systex | 1ed4a61fd972c265a1f12d4715eee85abe586bbfa93316a0d04b1b81412b9425

Analysis

max time kernel
148s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260604-xc4cgact71
SHA256 1ed4a61fd972c265a1f12d4715eee85abe586bbfa93316a0d04b1b81412b9425
MD5 2854194c3675d443ad0416efa3ef6fdb
SHA1 b3479b2117f8c0a9531ee43f164d25aec243922b
SHA512 5cea40c533d97fe2f2b2e7fb1ea7b55f5f08d7de7d912d639220d704fe8ee92dc7491936ca126b9eeb040036c67592bdcdf82ca3f44d121112b4d619a31b06f2
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:MghLQ0sQmpcF8BzXfwVfAI
TLSH
T103344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5084	CP.exe
2980	xrmkecwrje.exe
236	CP.exe
2276	CP.exe
4828	i_xrmkecwrje.exe
388	trmkecwuom.sys
4360	CP.exe
1616	hezwuomgeb.exe
1664	CP.exe
3284	CP.exe
2516	i_hezwuomgeb.exe
3580	uomjebwuom.sys
2884	CP.exe
1984	ljdbwtomge.exe
1780	CP.exe
3116	CP.exe
1888	i_ljdbwtomge.exe
4700	ljdbwtolge.sys
900	CP.exe
816	bwtnlgdywt.exe
4004	CP.exe
3996	CP.exe
2820	i_bwtnlgdywt.exe
2152	bvtnlgdywq.sys
492	CP.exe
4924	qoigaysnlf.exe
3128	CP.exe
3752	CP.exe
2724	i_qoigaysnlf.exe
2204	vtnlfdxvqn.sys
5116	CP.exe
3544	cavsnlfdxv.exe
1564	CP.exe
2420	CP.exe
3312	i_cavsnlfdxv.exe
2752	qkicavsnkf.sys
4776	CP.exe
2876	fdxvpnhfdx.exe
4488	CP.exe
3472	CP.exe
2644	i_fdxvpnhfdx.exe
568	ecxupnhfzx.sys
2972	CP.exe
388	upnhfzxrpk.exe
3428	CP.exe
940	CP.exe
1816	i_upnhfzxrpk.exe
4960	wupmhezxrp.sys
1560	CP.exe
4984	mhfzxrpjhb.exe
972	CP.exe
4612	CP.exe
4340	i_mhfzxrpjhb.exe
1452	urmkecxrpj.sys
4356	CP.exe
4616	zxrojhbztr.exe
4960	CP.exe
2180	CP.exe
1804	i_zxrojhbztr.exe
3684	jebwuomgey.sys
2232	CP.exe
2308	bwuomgeywr.exe
1080	CP.exe
436	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_301917525\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_722337728\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_722337728\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_545086218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_5165446\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_5165446\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_722337728\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_301917525\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrmkecwrje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwuomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtnlgdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecwrpmgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwuomgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvqnigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecwrpmgec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrmkecwrje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtnlgdywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1896	ipconfig.exe
2164	ipconfig.exe
3684	ipconfig.exe
2524	ipconfig.exe
2752	ipconfig.exe
4652	ipconfig.exe
1328	ipconfig.exe
3736	ipconfig.exe
3456	ipconfig.exe
4464	ipconfig.exe
1772	ipconfig.exe
576	ipconfig.exe
2040	ipconfig.exe
3820	ipconfig.exe
3456	ipconfig.exe
4940	ipconfig.exe
1632	ipconfig.exe
1228	ipconfig.exe
4524	ipconfig.exe
1124	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31257696"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3756063225"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250722097836531"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{C57F2861-94AE-4C0A-8984-1DB65328D3B3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe
2980	xrmkecwrje.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	i_xrmkecwrje.exe
Token: SeDebugPrivilege	2516	i_hezwuomgeb.exe
Token: SeDebugPrivilege	1888	i_ljdbwtomge.exe
Token: SeDebugPrivilege	2820	i_bwtnlgdywt.exe
Token: SeDebugPrivilege	2724	i_qoigaysnlf.exe
Token: SeDebugPrivilege	3312	i_cavsnlfdxv.exe
Token: SeDebugPrivilege	2644	i_fdxvpnhfdx.exe
Token: SeDebugPrivilege	1816	i_upnhfzxrpk.exe
Token: SeDebugPrivilege	4340	i_mhfzxrpjhb.exe
Token: SeDebugPrivilege	1804	i_zxrojhbztr.exe
Token: SeDebugPrivilege	448	i_bwuomgeywr.exe
Token: SeDebugPrivilege	1316	i_trljdbwtom.exe
Token: SeDebugPrivilege	4700	i_lgdyvqoiga.exe
Token: SeDebugPrivilege	2712	i_axvqnigays.exe
Token: SeDebugPrivilege	1888	i_fdxvpnifay.exe
Token: SeDebugPrivilege	1520	i_sqkicausnh.exe
Token: SeDebugPrivilege	568	i_czxrpkecwu.exe
Token: SeDebugPrivilege	2248	i_zwrpjhbzur.exe
Token: SeDebugPrivilege	3420	i_jecwrpmgec.exe
Token: SeDebugPrivilege	1720	i_zwqojgbztr.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 4052	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 1528 wrote to memory of 4388	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	81
PID 4388 wrote to memory of 1672	4388	iexplore.exe	82
PID 4052 wrote to memory of 1772	4052	iexplore.exe	83
PID 1672 wrote to memory of 4668	1672	msedge.exe	84
PID 1672 wrote to memory of 3488	1672	msedge.exe	85
PID 1672 wrote to memory of 1100	1672	msedge.exe	86
PID 1672 wrote to memory of 1100	1672	msedge.exe	86
PID 1672 wrote to memory of 1100	1672	msedge.exe	86
PID 1672 wrote to memory of 3076	1672	msedge.exe	88
PID 1672 wrote to memory of 3076	1672	msedge.exe	88
PID 1672 wrote to memory of 4384	1672	msedge.exe	89
PID 1672 wrote to memory of 4384	1672	msedge.exe	89
PID 1672 wrote to memory of 4384	1672	msedge.exe	89
PID 1672 wrote to memory of 2500	1672	msedge.exe	90
PID 1672 wrote to memory of 2500	1672	msedge.exe	90
PID 1672 wrote to memory of 2500	1672	msedge.exe	90
PID 1672 wrote to memory of 4436	1672	msedge.exe	91
PID 1672 wrote to memory of 4124	1672	msedge.exe	92
PID 1672 wrote to memory of 4436	1672	msedge.exe	91
PID 1672 wrote to memory of 4436	1672	msedge.exe	91
PID 1672 wrote to memory of 5000	1672	msedge.exe	93
PID 1672 wrote to memory of 3544	1672	msedge.exe	94
PID 1672 wrote to memory of 5096	1672	msedge.exe	95
PID 1672 wrote to memory of 5000	1672	msedge.exe	93
PID 1672 wrote to memory of 5000	1672	msedge.exe	93
PID 1672 wrote to memory of 3544	1672	msedge.exe	94
PID 1672 wrote to memory of 3544	1672	msedge.exe	94
PID 1672 wrote to memory of 5096	1672	msedge.exe	95
PID 1672 wrote to memory of 5096	1672	msedge.exe	95
PID 1672 wrote to memory of 4124	1672	msedge.exe	92
PID 1672 wrote to memory of 4124	1672	msedge.exe	92
PID 1672 wrote to memory of 844	1672	msedge.exe	97
PID 1672 wrote to memory of 844	1672	msedge.exe	97
PID 1672 wrote to memory of 1556	1672	msedge.exe	98
PID 1672 wrote to memory of 1556	1672	msedge.exe	98
PID 1672 wrote to memory of 3464	1672	msedge.exe	100
PID 1672 wrote to memory of 2244	1672	msedge.exe	101
PID 1672 wrote to memory of 3464	1672	msedge.exe	100
PID 1672 wrote to memory of 2244	1672	msedge.exe	101
PID 1672 wrote to memory of 3328	1672	msedge.exe	103
PID 1672 wrote to memory of 5092	1672	msedge.exe	104
PID 5092 wrote to memory of 2132	5092	msedge.exe	105
PID 1672 wrote to memory of 2748	1672	msedge.exe	106
PID 1672 wrote to memory of 2748	1672	msedge.exe	106
PID 1672 wrote to memory of 1052	1672	msedge.exe	107
PID 1672 wrote to memory of 1052	1672	msedge.exe	107
PID 1528 wrote to memory of 5084	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 2980 wrote to memory of 236	2980	xrmkecwrje.exe	111
PID 1672 wrote to memory of 1036	1672	msedge.exe	114
PID 1672 wrote to memory of 1036	1672	msedge.exe	114
PID 1672 wrote to memory of 492	1672	msedge.exe	115
PID 1672 wrote to memory of 492	1672	msedge.exe	115
PID 1672 wrote to memory of 1480	1672	msedge.exe	116
PID 1672 wrote to memory of 1480	1672	msedge.exe	116
PID 1528 wrote to memory of 2276	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 1528 wrote to memory of 4360	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 1616 wrote to memory of 1664	1616	hezwuomgeb.exe	123
PID 1528 wrote to memory of 3284	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 1528 wrote to memory of 2884	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 1984 wrote to memory of 1780	1984	ljdbwtomge.exe	132
PID 1528 wrote to memory of 3116	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1528 wrote to memory of 900	1528	2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 816 wrote to memory of 4004	816	bwtnlgdywt.exe	141

C:\Users\Admin\AppData\Local\Temp\2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_2854194c3675d443ad0416efa3ef6fdb_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:1772
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2b8,0x2e4,0x2e8,0x2c0,0x308,0x7ffb95a3c188,0x7ffb95a3c194,0x7ffb95a3c1a0
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,13256464564592136014,13573354547409257691,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:11
      4⤵
      System Time Discovery
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1874901646143055784,14138735739547497801,262144 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
      4⤵
      PID:1100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,14892353565073984437,3858774641573494305,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
      4⤵
      PID:3076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1356627302726246610,15887759067581748568,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,3232253607314925926,17860706571093096286,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,13235095130136778590,11037579337473793249,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,2723093005035892585,9680884822766759654,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,15903676888483587796,17177174045110594159,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4288,i,11689005675668155368,952224163496915116,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:3544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4484,i,270006540524102103,13051561640051676933,2097152 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,1481271276528685132,10215883531942351099,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:14
      4⤵
      PID:844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,10788701575971294513,14952202800615796719,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,1565863258475494456,5459419779879020831,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15687400792934447919,3972638507658871280,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4397866898633407146,15596467637246765893,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,4397866898633407146,15596467637246765893,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,15385646999905766031,11520542607467543525,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:2132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,15696006281614776261,2798620547531626859,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,14729497844711526295,4068595661226525750,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,11441771118375218356,12880713281140070811,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,8173050320878097752,14295941035598149754,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:14
      4⤵
      PID:492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,11479829418864355915,2858177102232088528,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,9765663527767531444,8618492439675881241,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,12006196667705434997,6423517355827480682,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,18035817631277282120,1614315540185275134,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,4332154330243216047,3689042800422378399,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,6666167950909795921,10128741365948619002,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,9505440393594285123,13488800425449264819,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,12506305680153336315,10617137430709441381,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6368,i,3638475622998381056,8982629291661639829,262144 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:10
      4⤵
      PID:396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5944353416290551959,1788064628924711139,524288 --field-trial-handle=2124,i,17991489213900951857,16512484709128752261,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:14
      4⤵
      PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrmkecwrje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5084
- - C:\Temp\xrmkecwrje.exe
    C:\Temp\xrmkecwrje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrmkecwrje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\i_xrmkecwrje.exe
    C:\Temp\i_xrmkecwrje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwuomgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\hezwuomgeb.exe
    C:\Temp\hezwuomgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwuomgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3284
- - C:\Temp\i_hezwuomgeb.exe
    C:\Temp\i_hezwuomgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Temp\ljdbwtomge.exe
    C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3116
- - C:\Temp\i_ljdbwtomge.exe
    C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtnlgdywt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:900
- - C:\Temp\bwtnlgdywt.exe
    C:\Temp\bwtnlgdywt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtnlgdywt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3996
- - C:\Temp\i_bwtnlgdywt.exe
    C:\Temp\i_bwtnlgdywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:492
- - C:\Temp\qoigaysnlf.exe
    C:\Temp\qoigaysnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\i_qoigaysnlf.exe
    C:\Temp\i_qoigaysnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\cavsnlfdxv.exe
    C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2420
- - C:\Temp\i_cavsnlfdxv.exe
    C:\Temp\i_cavsnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4776
- - C:\Temp\fdxvpnhfdx.exe
    C:\Temp\fdxvpnhfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\i_fdxvpnhfdx.exe
    C:\Temp\i_fdxvpnhfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2972
- - C:\Temp\upnhfzxrpk.exe
    C:\Temp\upnhfzxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:940
- - C:\Temp\i_upnhfzxrpk.exe
    C:\Temp\i_upnhfzxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1560
- - C:\Temp\mhfzxrpjhb.exe
    C:\Temp\mhfzxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\i_mhfzxrpjhb.exe
    C:\Temp\i_mhfzxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrojhbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4356
- - C:\Temp\zxrojhbztr.exe
    C:\Temp\zxrojhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrojhbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2180
- - C:\Temp\i_zxrojhbztr.exe
    C:\Temp\i_zxrojhbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgeywr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Temp\bwuomgeywr.exe
    C:\Temp\bwuomgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgeywr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:436
- - C:\Temp\i_bwuomgeywr.exe
    C:\Temp\i_bwuomgeywr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  PID:1816
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  PID:2772
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdyvqoiga.exe ups_run
  2⤵
  PID:1928
- - C:\Temp\lgdyvqoiga.exe
    C:\Temp\lgdyvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdyvqoiga.exe ups_ins
  2⤵
  PID:3252
- - C:\Temp\i_lgdyvqoiga.exe
    C:\Temp\i_lgdyvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvqnigays.exe ups_run
  2⤵
  PID:572
- - C:\Temp\axvqnigays.exe
    C:\Temp\axvqnigays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvqnigays.exe ups_ins
  2⤵
  PID:576
- - C:\Temp\i_axvqnigays.exe
    C:\Temp\i_axvqnigays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  PID:4852
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  PID:2140
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnh.exe ups_run
  2⤵
  PID:2112
- - C:\Temp\sqkicausnh.exe
    C:\Temp\sqkicausnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnh.exe ups_ins
  2⤵
  PID:2872
- - C:\Temp\i_sqkicausnh.exe
    C:\Temp\i_sqkicausnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxrpkecwu.exe ups_run
  2⤵
  PID:1604
- - C:\Temp\czxrpkecwu.exe
    C:\Temp\czxrpkecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxrpkecwu.exe ups_ins
  2⤵
  PID:3736
- - C:\Temp\i_czxrpkecwu.exe
    C:\Temp\i_czxrpkecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbzur.exe ups_run
  2⤵
  PID:1632
- - C:\Temp\zwrpjhbzur.exe
    C:\Temp\zwrpjhbzur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbzur.exe ups_ins
  2⤵
  PID:1128
- - C:\Temp\i_zwrpjhbzur.exe
    C:\Temp\i_zwrpjhbzur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecwrpmgec.exe ups_run
  2⤵
  PID:1228
- - C:\Temp\jecwrpmgec.exe
    C:\Temp\jecwrpmgec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecwrpmgec.exe ups_ins
  2⤵
  PID:4484
- - C:\Temp\i_jecwrpmgec.exe
    C:\Temp\i_jecwrpmgec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwqojgbztr.exe ups_run
  2⤵
  PID:2712
- - C:\Temp\zwqojgbztr.exe
    C:\Temp\zwqojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwqojgbztr.exe ups_ins
  2⤵
  PID:784
- - C:\Temp\i_zwqojgbztr.exe
    C:\Temp\i_zwqojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

C:\Temp\trmkecwuom.sys
C:\Temp\trmkecwuom.sys
1⤵
- Executes dropped EXE
PID:388

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
- Executes dropped EXE
PID:3580

C:\Temp\ljdbwtolge.sys
C:\Temp\ljdbwtolge.sys
1⤵
- Executes dropped EXE
PID:4700

C:\Temp\bvtnlgdywq.sys
C:\Temp\bvtnlgdywq.sys
1⤵
- Executes dropped EXE
PID:2152

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:2204

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\ecxupnhfzx.sys
C:\Temp\ecxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:568

C:\Temp\wupmhezxrp.sys
C:\Temp\wupmhezxrp.sys
1⤵
- Executes dropped EXE
PID:4960

C:\Temp\urmkecxrpj.sys
C:\Temp\urmkecxrpj.sys
1⤵
- Executes dropped EXE
PID:1452

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:3684

C:\Temp\eywqoigbyt.sys
C:\Temp\eywqoigbyt.sys
1⤵
PID:692

C:\Temp\vqoigaytql.sys
C:\Temp\vqoigaytql.sys
1⤵
PID:1228

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:1152

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:784

C:\Temp\cxvpnhfaxs.sys
C:\Temp\cxvpnhfaxs.sys
1⤵
PID:3024

C:\Temp\spkecxrpkh.sys
C:\Temp\spkecxrpkh.sys
1⤵
PID:1128

C:\Temp\smkecwupmh.sys
C:\Temp\smkecwupmh.sys
1⤵
PID:1556

C:\Temp\rpjhbzurmk.sys
C:\Temp\rpjhbzurmk.sys
1⤵
PID:3032

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
PID:3848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywq.sys

Path C:\Temp\bvtnlgdywq.sys
Size 141KB
SHA256 b420cdf18cc3ed724f53550d89f193645bf3aea7ba4b60d78f22335bcdda94dc
MD5 560d552b507de55489316460819cc776
SHA1 6895890d97b54c4da6660ab61c93f3be7acdb066
SHA512 317388380ce245a913b6d64e3ad15f031f0d018246f92526860fb4fd350ea6eae80baee13217d5992c717f379984c20f79ad2ca3abda26001ba2972562e0f666
SSDEEP 3072:8sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:8sQmpcF8BzXfwV
TLSH
T1D7E38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtnlgdywt.exe

Path C:\Temp\bwtnlgdywt.exe
Size 230KB
SHA256 04d9f51738474f8baf8280a614ba71d38350df3b2c7be36ffefca1e35732a9ec
MD5 90a193ea37c45a71eeb6c3dd4f6d2cf1
SHA1 47051fdced60b52b3eeb7fd1a50964d0ca4107aa
SHA512 94a352e5e45d2086fe639ca9b8bd121088576d3fa95c903ce6e31ce056f8ec982a0578cdd5fab9c5d9042052022fd4c7943ab5aa9efc55a6b9d27add0c6c6e2d
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezwuomgeb.exe

Path C:\Temp\hezwuomgeb.exe
Size 230KB
SHA256 cb546bdccc40d5de9cc1781cacae3ea26cfe87282758d078b30223d50cbc44b1
MD5 c91bd815c341f06ca46d2acdf40fa159
SHA1 7ec3af588fcd569e6cf2bc39183ed3a22e708a8c
SHA512 ed52ed9d71691fe4ae2747be8c051d6793b88f6545150acd9b652454ce9a689f60e1959183756f7357ede9da69c62d1a34e6905b61a0529b1daf550316b36455
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T121344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtnlgdywt.exe

Path C:\Temp\i_bwtnlgdywt.exe
Size 230KB
SHA256 ed7e8dbce3c0c3107aedf977cc98afec294ec918f6baace091c77b891f3587ba
MD5 5692ba6d8514f0d8de1c0f07d620fc28
SHA1 83698a2435f914c89a9730b6ecb03b7c4955a79a
SHA512 73efb326c91507a89f04eec3f2b58f5e0adf937ace7ebf5f5c83c815e0881e2a8da438989b05d077b9e0816d95104e00ff2376cb0b90df5aad6eedcc141e2866
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T18C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezwuomgeb.exe

Path C:\Temp\i_hezwuomgeb.exe
Size 230KB
SHA256 85011cc8f76f19a3b6589a4137a6e4a3a802de33ae0aef92255959c225bea2d6
MD5 15b4db186a69cf7f3316b973f5746581
SHA1 9a92ec3f49dcfc07e0a5a1e0080aff9947a29f22
SHA512 8eccf355cce455ed902a9db50958e4cbf7abb71c92b473e261c72aa776d337d119c7e4aaaa3f35da08e740cb3545ef240b300a227c465761465371e1680b9a14
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T106344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbwtomge.exe

Path C:\Temp\i_ljdbwtomge.exe
Size 230KB
SHA256 d7e230d0edc9e0344445b8c40e4f6f56854426018ae39989308ecc2213e5229b
MD5 b5f970af632df259b8927fdf52446dd8
SHA1 363e65e4cbd9366a70b5f4f4d63e25db1453aea9
SHA512 0110779ee4415ecb6294bce18d32bc0ae8639d1c6dbc6959be3131fc3af9a21a62f115c3a5f9ddfc3220cf2349bb8ae0e6818cabdbf57c4259c7aa998b32d8ae
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T188344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysnlf.exe

Path C:\Temp\i_qoigaysnlf.exe
Size 230KB
SHA256 58e2d846a7ffdb7dd4d462512a3664a595f42cf8aa633c43dba1661b5021b3f9
MD5 e9721ee707926fa2d62f340a91d08190
SHA1 3c07a30c5f8d03addbfa50b230084e153f60c308
SHA512 7d236855c8fbb7e6e7ffe4f7eea6f750a091659e48a5e769af0a5f33cf83284187743c8f39feb0219d74dbc8776d2f4f1eab2e332096be65d8dcd34edaab9b64
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrmkecwrje.exe

Path C:\Temp\i_xrmkecwrje.exe
Size 230KB
SHA256 dd6de8fe4d47167f45d31fbeab802004ff10f1d53987411e1cd2e670da214cfe
MD5 2843d7470eb2bfe9b61b17a08d650718
SHA1 234b0120f7a033148302a111e565efa66b7d2843
SHA512 639434ccd8922c762b5ea9ae671b21fd57442f09275a8b1703eae71676d35114ebc512526097ae85155b1bf8a486f2209e7a6544367e35136737c0567334464b
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtolge.sys

Path C:\Temp\ljdbwtolge.sys
Size 141KB
SHA256 65cde97c4d51eb453216510d58c9c3455419e40745f00504d5e7104ca969b453
MD5 d0b26a28421d81f1cb455b80dc425785
SHA1 3a753ab3e891ed2fe404060faafcafd3c703e9d2
SHA512 6c3b1fa6c8498b586a82dee3f8a3723a1bbf38efa210113f0baaf59a6ea0d2174c7934fea05331d1b3d249d153bdf99b2cc969e03538bce05437aca4fa6adec1
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T194E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtomge.exe

Path C:\Temp\ljdbwtomge.exe
Size 230KB
SHA256 b5b7faffc9f1ecfb07aac4b852541592ffa282d3d442ab271a15e92553437c79
MD5 99704768748f5dc24c1706b805de72d8
SHA1 720435b42e6465077476bd27f595004e99568082
SHA512 2b7308d52f32f784231e574889ec450a96857877dd46c138babcb4f2db367b270178808ed22485e55f2b6349fde90867a64c32dbca7e47c95ebd41048cd4c32e
SSDEEP 3072:nJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:nghLQ0sQmpcF8BzXfwVfAI
TLSH
T16F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysnlf.exe

Path C:\Temp\qoigaysnlf.exe
Size 230KB
SHA256 8c631a40944da96358ef4fba8196d409d7b2aef2955a7beaf4abd936cae43371
MD5 9ec680780bd3a9ad480331381936b2ca
SHA1 e920d758c09c32b9fd023a7062efa847ceb0fe2b
SHA512 1715de1287d3392838e2dda5aeb3e24894abd56fa8cd794ed5ebe02791ec4d6fb54e4b5159d8d9317129c04598114cdaf48e1952dd79149163ba82663ce9706c
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmkecwuom.sys

Path C:\Temp\trmkecwuom.sys
Size 141KB
SHA256 5e68752e620247a331c07a6b87f5bcb762e5390c04df1be421efff3c532214b4
MD5 e5ea027789811c85f456ec41418549a1
SHA1 80d4aec71ed02f19513fd2f2b5997e2c833c9c14
SHA512 e987f2006d7a4a7801d62d7b70ccc398057fef4d0582a0ff7897fb200f258b46a95eb2ab65e3b700fbc3b71a9a352c4dac3879b85c3562b80db4ea21708de8f2
SSDEEP 3072:SsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:SsQmpcF8BzXfwV
TLSH
T1C6E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjebwuom.sys

Path C:\Temp\uomjebwuom.sys
Size 141KB
SHA256 f4ed03aa3d261f5873f8799a8d3965ddcc9a8b52ff6bcdc1d2a0de6c690a666a
MD5 1460270fd97163d3b60199c1cea21f3f
SHA1 99a59d82942128e5b7b0bdba91540150b656a699
SHA512 02d22fed4ae966d2015a9786d1ccd9cda0c34d6e0901c570823cd9e1acb7fd39d961c35ac96d050e6b0259a8a930a13a8db576fbeeedff10d9a16464d27ba1fc
SSDEEP 3072:hsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:hsQmpcF8BzXfwV
TLSH
T11EE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvqn.sys

Path C:\Temp\vtnlfdxvqn.sys
Size 141KB
SHA256 0ea41d01ba7273a8616c69f4f2cf050a79bcb245ea03e976a87e1627f699bc69
MD5 954d1582efd514749ea02ad96af32c69
SHA1 e0205be89795b56a69818bd0f52132b4307c2d9b
SHA512 46ece0810f75d92f023cfae7e1704480806389f3a4fa2d8e3eb6c798b8df195119a461481cd0933886a977abf9400f8b0aa7fc4ea124ba3355d7bc68c122a874
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T173E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrmkecwrje.exe

Path C:\Temp\xrmkecwrje.exe
Size 230KB
SHA256 4dab396cceac5cfbe397b8f44c27f1e7729e8a293440015e98f13ffdd7620219
MD5 edba0f361bcf1123b2ee517f8f6cb054
SHA1 31c4ab4716565c45cd076e8f38afd77db15b8f5a
SHA512 410a245f0c2626de6288060a7b94394f1de473ccc23a968f6cb0090bdc87d97f10279cbbf91da39ead094efe3427396eb6bbc8b279b17e8242842f7792a88ad2
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T10F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6e5382ae3716dd69af33358250564b478b19f1f6b3156bba0e813f630ed24101
MD5 c7c933e8225f15cfb0d9b11e42cea3f2
SHA1 6bf74ef81f9ea46a1d0a386eecdcf01f41ce4f39
SHA512 f1453c66f98c9fb7c4be6feb9296bfbf2c002c202979e67204f15260973710f0c6471756e324a2a72ba93bb14bcf0eb5a30c2cb4a8bcbe1d79f7ace3031cca22
TLSH
T1EA71613D03224997E3C10C3395C153A07E71C8B21AB34F15FA949E74E7167E6C4A52EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58771f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58771f.TMP
Size 3KB
SHA256 318b571a87d5ba21806ed4f02852501348bf40a8887889226dd1336268271339
MD5 da1a122827bf1399741ce94f7215a875
SHA1 95c7d64416437e7dcb87e5daaf1911bcf2beda70
SHA512 857be3478f5711b701482841ac956ce9a4d03f2bb51035e910986bf89b87ac264d54817f3dd4a5dcd247bdba3da114930ce149402f6a576dbcec885fc8dd5053
TLSH
T11D71703D03225997E3C50C3395C153A07E72C8B21AB34F19FA94AE74EB167E6C4A52EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8068d4413681c091ce1d6c53b4df4ab8cb99612eb4f19cd3bbaac8e061b0c0d4
MD5 9e6784d1f6fc1f2c3e9f4267a27e47c0
SHA1 1788be2185b3f78124faf03e0395da2eec89fa15
SHA512 3148369368a9740fb9e4ecd0a36a7188b49296d1b6a9ae2b5102b99912a0b64183a1aae165ca1457e7fa1596ae4e78694217f5e29f17157ecf406aabd9cf284b
TLSH
T1EB419FF3C3E8856D8A0156F0B624AF1BCE6D0954832C3D5AC5E4AF1B93E2471E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 379d72a7c53887b7f95dc211c5dc215d25b31db373666b58317010f0ef587d65
MD5 67cb54c03803da8c354a9e936d6a5c33
SHA1 e71d586ecebf64163ab96fdbf18a2a1efe29e0a1
SHA512 03deffad8ffbcb518b31718d18c9bed8d7cb9c355251d124d2c25992673a00a4fcebdcc0886daaf09ff365c6358b6e453268114184e2bf8be771147360211084
SSDEEP 192:sxZiRdyM/jK1Ml8Mco/ffsNq/XDeZGIdp/0/W6+WNsznfY0obi8Ig4J:sxZin0o/ffsE/zeM/bYf5wc
TLSH
T1D752F9066A34597BCCDBD209FA55BB53D6F9157392900D48AAFCDA0C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ca16eebea00990f8e9f8a7bf4da6a981afc5fd97892503228ad8d0383511fee1
MD5 60b097381a56a3f146154a0af8c9eaa9
SHA1 fefb6fdc9699ff58b1069a16fc3920de3405a750
SHA512 2a06f1830b6895b64af62c3b9bdc6dd064f231c6ba50d18911ffa8cbc54079b9a17efe8c3fb8ba93c6ed1daa595d111571c9763c8df690240e5f9365c86e371c
SSDEEP 192:sxZiRdyM/jK1Ml8UQtcco/ffs7qhXDeZGIdpZ0/W6+WNsznfY0oUi8Ig5OJ:sxZinqt7o/ffsuhzem/bYf5Xk
TLSH
T17A62E906AA345977CCDBD209B955BB53D6F8157392910E48AAFCDA0C01E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7455809814da6c2ce5e234d3a06c8c40e9e9ec874e647c7cfa25f61cde887ed3
MD5 c00cbd1818949748d732e67eade2bd1d
SHA1 26bd5a3f81902ce0adfc15aa737f428977f28596
SHA512 c97e953c7729ecce4ee2652e839941e21253089b23114405767770f72679a0cc77a5caed8d0c167ef69f94693c9da79669e3b5e4b576eec12d8f6369c7f35d24
SSDEEP 768:S2c0s8Ww2Ci7pLuLX/fWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3et6OLl2:S2c0s8Ww2C6EX/fWRm/JQg1u1jaKet6T
TLSH
T1CB030A3B2C0CCB7E4F844E9CED26BE8A6DE8018B6698895447FA444C03C76EF56165DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b9b1f15ceaeeebb60d13d1b3e99ab0cf7245ee2b3e1df8372b74108dd4e6398
MD5 9d06ae06783eddcbc6f48f022fda5fd7
SHA1 7a73980171d9e5c548dc1eb1ef1b3a1a8ae48fdf
SHA512 da8d0928c2aa9646091e1e631a87c56452e70d50f7fda030ecb46484fb6ac38067c9c209a89a8a7e8d769b3ec259c88a975b311c9ddd9297ac017295803a0efc
SSDEEP 24:KdCfFufa0dIUw4As+jIjqwKiDhaMw1EagSmOMX8CdyXYof/sdaCdK6W4KG+dIjAi:KQTINKQMgvyVhIlKC4oG8ILKVCc/yY
TLSH
T1C5919F52307A13913D7E7908D3D09B2A4A82B2A7319AE42B3FF844B25E67E101DFD5CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591275.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591275.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bc3f52fdc77ad39634709cf43d8fe00d924d0d869cc954845e082551aa0eeb5d
MD5 592b6c5dc96724196d307a2e5ea0342d
SHA1 7ca1cdd5dda1468de6de1a3b05a4d43772d4f5ca
SHA512 7b51a152d4862420eceb75b30f5e89dc742e434de2fe5199f633c4326b298c1eedd74698d5d6e2d91f3871235eacad053fe5d363e751d63a818ad4f6b6c64eb4
SSDEEP 384:nrtNnNnb9j8NJdStvEw+ORq2Uu8Yuus3WKuGk+2xB08jZALEnknbN:rjZbF3tvxq/Cu1GK2lxB064N
TLSH
T1E8926C756C3A9DB79DE66155FA4732879F7410A78D852F88D6FCAF0C00DB28C231AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d10974d0ad88c3087301ca363bcf25e2feb8cafd8b490ebe16cb877fa9391504
MD5 4bba74ad86e4b83764507f3a399f31e1
SHA1 351ef99c9d3eaf3fea7fa9b5d9e2fcd47244bc9b
SHA512 0fcbcf0de940cbe150eb606d9c0f5f430c52afb3339257cad20f300bcc06c051f0a53aceb9d8696a69eb38b9f553ac59997896e8a1646cbf80f51d57065e4e33
SSDEEP 192:XGN26jCQmiUyeIBf4SufoPxzYzSus6+1oCSn9bNU6:XGN26qdefju8Yuus3WfNNU6
TLSH
T1A502B9356C68AC7B9EB36E45FA8737135FA5112BE9852F44DAF81F0C00E769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 632d2861c9f1615bc059d2e262bdca3902c7b98ae8722f25b1582d11976f5f95
MD5 7d46deaba8cb875ad00e49010a19a7f8
SHA1 07168bfe34255ae69cc311315bc99ea37c575089
SHA512 39acb8ec8293c151b0d79ca6fa938c16ec1a0ba9848633c864b0b0426c3fa2fdb3bc2d2181fb00f9244b5395fa6b08b0c983a5e112973ab7a9f7f6558280318b
SSDEEP 384:nrtNnNnb9I8NJdStvEw+SRq2Uu8Yuus3WKuGk+2xB08jZALEnknbN:rjZb63tvVq/Cu1GK2lxB064N
TLSH
T1C1926C756C3A9DB79DE66155FA4732879F7410A78D852F88D6FCAF0C00DB28C231AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3c05a72ab24b367dc26b43ff89c6f16a6bab0807e485188d4a152f749dd7f923
MD5 13a53b52ba04e00a578a534ddde2f848
SHA1 9418dab394117dce933156a3cf3135c11700e919
SHA512 3bc2b3911fc861540f675565c16fcd27a3f3692673697ced4c7afd2c800378de575ced67df1b464485a669c6660492d43efafe4be97dcb5c7ba29d6e9fc8ae76
SSDEEP 384:nctNnNnb9l8NJwStvEw+DRq2Uu8Yuus3WKuGk+2xB08jZALEnknbN:cjZbPstvcq/Cu1GK2lxB064N
TLSH
T1D4926C756C3A9DB79DE66155FA4B32879FB410A78C842F88D6FCAF0C00DB28C2319C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 915d3cc66134d63f999c2ec4657daf95cd5c84d6c3b7f748b603a6a6ace6016f
MD5 02dbc2dd1d4449e27f2cb0e865f0ae18
SHA1 8708f59e03301183964a398247b3f4954507b900
SHA512 e9e699f672b429f9c4ab4bcd99339dc3d55053aa194f6d3e4b8cd032de3c149731f2bc5211d99989bc860951808cd03507d96a7231b76f9a9460bdb25f659b23
SSDEEP 192:XGNM6jiQmiUypBT4SufoPxzYzSus6+1ofSuv+k+2NOMGqFSU6:XGNM6SqTju8Yuus3WKuGk+2B0U6
TLSH
T1AE12F7746869EC27AEA36554FA8737539FA52037ED856F48E6F81F0C00D768C234A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c4f0462e79396d94a025bc1f89e375b31c1e88184eab3320f9b27bcae8aee0bb
MD5 3a4ada112cd0971bab095247e6c23833
SHA1 6f02fcbbb1d78eb2b03c27452894074399562184
SHA512 e6d5fbe0bb6c4194a2d3c5de0c2849e4b65657611ab0f923af7ecc98de173acda93a65f75527bccab092a44840c1abf68a5bb3133b1ff40e3edc165178b277d8
SSDEEP 384:nXtNnNnb9l8NJcStvEw+iRq2Uu8Yuus3WKuGk+2k08jZALEnknbN:XjZbP8tv1q/Cu1GK2lk064N
TLSH
T115925B75683A9DB79EE66115FA4B32879F7411A78D852F88D6FCAF0C00DB28C2319C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 507d10a2fcf67357141b2bbb57709288a7dad3c5f1f752f7b83e107f3ee346ba
MD5 9d308721a92045168ae701f28b7d1eb3
SHA1 e9700bff6e117fb8a7a7edc817f66b8bdbbc5ac9
SHA512 b9d3cbb92930ffabe766810ad222953646ec77b3b76e917a8bc863fc211c03e90df0478f4e3f5adca72d86e4b9905005a7cabde76d1d2b1d1d523ce743dab989
SSDEEP 384:nFiFKtNnNnb9+8Nr8TUNTUlIldStvEw+tRq2qDfQ/u8Yuus3WKuGk+2lJ08jZALB:MFKjZbI2wgOtv6qy/Cu1GK2llJ064N
TLSH
T13EC22976D865DA7BADE75785FB0772879FF001A389886EC8DAD86E0C00D72DD230AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ca5503995cf39750df612713f45f2b42c1172d7754c01e5c36ede74252deb8e8
MD5 7147d1aabda35fe93cfa6db8d53c0477
SHA1 4cc7b879eb46028e93633cebd5229357ac61cc9d
SHA512 0aa2c892bffe7a357de45a717f0f7799cf3e37ca479f63323fa56304f59e3084b9c3683d25f7eac63c13d66c175baff75fe4204535e77b128d79c5e163527a49
SSDEEP 192:zJGNJ1j9+dQmiU139+ZJSufoPxzYzSus6+1ofSuv+k+2NOhGqFSU9:zJGNJ1BKT0Uu8Yuus3WKuGk+2Y0U9
TLSH
T1F322F7746869EC379DA36558FA8737A39FA520379D852F48E6F81F0C009728C234AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

3eaeecce-7680-400d-8913-a203ee3eee8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3eaeecce-7680-400d-8913-a203ee3eee8f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8f8bcf6a-93f5-4602-b6ca-b983f0890683.tmp

Path C:\Users\Admin\AppData\Local\Temp\8f8bcf6a-93f5-4602-b6ca-b983f0890683.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92aba6b-4aff-4b8f-99f7-7bf609071d93.tmp

Path C:\Users\Admin\AppData\Local\Temp\b92aba6b-4aff-4b8f-99f7-7bf609071d93.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1672_1657512191\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3aedfb10-0e82-4a9f-8fc3-f01ae68b90b3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1672_696052271\3aedfb10-0e82-4a9f-8fc3-f01ae68b90b3.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_301917525\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_5165446\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_545086218\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1672_722337728\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/388-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/568-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/692-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/784-751-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-796-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-731-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1452-651-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-836-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-809-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2152-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2204-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2204-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3024-773-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3024-797-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-835-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3032-849-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3580-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3684-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3848-848-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4700-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4960-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download