systex | 52e6eb370760951403a852b024362f3af1aa54b38072b17c9c17465d369b2f18

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Size 291KB
Sample260715-vs8wsads8x
SHA256 52e6eb370760951403a852b024362f3af1aa54b38072b17c9c17465d369b2f18
MD5 30715279386ee229f814a1a61ab108ad
SHA1 7c842a3f2db8543fcb663fbc82d9205dc3a902b1
SHA512 d8bba6247bf475a6a1619101ac04cdcafd0a8c4331550ca038e0307dcfc33a03aa1a27d1453c6c57b0265bb1eddf1b7cfdb01a0e0350db32d4927830f4c0da70
SSDEEP 3072:tJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:tghLWsQmpcF8BzXfwVTTIr6N
TLSH
T106544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan upx

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/1136-0-0x00000000004B0000-0x00000000004FB000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5bc-71.dat	UPX
behavioral2/memory/5980-72-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/memory/5980-75-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/files/0x00060000000187f3-168.dat	UPX
behavioral2/memory/2112-169-0x0000000000370000-0x00000000003BB000-memory.dmp	UPX
behavioral2/memory/1136-199-0x00000000004B0000-0x00000000004FB000-memory.dmp	UPX
behavioral2/memory/2112-201-0x0000000000370000-0x00000000003BB000-memory.dmp	UPX
behavioral2/files/0x000c0000000187e5-233.dat	UPX
behavioral2/memory/3388-234-0x0000000000F70000-0x0000000000FBB000-memory.dmp	UPX
behavioral2/memory/3388-237-0x0000000000F70000-0x0000000000FBB000-memory.dmp	UPX
behavioral2/files/0x000d0000000187e5-240.dat	UPX
behavioral2/memory/4964-241-0x0000000000430000-0x000000000047B000-memory.dmp	UPX
behavioral2/memory/4964-252-0x0000000000430000-0x000000000047B000-memory.dmp	UPX
behavioral2/files/0x000e0000000187e5-257.dat	UPX
behavioral2/memory/4284-258-0x0000000000960000-0x00000000009AB000-memory.dmp	UPX
behavioral2/memory/4284-261-0x0000000000960000-0x00000000009AB000-memory.dmp	UPX
behavioral2/files/0x000700000001b82c-280.dat	UPX
behavioral2/memory/4180-281-0x00000000008B0000-0x00000000008FB000-memory.dmp	UPX
behavioral2/memory/4180-284-0x00000000008B0000-0x00000000008FB000-memory.dmp	UPX
behavioral2/files/0x000800000001b82c-289.dat	UPX
behavioral2/memory/248-290-0x0000000000060000-0x00000000000AB000-memory.dmp	UPX
behavioral2/memory/248-293-0x0000000000060000-0x00000000000AB000-memory.dmp	UPX
behavioral2/files/0x000c00000001c5d3-296.dat	UPX
behavioral2/memory/2408-297-0x0000000000C90000-0x0000000000CDB000-memory.dmp	UPX
behavioral2/memory/2408-300-0x0000000000C90000-0x0000000000CDB000-memory.dmp	UPX
behavioral2/files/0x000d00000001c5d3-305.dat	UPX
behavioral2/memory/5896-306-0x00000000003E0000-0x000000000042B000-memory.dmp	UPX
behavioral2/memory/5896-309-0x00000000003E0000-0x000000000042B000-memory.dmp	UPX
behavioral2/files/0x000e00000001c5d3-312.dat	UPX
behavioral2/memory/2816-314-0x00000000009B0000-0x00000000009FB000-memory.dmp	UPX
behavioral2/memory/2816-316-0x00000000009B0000-0x00000000009FB000-memory.dmp	UPX
behavioral2/files/0x00110000000187e5-338.dat	UPX
behavioral2/memory/4744-340-0x0000000000CE0000-0x0000000000D2B000-memory.dmp	UPX
behavioral2/memory/4744-342-0x0000000000CE0000-0x0000000000D2B000-memory.dmp	UPX
behavioral2/files/0x00120000000187e5-345.dat	UPX
behavioral2/memory/2928-346-0x00000000008F0000-0x000000000093B000-memory.dmp	UPX
behavioral2/memory/2928-349-0x00000000008F0000-0x000000000093B000-memory.dmp	UPX
behavioral2/memory/4088-352-0x00000000002C0000-0x000000000030B000-memory.dmp	UPX
behavioral2/memory/4088-353-0x00000000002C0000-0x000000000030B000-memory.dmp	UPX
behavioral2/memory/4996-355-0x0000000000AB0000-0x0000000000AFB000-memory.dmp	UPX
behavioral2/memory/4996-357-0x0000000000AB0000-0x0000000000AFB000-memory.dmp	UPX
behavioral2/memory/5908-360-0x0000000000340000-0x000000000038B000-memory.dmp	UPX
behavioral2/memory/5908-361-0x0000000000340000-0x000000000038B000-memory.dmp	UPX
behavioral2/memory/480-363-0x0000000000E20000-0x0000000000E6B000-memory.dmp	UPX
behavioral2/memory/480-365-0x0000000000E20000-0x0000000000E6B000-memory.dmp	UPX
behavioral2/memory/2012-369-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	UPX
behavioral2/memory/2012-370-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	UPX
behavioral2/memory/5488-372-0x0000000000FD0000-0x000000000101B000-memory.dmp	UPX
behavioral2/memory/5488-374-0x0000000000FD0000-0x000000000101B000-memory.dmp	UPX
behavioral2/memory/2440-398-0x0000000000E20000-0x0000000000E6B000-memory.dmp	UPX
behavioral2/memory/2440-399-0x0000000000E20000-0x0000000000E6B000-memory.dmp	UPX
behavioral2/memory/4280-401-0x0000000000330000-0x000000000037B000-memory.dmp	UPX
behavioral2/memory/4280-403-0x0000000000330000-0x000000000037B000-memory.dmp	UPX
behavioral2/memory/5260-406-0x0000000000E80000-0x0000000000ECB000-memory.dmp	UPX
behavioral2/memory/5260-407-0x0000000000E80000-0x0000000000ECB000-memory.dmp	UPX
behavioral2/memory/3396-417-0x0000000000190000-0x00000000001DB000-memory.dmp	UPX
behavioral2/memory/3396-419-0x0000000000190000-0x00000000001DB000-memory.dmp	UPX
behavioral2/memory/5480-422-0x0000000000B70000-0x0000000000BBB000-memory.dmp	UPX
behavioral2/memory/5480-423-0x0000000000B70000-0x0000000000BBB000-memory.dmp	UPX
behavioral2/memory/3332-425-0x0000000000DB0000-0x0000000000DFB000-memory.dmp	UPX
behavioral2/memory/3332-428-0x0000000000DB0000-0x0000000000DFB000-memory.dmp	UPX
behavioral2/memory/2940-444-0x00000000001F0000-0x000000000023B000-memory.dmp	UPX
behavioral2/memory/2940-445-0x00000000001F0000-0x000000000023B000-memory.dmp	UPX

Executes dropped EXE 64 IoCs

pid	Process
4856	CP.exe
5980	ljdbvtogeo.exe
5176	CP.exe
488	CP.exe
2112	i_ljdbvtogeo.exe
5184	tnligbytrl.sys
1680	CP.exe
3388	ayvqoidayt.exe
2792	CP.exe
5776	CP.exe
4964	i_ayvqoidayt.exe
6068	lidbvsqlid.sys
3772	CP.exe
4284	vtnlfdxvtq.exe
4852	CP.exe
2484	CP.exe
4180	i_vtnlfdxvtq.exe
2928	qnlfdxvpni.sys
2316	CP.exe
248	qkifaysqki.exe
5208	CP.exe
1556	CP.exe
2408	i_qkifaysqki.exe
2364	hfdxvpnhfa.sys
2188	CP.exe
5896	ausmkicaus.exe
712	CP.exe
5000	CP.exe
2816	i_ausmkicaus.exe
2956	pmhfcxuspk.sys
2736	CP.exe
4744	pnhfzxupmh.exe
5264	CP.exe
2348	CP.exe
2928	i_pnhfzxupmh.exe
4200	mkeczusmke.sys
364	CP.exe
4088	czurmkezwu.exe
3116	CP.exe
4344	CP.exe
4996	i_czurmkezwu.exe
4688	ezxromjhbz.sys
5252	CP.exe
5908	ecwuomgezw.exe
5832	CP.exe
5536	CP.exe
480	i_ecwuomgezw.exe
5328	ebztrljebw.sys
4232	CP.exe
2012	wrojebztrm.exe
5476	CP.exe
1732	CP.exe
5488	i_wrojebztrm.exe
5928	igdywtrljd.sys
4200	CP.exe
2440	gdbytrljdb.exe
4800	CP.exe
1856	CP.exe
4280	i_gdbytrljdb.exe
1892	gdbvtnlgdy.sys
4152	CP.exe
5260	bvtnlfdbvq.exe
1216	CP.exe
4492	CP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1136-0-0x00000000004B0000-0x00000000004FB000-memory.dmp	upx
behavioral2/files/0x000d00000001c5bc-71.dat	upx
behavioral2/memory/5980-72-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/memory/5980-75-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/files/0x00060000000187f3-168.dat	upx
behavioral2/memory/2112-169-0x0000000000370000-0x00000000003BB000-memory.dmp	upx
behavioral2/memory/1136-199-0x00000000004B0000-0x00000000004FB000-memory.dmp	upx
behavioral2/memory/2112-201-0x0000000000370000-0x00000000003BB000-memory.dmp	upx
behavioral2/files/0x000c0000000187e5-233.dat	upx
behavioral2/memory/3388-234-0x0000000000F70000-0x0000000000FBB000-memory.dmp	upx
behavioral2/memory/3388-237-0x0000000000F70000-0x0000000000FBB000-memory.dmp	upx
behavioral2/files/0x000d0000000187e5-240.dat	upx
behavioral2/memory/4964-241-0x0000000000430000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/4964-252-0x0000000000430000-0x000000000047B000-memory.dmp	upx
behavioral2/files/0x000e0000000187e5-257.dat	upx
behavioral2/memory/4284-258-0x0000000000960000-0x00000000009AB000-memory.dmp	upx
behavioral2/memory/4284-261-0x0000000000960000-0x00000000009AB000-memory.dmp	upx
behavioral2/files/0x000700000001b82c-280.dat	upx
behavioral2/memory/4180-281-0x00000000008B0000-0x00000000008FB000-memory.dmp	upx
behavioral2/memory/4180-284-0x00000000008B0000-0x00000000008FB000-memory.dmp	upx
behavioral2/files/0x000800000001b82c-289.dat	upx
behavioral2/memory/248-290-0x0000000000060000-0x00000000000AB000-memory.dmp	upx
behavioral2/memory/248-293-0x0000000000060000-0x00000000000AB000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d3-296.dat	upx
behavioral2/memory/2408-297-0x0000000000C90000-0x0000000000CDB000-memory.dmp	upx
behavioral2/memory/2408-300-0x0000000000C90000-0x0000000000CDB000-memory.dmp	upx
behavioral2/files/0x000d00000001c5d3-305.dat	upx
behavioral2/memory/5896-306-0x00000000003E0000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/5896-309-0x00000000003E0000-0x000000000042B000-memory.dmp	upx
behavioral2/files/0x000e00000001c5d3-312.dat	upx
behavioral2/memory/2816-314-0x00000000009B0000-0x00000000009FB000-memory.dmp	upx
behavioral2/memory/2816-316-0x00000000009B0000-0x00000000009FB000-memory.dmp	upx
behavioral2/files/0x00110000000187e5-338.dat	upx
behavioral2/memory/4744-340-0x0000000000CE0000-0x0000000000D2B000-memory.dmp	upx
behavioral2/memory/4744-342-0x0000000000CE0000-0x0000000000D2B000-memory.dmp	upx
behavioral2/files/0x00120000000187e5-345.dat	upx
behavioral2/memory/2928-346-0x00000000008F0000-0x000000000093B000-memory.dmp	upx
behavioral2/memory/2928-349-0x00000000008F0000-0x000000000093B000-memory.dmp	upx
behavioral2/memory/4088-352-0x00000000002C0000-0x000000000030B000-memory.dmp	upx
behavioral2/memory/4088-353-0x00000000002C0000-0x000000000030B000-memory.dmp	upx
behavioral2/memory/4996-355-0x0000000000AB0000-0x0000000000AFB000-memory.dmp	upx
behavioral2/memory/4996-357-0x0000000000AB0000-0x0000000000AFB000-memory.dmp	upx
behavioral2/memory/5908-360-0x0000000000340000-0x000000000038B000-memory.dmp	upx
behavioral2/memory/5908-361-0x0000000000340000-0x000000000038B000-memory.dmp	upx
behavioral2/memory/480-363-0x0000000000E20000-0x0000000000E6B000-memory.dmp	upx
behavioral2/memory/480-365-0x0000000000E20000-0x0000000000E6B000-memory.dmp	upx
behavioral2/memory/2012-369-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	upx
behavioral2/memory/2012-370-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	upx
behavioral2/memory/5488-372-0x0000000000FD0000-0x000000000101B000-memory.dmp	upx
behavioral2/memory/5488-374-0x0000000000FD0000-0x000000000101B000-memory.dmp	upx
behavioral2/memory/2440-398-0x0000000000E20000-0x0000000000E6B000-memory.dmp	upx
behavioral2/memory/2440-399-0x0000000000E20000-0x0000000000E6B000-memory.dmp	upx
behavioral2/memory/4280-401-0x0000000000330000-0x000000000037B000-memory.dmp	upx
behavioral2/memory/4280-403-0x0000000000330000-0x000000000037B000-memory.dmp	upx
behavioral2/memory/5260-406-0x0000000000E80000-0x0000000000ECB000-memory.dmp	upx
behavioral2/memory/5260-407-0x0000000000E80000-0x0000000000ECB000-memory.dmp	upx
behavioral2/memory/3396-417-0x0000000000190000-0x00000000001DB000-memory.dmp	upx
behavioral2/memory/3396-419-0x0000000000190000-0x00000000001DB000-memory.dmp	upx
behavioral2/memory/5480-422-0x0000000000B70000-0x0000000000BBB000-memory.dmp	upx
behavioral2/memory/5480-423-0x0000000000B70000-0x0000000000BBB000-memory.dmp	upx
behavioral2/memory/3332-425-0x0000000000DB0000-0x0000000000DFB000-memory.dmp	upx
behavioral2/memory/3332-428-0x0000000000DB0000-0x0000000000DFB000-memory.dmp	upx
behavioral2/memory/2940-444-0x00000000001F0000-0x000000000023B000-memory.dmp	upx
behavioral2/memory/2940-445-0x00000000001F0000-0x000000000023B000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1988_52396386\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1988_313122073\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1988_313122073\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmkezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjeczurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtogeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqoidayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqoidayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbytrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdysqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmkezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdbvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjeczurmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtogeo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1476	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3472	ipconfig.exe
3400	ipconfig.exe
2896	ipconfig.exe
2292	ipconfig.exe
4244	ipconfig.exe
2956	ipconfig.exe
5104	ipconfig.exe
3388	ipconfig.exe
480	ipconfig.exe
4200	ipconfig.exe
2704	ipconfig.exe
5488	ipconfig.exe
2408	ipconfig.exe
2608	ipconfig.exe
4336	ipconfig.exe
2736	ipconfig.exe
2608	ipconfig.exe
5012	ipconfig.exe
4964	ipconfig.exe
2384	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286093868019948"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{88589372-392E-41F5-951F-7278C34DB9ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe
5980	ljdbvtogeo.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	i_ljdbvtogeo.exe
Token: SeDebugPrivilege	4964	i_ayvqoidayt.exe
Token: SeDebugPrivilege	4180	i_vtnlfdxvtq.exe
Token: SeDebugPrivilege	2408	i_qkifaysqki.exe
Token: SeDebugPrivilege	2816	i_ausmkicaus.exe
Token: SeDebugPrivilege	2928	i_pnhfzxupmh.exe
Token: SeDebugPrivilege	4996	i_czurmkezwu.exe
Token: SeDebugPrivilege	480	i_ecwuomgezw.exe
Token: SeDebugPrivilege	5488	i_wrojebztrm.exe
Token: SeDebugPrivilege	4280	i_gdbytrljdb.exe
Token: SeDebugPrivilege	3396	i_bvtnlfdbvq.exe
Token: SeDebugPrivilege	3332	i_ysqkicavsn.exe
Token: SeDebugPrivilege	264	i_kicausnkfd.exe
Token: SeDebugPrivilege	5900	i_causmkecxv.exe
Token: SeDebugPrivilege	4632	i_smkecwuomh.exe
Token: SeDebugPrivilege	4140	i_mjeczurmje.exe
Token: SeDebugPrivilege	3800	i_hbztrljebw.exe
Token: SeDebugPrivilege	2464	i_wqojgbytrl.exe
Token: SeDebugPrivilege	4204	i_ligdyvqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1988	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4608	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 1136 wrote to memory of 4416	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4416 wrote to memory of 364	4416	iexplore.exe	89
PID 4608 wrote to memory of 1988	4608	iexplore.exe	90
PID 1988 wrote to memory of 6136	1988	msedge.exe	91
PID 1988 wrote to memory of 1476	1988	msedge.exe	92
PID 1988 wrote to memory of 5004	1988	msedge.exe	93
PID 1988 wrote to memory of 5004	1988	msedge.exe	93
PID 1988 wrote to memory of 5004	1988	msedge.exe	93
PID 1988 wrote to memory of 4648	1988	msedge.exe	95
PID 1988 wrote to memory of 4648	1988	msedge.exe	95
PID 1988 wrote to memory of 5532	1988	msedge.exe	96
PID 1988 wrote to memory of 3220	1988	msedge.exe	97
PID 1988 wrote to memory of 5532	1988	msedge.exe	96
PID 1988 wrote to memory of 5532	1988	msedge.exe	96
PID 1988 wrote to memory of 3220	1988	msedge.exe	97
PID 1988 wrote to memory of 3220	1988	msedge.exe	97
PID 1988 wrote to memory of 2680	1988	msedge.exe	98
PID 1988 wrote to memory of 4212	1988	msedge.exe	99
PID 1988 wrote to memory of 2680	1988	msedge.exe	98
PID 1988 wrote to memory of 2680	1988	msedge.exe	98
PID 1988 wrote to memory of 4212	1988	msedge.exe	99
PID 1988 wrote to memory of 4212	1988	msedge.exe	99
PID 1988 wrote to memory of 3908	1988	msedge.exe	100
PID 1988 wrote to memory of 3908	1988	msedge.exe	100
PID 1988 wrote to memory of 3908	1988	msedge.exe	100
PID 1988 wrote to memory of 3568	1988	msedge.exe	101
PID 1988 wrote to memory of 3568	1988	msedge.exe	101
PID 1136 wrote to memory of 4856	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 5980 wrote to memory of 5176	5980	ljdbvtogeo.exe	106
PID 1988 wrote to memory of 1120	1988	msedge.exe	109
PID 1988 wrote to memory of 1120	1988	msedge.exe	109
PID 1988 wrote to memory of 4796	1988	msedge.exe	110
PID 1988 wrote to memory of 4796	1988	msedge.exe	110
PID 1988 wrote to memory of 5936	1988	msedge.exe	112
PID 1988 wrote to memory of 2484	1988	msedge.exe	113
PID 1988 wrote to memory of 2484	1988	msedge.exe	113
PID 1136 wrote to memory of 488	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 1988 wrote to memory of 5012	1988	msedge.exe	118
PID 1988 wrote to memory of 5012	1988	msedge.exe	118
PID 1136 wrote to memory of 1680	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 3388 wrote to memory of 2792	3388	ayvqoidayt.exe	123
PID 1136 wrote to memory of 5776	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 1136 wrote to memory of 3772	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4284 wrote to memory of 4852	4284	vtnlfdxvtq.exe	132
PID 1136 wrote to memory of 2484	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1136 wrote to memory of 2316	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 248 wrote to memory of 5208	248	qkifaysqki.exe	141
PID 1136 wrote to memory of 1556	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 1988 wrote to memory of 996	1988	msedge.exe	147
PID 1988 wrote to memory of 5540	1988	msedge.exe	148
PID 1988 wrote to memory of 5900	1988	msedge.exe	149
PID 1136 wrote to memory of 2188	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 5896 wrote to memory of 712	5896	ausmkicaus.exe	154
PID 1136 wrote to memory of 5000	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 1136 wrote to memory of 2736	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4744 wrote to memory of 5264	4744	pnhfzxupmh.exe	163
PID 1136 wrote to memory of 2348	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 1136 wrote to memory of 364	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4088 wrote to memory of 3116	4088	czurmkezwu.exe	172
PID 1136 wrote to memory of 4344	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 1136 wrote to memory of 5252	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	179
PID 5908 wrote to memory of 5832	5908	ecwuomgezw.exe	181
PID 1136 wrote to memory of 5536	1136	2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	184

C:\Users\Admin\AppData\Local\Temp\2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_30715279386ee229f814a1a61ab108ad_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffc6c0dc188,0x7ffc6c0dc194,0x7ffc6c0dc1a0
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,10180812605170011884,6803760191731161319,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
      4⤵
      System Time Discovery
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,296456128348260946,7334409510031812610,262144 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2704,i,15820057333655323677,18046642955100514505,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:13
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1645167628873375695,11805293331015388492,2097152 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,15726712700394819937,731953198438899695,2097152 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7769649794764343482,12374287198583020352,2097152 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:9
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,1656503559384991432,17362338298847431646,2097152 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,13278027444865876161,7637531619813293345,2097152 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,11244672719354056607,9119287834848550055,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:3568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,2398622402991118088,8612884369613398414,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,4392892263033601184,1349206582836544245,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,12461997928187769430,129120798457873303,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,12461997928187769430,129120798457873303,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,4212523916439060174,770412597545494476,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,3463396463785108613,4348549026323303299,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,5247604832692876550,9705999932692949541,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,10961493864321179367,2958305914082606997,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,6047912618357063552,9663798681890979363,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10820724078396149442,9838864145208998728,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,14234724341623061869,4872648366208663559,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5900,i,2862065083090121279,17153935557638920500,262144 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:10
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,18371257177676127087,15840358749458557809,524288 --field-trial-handle=2392,i,3020009860037469945,5737397251233251138,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:2444
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtogeo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4856
- - C:\Temp\ljdbvtogeo.exe
    C:\Temp\ljdbvtogeo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtogeo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:488
- - C:\Temp\i_ljdbvtogeo.exe
    C:\Temp\i_ljdbvtogeo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqoidayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\ayvqoidayt.exe
    C:\Temp\ayvqoidayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqoidayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5776
- - C:\Temp\i_ayvqoidayt.exe
    C:\Temp\i_ayvqoidayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxvtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\vtnlfdxvtq.exe
    C:\Temp\vtnlfdxvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxvtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Temp\i_vtnlfdxvtq.exe
    C:\Temp\i_vtnlfdxvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2316
- - C:\Temp\qkifaysqki.exe
    C:\Temp\qkifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1556
- - C:\Temp\i_qkifaysqki.exe
    C:\Temp\i_qkifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2188
- - C:\Temp\ausmkicaus.exe
    C:\Temp\ausmkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Temp\i_ausmkicaus.exe
    C:\Temp\i_ausmkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2736
- - C:\Temp\pnhfzxupmh.exe
    C:\Temp\pnhfzxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2348
- - C:\Temp\i_pnhfzxupmh.exe
    C:\Temp\i_pnhfzxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmkezwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:364
- - C:\Temp\czurmkezwu.exe
    C:\Temp\czurmkezwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4088
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmkezwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\i_czurmkezwu.exe
    C:\Temp\i_czurmkezwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5252
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5832
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5536
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojebztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4232
- - C:\Temp\wrojebztrm.exe
    C:\Temp\wrojebztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojebztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1732
- - C:\Temp\i_wrojebztrm.exe
    C:\Temp\i_wrojebztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbytrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4200
- - C:\Temp\gdbytrljdb.exe
    C:\Temp\gdbytrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbytrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1856
- - C:\Temp\i_gdbytrljdb.exe
    C:\Temp\i_gdbytrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlfdbvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4152
- - C:\Temp\bvtnlfdbvq.exe
    C:\Temp\bvtnlfdbvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlfdbvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4492
- - C:\Temp\i_bvtnlfdbvq.exe
    C:\Temp\i_bvtnlfdbvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  PID:3860
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  PID:5168
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicausnkfd.exe ups_run
  2⤵
  PID:5492
- - C:\Temp\kicausnkfd.exe
    C:\Temp\kicausnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicausnkfd.exe ups_ins
  2⤵
  PID:260
- - C:\Temp\i_kicausnkfd.exe
    C:\Temp\i_kicausnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxv.exe ups_run
  2⤵
  PID:1292
- - C:\Temp\causmkecxv.exe
    C:\Temp\causmkecxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxv.exe ups_ins
  2⤵
  PID:5716
- - C:\Temp\i_causmkecxv.exe
    C:\Temp\i_causmkecxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecwuomh.exe ups_run
  2⤵
  PID:5824
- - C:\Temp\smkecwuomh.exe
    C:\Temp\smkecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecwuomh.exe ups_ins
  2⤵
  PID:1548
- - C:\Temp\i_smkecwuomh.exe
    C:\Temp\i_smkecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjeczurmje.exe ups_run
  2⤵
  PID:4500
- - C:\Temp\mjeczurmje.exe
    C:\Temp\mjeczurmje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjeczurmje.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_mjeczurmje.exe
    C:\Temp\i_mjeczurmje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljebw.exe ups_run
  2⤵
  PID:5632
- - C:\Temp\hbztrljebw.exe
    C:\Temp\hbztrljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljebw.exe ups_ins
  2⤵
  PID:3920
- - C:\Temp\i_hbztrljebw.exe
    C:\Temp\i_hbztrljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbytrl.exe ups_run
  2⤵
  PID:4224
- - C:\Temp\wqojgbytrl.exe
    C:\Temp\wqojgbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbytrl.exe ups_ins
  2⤵
  PID:5904
- - C:\Temp\i_wqojgbytrl.exe
    C:\Temp\i_wqojgbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligdyvqoig.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\ligdyvqoig.exe
    C:\Temp\ligdyvqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligdyvqoig.exe ups_ins
  2⤵
  PID:3280
- - C:\Temp\i_ligdyvqoig.exe
    C:\Temp\i_ligdyvqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdysqoi.exe ups_run
  2⤵
  PID:4072
- - C:\Temp\qoigdysqoi.exe
    C:\Temp\qoigdysqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2384

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2840

C:\Temp\tnligbytrl.sys
C:\Temp\tnligbytrl.sys
1⤵
- Executes dropped EXE
PID:5184

C:\Temp\lidbvsqlid.sys
C:\Temp\lidbvsqlid.sys
1⤵
- Executes dropped EXE
PID:6068

C:\Temp\qnlfdxvpni.sys
C:\Temp\qnlfdxvpni.sys
1⤵
- Executes dropped EXE
PID:2928

C:\Temp\hfdxvpnhfa.sys
C:\Temp\hfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:2364

C:\Temp\pmhfcxuspk.sys
C:\Temp\pmhfcxuspk.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\mkeczusmke.sys
C:\Temp\mkeczusmke.sys
1⤵
- Executes dropped EXE
PID:4200

C:\Temp\ezxromjhbz.sys
C:\Temp\ezxromjhbz.sys
1⤵
- Executes dropped EXE
PID:4688

C:\Temp\ebztrljebw.sys
C:\Temp\ebztrljebw.sys
1⤵
- Executes dropped EXE
PID:5328

C:\Temp\igdywtrljd.sys
C:\Temp\igdywtrljd.sys
1⤵
- Executes dropped EXE
PID:5928

C:\Temp\gdbvtnlgdy.sys
C:\Temp\gdbvtnlgdy.sys
1⤵
- Executes dropped EXE
PID:1892

C:\Temp\aysqkidays.sys
C:\Temp\aysqkidays.sys
1⤵
PID:3024

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
PID:5952

C:\Temp\causmkhfzx.sys
C:\Temp\causmkhfzx.sys
1⤵
PID:6124

C:\Temp\hczusmkfcw.sys
C:\Temp\hczusmkfcw.sys
1⤵
PID:1916

C:\Temp\smjecwuomk.sys
C:\Temp\smjecwuomk.sys
1⤵
PID:2164

C:\Temp\ebzwromgey.sys
C:\Temp\ebzwromgey.sys
1⤵
PID:4456

C:\Temp\ywtojgeywq.sys
C:\Temp\ywtojgeywq.sys
1⤵
PID:5228

C:\Temp\wtolgdbvtr.sys
C:\Temp\wtolgdbvtr.sys
1⤵
PID:1568

C:\Temp\nlfdyvqnig.sys
C:\Temp\nlfdyvqnig.sys
1⤵
PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkicaus.exe

Path C:\Temp\ausmkicaus.exe
Size 291KB
SHA256 9f334f50efb4f0d37c681eb53f4fd2e60497b2ede5c670ae04a0d5f72f160736
MD5 1c751ee0263bdd60a08ea18cdd4a1dd7
SHA1 67c73e6634b0702e868c85638142a2ea7d733056
SHA512 6c7f483cadce1de40deadc243e0ea669371d7e1e7667f8ceade4606c36c143c1b68889274d2f545c7f6752bc7a59e11292162979215eee38393d319722d8529d
SSDEEP 3072:hJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:hghLWsQmpcF8BzXfwVTTIr6N
TLSH
T13F544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvqoidayt.exe

Path C:\Temp\ayvqoidayt.exe
Size 291KB
SHA256 2601ca7df291f6a1b5cb97d24220ca08cd238f401e1a1c5f34a06b95681ae1d1
MD5 7a50c8e182598fd64bf5e0865212be70
SHA1 bb1468ff26fd5df50a1ba1aca905c084376e0cc7
SHA512 8cf7257740174c98307a73478e312d415ec1595c5633feb6ba2f74b93d9d04fb16897ebf5ecafc204acf58dd18ebf655ea0ad3460ea55c150ce122fa1cc23237
SSDEEP 3072:tJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:tghLWsQmpcF8BzXfwVTTIr6N
TLSH
T155544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdxvpnhfa.sys

Path C:\Temp\hfdxvpnhfa.sys
Size 141KB
SHA256 6451bed1ff0294802e9fad2d51af492c4a6ca754087f7e01ebb79a349efaa755
MD5 2e98b0cb37acde01b7d61c9781d433d7
SHA1 603e3ce9ca48ec75d25d4d4dbe2f5d9d30e43e68
SHA512 b0cede72b4d7de4402623bcd0341b668ce671fea3f890f75809821fd94c1b73c84e335932e93e26c645f6256842644b4c8d58ac14d51b37d6498396b3f017d1f
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T176E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkicaus.exe

Path C:\Temp\i_ausmkicaus.exe
Size 291KB
SHA256 4371c6f915272670d5d7945938998cfc9d02826f8f97cd720ba37f4c5c15d062
MD5 71e5fa63b84156a05a36e13532b22a65
SHA1 8d300f0063ca49292c5ddc578e566c67ec6e4cce
SHA512 8155ac19cbbee603f275483a3662d845432bcc7e06839f1e788f27bc29bd086a722369e0350c4636418615fbe5b0761b82a8f5356d36c5ce6e0e700d464251d4
SSDEEP 3072:YJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:YghLWsQmpcF8BzXfwVTTIr6N
TLSH
T15F544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvqoidayt.exe

Path C:\Temp\i_ayvqoidayt.exe
Size 291KB
SHA256 91678aff63f25c0255ac78bf0098ec08f2dac4ac62b805fcda2d0b288e404f93
MD5 80291e05cd2a000f133dc3135facf8a1
SHA1 ddd5f4e13e98789c2f01e2dfa724dedcc558bd45
SHA512 8498b32c5b7c3583f462cd4622ee402beef66b1de778738e4591db16981a4c3ea17e5f42f4214284e883adea72f3b47701f015243cf37dfc0db550bc1b946134
SSDEEP 3072:fJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:fghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1B6544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtogeo.exe

Path C:\Temp\i_ljdbvtogeo.exe
Size 291KB
SHA256 a5ffbaf227f823b176b11f205537129e673398e9086ab0b032501585983796e6
MD5 5d1fd7160f0e79e3bf65316334b7b176
SHA1 5823ebc02561b2009353fb881c1a991d8a1758ef
SHA512 5f7006f7a9d4d6b5f1752b2a5f7d9a5da33e69a326289715bec6563efcdc45c16eb03e68de3773dc5fdfc3a07e41d07ca0fc363f1b6c0f94c032ae813e390fa6
SSDEEP 3072:NJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:NghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1F4544A1172808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxupmh.exe

Path C:\Temp\i_pnhfzxupmh.exe
Size 291KB
SHA256 e3e482316dcae5a23a6bec38ca3b295801b161ebabe07d63fb2a0027b753ea7c
MD5 a6125c54d631ac5a1f473931fbe03eea
SHA1 55ba6a1f4bd1c9f5a3f173ba177f2166fdda48ae
SHA512 9dfd7097a7eb1b81b4c44308a47d10a71d45e1014ce26b021465a84ddccc187f20f853cf4d5dd41f3eec31d861e6e5fba2b659027b3943de8ba1f62a3a5107c4
SSDEEP 3072:iJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:ighLWsQmpcF8BzXfwVTTIr6N
TLSH
T134544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifaysqki.exe

Path C:\Temp\i_qkifaysqki.exe
Size 291KB
SHA256 66ad00e546a64e17650c2f993419683d906d79f0edbe57eed725343e7e270b9c
MD5 0592b307a1ad30a92269569cf0078ccd
SHA1 479d3dedcbe829b0de66cbf4ca66d6a2d3d566c8
SHA512 70fabd7abad48235b25be3c6062ad550b53d31117cd6573d1f0398beb20b14db919e968f6ae0a436d56a93b29712c84914a1aa16f0f184a0b2bf00fe98bdd691
SSDEEP 3072:HJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:HghLWsQmpcF8BzXfwVTTIr6N
TLSH
T103544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdxvtq.exe

Path C:\Temp\i_vtnlfdxvtq.exe
Size 291KB
SHA256 161d8a2fd6de7d28d4f7735e9a57a614adeff7d3e894952ab27183966bba6666
MD5 22e5f487245224f258054d2c70d9e02b
SHA1 547129e2cdf7469b5950d490304ce4bd1f1c9ee2
SHA512 19e6943cfede2e06b23db47784ec3b1d692626088a88ce3acb6ff506cef5e7f512ed99ccbc638e87b5a1f5a17c85f2e8ca35648c7dd8eb120f2a84ed68c4f695
SSDEEP 3072:NJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:NghLWsQmpcF8BzXfwVTTIr6N
TLSH
T12D544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvsqlid.sys

Path C:\Temp\lidbvsqlid.sys
Size 141KB
SHA256 1cbe358c8b2c49c4c856fb0247632e8e903e5e2af1a0fe4d015bb19590e5ef11
MD5 02d601fcad2b15f5bff6eea6eb4cd600
SHA1 62b00b24847d76cb111ca02ba99e5957691d06d4
SHA512 5ca042b1b4ef3e2d3ea2200c59cbc179752eaa0dd6ef76ce6723bd34842841765a38e87d7826d2cadf2678495380e88da825d3e4ae65a39c4731666df7bcc9ff
SSDEEP 3072:osQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:osQmpcF8BzXfwV
TLSH
T17BE38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtogeo.exe

Path C:\Temp\ljdbvtogeo.exe
Size 291KB
SHA256 48fa20e74cde22cf1a6583fe80cacf369c5cc0c47a588c0eae330faa3e898da4
MD5 2ef6f7bbd8ebab39ccd13eba325f4f70
SHA1 602c4f12e8a57e75521f02086bef52c85eb15779
SHA512 52d421e52ba1819341fb04c062ddb8f91b3ad910993c2b13668605c1bcb4891439beaf0f1e0bcb3bc5e172547779acccba789908da5890ff4a05411bfc9356ed
SSDEEP 3072:2JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:2ghLWsQmpcF8BzXfwVTTIr6N
TLSH
T114544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmhfcxuspk.sys

Path C:\Temp\pmhfcxuspk.sys
Size 141KB
SHA256 7fc6bb759781a6623283918f4f1b431678f6c2e8fb86633495e46164da1e6b27
MD5 e15c0d783ccfc50a967abbf587ea883c
SHA1 7924146c3ac056aa2a8d00f7f7fe81d3d99cd9ab
SHA512 c12d184b146279439df4a290c6dda7b3acb920c69f56c8449090bb61e630ab8766788bf836fade4c05a8243eeb3b324a54af92c3e85898c57d7f732078dc52d4
SSDEEP 3072:ysQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ysQmpcF8BzXfwV
TLSH
T1E9E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxupmh.exe

Path C:\Temp\pnhfzxupmh.exe
Size 291KB
SHA256 d90c2e7f78303757b62cf7c36d63c2a6d468d0af5736fbe5ab8b616841465021
MD5 1984629a5a41594265e17ffcd51108d8
SHA1 eb6b9d462974803bfcc8399661891364dbfeebd7
SHA512 7162a323b5823ca2cbf45d0f06abefb8355e499252e7ffd6a2d659329644b22a172215b29aca8403b825022308da6984ff5333bf47e433d044d1060972101597
SSDEEP 3072:LJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:LghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1DE544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifaysqki.exe

Path C:\Temp\qkifaysqki.exe
Size 291KB
SHA256 05b9823d407e657170f8ea5ccb96196ca45476371bc70fab2a0ddfa93500768e
MD5 10f7a08e7751f38bf857e55842d615c0
SHA1 33068137e6da7584f170248318c76b016da7ce23
SHA512 5829f85654e0df66758dcc9d727e5775778126a2ccda4fa8a8cd53b7ad5de15ded45eb70d28a55f7846beb92744ee3734d442a483ca0414076344fde345b69ec
SSDEEP 3072:5JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:5ghLWsQmpcF8BzXfwVTTIr6N
TLSH
T13A544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvpni.sys

Path C:\Temp\qnlfdxvpni.sys
Size 141KB
SHA256 d328544aa5fa67dbb34cdbdd12041540b95470ad623a7853e137934efa7cda83
MD5 8c404ef423647ec93df1aa9031a39dd2
SHA1 d9d91c52a336a6fa4fb1c49338e6fed65e06b78f
SHA512 de9756e0a3f4420dbd2feb496332ab257b0411fc256d778ff3d104eee8958f2a1b6b941c0ed5a86e53a042eb1645e228bf793795a65a59c6d15819fbea26bedc
SSDEEP 3072:XsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:XsQmpcF8BzXfwV
TLSH
T1EFE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnligbytrl.sys

Path C:\Temp\tnligbytrl.sys
Size 141KB
SHA256 e1eb87e8847cc768268bcc9573847e5ffdd3046398804fd160cd84bb427fceac
MD5 d1ed55c49e59c70e57edfc98fa121104
SHA1 45350d996c4bbede77df43c4e677d80c9277a14b
SHA512 7fb71cb7a0b62f21869a4d2db3cc0cab1858329656135fe84a8ebd2b8498593d24c1c531b31c831acffec8c664582f4d58e5a2ea7371d7fe52d776b61b370ca1
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T1AEE38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxvtq.exe

Path C:\Temp\vtnlfdxvtq.exe
Size 291KB
SHA256 957d32034205c6ed5f67d2c26f8b409706d7783e20ce8097df82a18960017908
MD5 3cc32345a45473b86a1b5a06f8236df9
SHA1 3930327c3268d688540f5eebebaec0e37f580f65
SHA512 81b3e1bc1e15003e72f3b686e4ecde8df97657fa925f40be3d908b17aa454d9d3242b23b9f78ba3a1923d98450324c158e323aa7970782b05b1537f38c435f70
SSDEEP 3072:yJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:yghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1F6544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d99566b639ee6ca3af9d288bd9a88d790ddbc10d51d22cd7ae61a25674d94fee
MD5 7361b2540097b248df192dc03876c595
SHA1 c28766042ec5c3802e7e47c27addab6b3eb8a1f0
SHA512 13b8d09130b44f40455231cc1e2ff1d8d981e42f8862bfab1ebc186c0fd7a3f64c1ae8a55e9ccb7fa90f5043905249bb73a61d6ffd2e68ecc88e7235c8f0986d
TLSH
T14C611DC233611780C7A918BD46E5B74D32F6469ECA87E95E8090ADB64CB2FC02CD21D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b3f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b3f4.TMP
Size 3KB
SHA256 52e9edb18fc40a24b0a354417f2efa4c659e03abfff5f64c0226037cf3ab188c
MD5 8f577e7a7245128f6ee3ca424392019b
SHA1 6e0a125c98645cac47154194cadcf3b1723f12cd
SHA512 ad511a351fb3251f38e5ef102123b4bad1c4abea7a707d8fda3a359662680e43631bfd2a222b01306498045b6888aaa4af394a8b6b5649004d88a3ebb03cd187
TLSH
T14C610CC233651780C7E918BD86E5B74D32F6469ECA87E95E8090ADB64CB2FC52CD21D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1365d94a8234ffb00f5311e958fbd9b41ae3f7ddc4903b152c14cb2425a7e96a
MD5 c567f438b16b0d958c57d9612d3e0f0f
SHA1 6f6c8e0f8692ab55190b534a6d27b5b27adfbd2e
SHA512 953fa42af4d72c0fce4d32fbdba948a473cd06f08994297307a937d886c964b47cd2cbef79867dfe77666a25cece5bf52f24c4a6942599a49422d1e476136a5b
TLSH
T16351B0F3C3E8856DC91156F0AB147E2BDE1D0914432C3D5AC9E4AF1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 79f58d497ca7d50d1ba73cc8cf3e17cc17afc1ee1f80d18a99e1af44e6ac14ef
MD5 5eecdf59c602cd1c1c8feced6fbd617d
SHA1 3d5997cbb767b5a9e9ddebef8c367ad00f1076e7
SHA512 1773f38735187bb1d962dde2651a882c9d52d1fc6c4c9e3216faa823e8d0ff50d06743a8e492c156f986b08a14619dd07ae6dd52b10e2598e3fcf9f4fe00fb1e
SSDEEP 192:sxRhRWyM/jK1Ml8wCE/f0s8YXNZ6KjzoD8pi/g6+WNIYCsuObGRIgtJ:sxRhw8E/f0sNXj6K7i/5IeU3
TLSH
T1A252EA156A245D3BCCCBD21DFA55BF93D6F95573A2901E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4156e712ab1d4d47d5780afce7a83f2114b81ca3c69d509d0411cfa790128a27
MD5 7662b1e62fed146ff7529c178b90358d
SHA1 059105983e4a5ab2badde5e453371015f844b8c5
SHA512 8e8ca1c3d7e63c632dce78292867f642fe6fd90dd4cfcfa728a8d893ea2ed6410bb3301e242ee3f5f5518a63387caa7823ef8fd6041998a0bb0f3d6691e8bbdc
SSDEEP 192:sxRKRWyM/jK1Ml8UQIICE/f0s5YHNZ6K7zoD8prx/g6+WNChefYCXuObGRIgD/J:sxRKAqUE/f0sOHj6Kj9/5VfDUF
TLSH
T1E162E916AA245D3BCCCBD21DBA51BF93D6F9117392941E44AAFC8A0C10E6ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c6c8ceb8fee31cef98e89160846ec7c1215db1626b428dbdc904fa70b458939d
MD5 0b2d84aafbb5a2d91e5bf21d7da1ff02
SHA1 0205e1fa8613cc9f3ac0395bceb06abc53e96c13
SHA512 121eccd9f8f6e297b00855e18ed2150d3fa6cca4f775c812029fa4d9ac2e6580b4c78621b76e649258e102c5dfe5f3321e21dbc92ea231d7b9113ba3bc16e49e
SSDEEP 192:sxRKRWyM/jK1Ml8wCE/f0s5YXNZ6K7zoD8p9x/g6+WNChefYChuObGRIgDdJ:sxRKA8E/f0sOXj6Kj//5VfZUr
TLSH
T1A762E9166A245D7BCCCBD21DFA51BF93D6F91173A2941E44AAFC8A0C10E6BDC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6cad6908422cfccc60402fc99d512b98ea1fb030d37142812e12e97b804142bd
MD5 03f5ba916bfe94a213350aeb9eb5968f
SHA1 13ed7d274a45f454bac728aee29f2a7ecc633198
SHA512 8c00eccbfc7b6c96790a1b2072d3f84cf91e1aa2511ed0ed084a5aeb91f1062433602d62e1eb8d9405ce770540ed2264b8c7509ce3896172eaab6530976e0aea
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVo9MQqqArovPp:j/8vN7E7tQWgQ+fB+u1jar9MVqLZ
TLSH
T12DE2FC7B680CCB7E4F844E9CEC29BD9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 c24eab98bd2eac1ca7ea1350596c565f0c145bdc3505e40a23f92117d26a7872
MD5 d37afc2910078234d5546d3a0022ec53
SHA1 89273c326b6f81471ca782de6c79f414a4abbb8a
SHA512 e665266bb6e3874a422f3b6be5b3338effc7faf64f7bf2236e8927b54926fb26cde44c565fd9cc5b348259a37ea6b4de41a9c6122e614958fd459f72bfa5d9a2
SSDEEP 768:Tj+9F3sHgB7Yp8+p3bd66j+4BRv86aLIW8Mj1v:29F3tm8+p3Z6n4yeiv
TLSH
T111F2AE72E8AA9D639CE9C245B24737C3AFB421A349C01ED5D9D87F0D10C72AD170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ee30d48a16cfbecb8f16ad3e9f783f9f735d82bc75b92d075224346e64ac7f74
MD5 2ce2f8fd9fdbc3edc8b7527091e08679
SHA1 9cf888dfb2dfb6135ad0c8678c2a2a72f57f8f62
SHA512 aa9eef6b6b8bdcf8ed8caae38565cfa459ed421d9796312baf488d425ed4a48968e201e12a1ae63186dee005f6573e883d061172b36650dd7e40d71138fc6a82
SSDEEP 768:lj+9F3bHgB7Rp8+p3bd66j+4BRv86aLIW8Mj1v:Q9F3QP8+p3Z6n4yeiv
TLSH
T1BBF2AE72E89A9D638CE9C655B24737C3AFB421A349C00E95D9DCBF0D10C72AD170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 addfb1295f78a73ca00dddffe48fe8c5076540a13f59340cb024f4dc9df19add
MD5 30e9b8b1b10062e41cb79fe5265f15b7
SHA1 e6a30a10e00b5e625aaa3846631f96017ef168c4
SHA512 43c866b1908bd8ae90549ac55158e4e4c4ff3be256f2f8927734ae33ea366c2104fc26ed5c808262b1293f3bfc07377fd0a8f0f2ccb4679dcdcfa14e263d997d
SSDEEP 768:Irv+4UNbdD3XcHNp8+p3bd66j+4BRv86aLIiIM2bwCl1:Ibsbp32L8+p3Z6n4ymM0ww
TLSH
T16C03CE73F8A899739CE6C644B24A7A433FF851A396C10EC4D5DD2B4E419A19E630BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7b471eeb40d0314d28aad93274c9f379c57296da1179c9fa49483154e587057c
MD5 8bc5a2043f51c72268ea5af286ceae22
SHA1 aa05c49d4216026f3332bc84bce307cab4360694
SHA512 17e0730b297851151e381dd3938b7edd47da744b0405c99377b5609c3e011c146f24b0103506dd0f78e9c0d5a9d2ed4f615b9f5fc3915c392b35ca88a4fba83e
SSDEEP 768:Zj+9r3XHXs2p8+p3bd66j+4BRv86aLIW8Mj1v:E9r338+p3Z6n4yeiv
TLSH
T1841318F1E8D79936D89D8347633E6E829EBCD16375840984FBD86E4DCC821BFC606825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a0a61f779f8829cc88c8b6178a89a65f33da7b2e089da429749173886ab3530c
MD5 a72e4a743c63948750348a939bd4f7e7
SHA1 2ce94325953da453d430590211a8b3000e04b744
SHA512 6c5279450639f0af60c1c92de6baf74fde201fb88a36eacc8e91cbd5b81355cafa3556850145a5f6eb91116f965ef39f43acace32526326a94c478244682b897
SSDEEP 768:Yrv+4UNbdD3owB7Np8+p3bd66j+4BRv86aLIW82bwClW:Ybsbp3xL8+p3Z6n4ye0wT
TLSH
T19303BE72F4A9DD739CEAC644B14677837FB811A395C10EC4E9D96B4E004A19E370BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

91605b43-1f35-4881-b6f6-02988bd528e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91605b43-1f35-4881-b6f6-02988bd528e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1988_1185958724\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-290-0x0000000000060000-0x00000000000AB000-memory.dmp

Download

memory/248-293-0x0000000000060000-0x00000000000AB000-memory.dmp

Download

memory/264-449-0x0000000000750000-0x000000000079B000-memory.dmp

Download

memory/264-447-0x0000000000750000-0x000000000079B000-memory.dmp

Download

memory/480-365-0x0000000000E20000-0x0000000000E6B000-memory.dmp

Download

memory/480-363-0x0000000000E20000-0x0000000000E6B000-memory.dmp

Download

memory/1136-0-0x00000000004B0000-0x00000000004FB000-memory.dmp

Download

memory/1136-199-0x00000000004B0000-0x00000000004FB000-memory.dmp

Download

memory/1488-486-0x0000000000F40000-0x0000000000F8B000-memory.dmp

Download

memory/1488-487-0x0000000000F40000-0x0000000000F8B000-memory.dmp

Download

memory/1892-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1916-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-476-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2008-477-0x0000000000400000-0x000000000044B000-memory.dmp

Download

memory/2012-369-0x0000000000BB0000-0x0000000000BFB000-memory.dmp

Download

memory/2012-370-0x0000000000BB0000-0x0000000000BFB000-memory.dmp

Download

memory/2112-201-0x0000000000370000-0x00000000003BB000-memory.dmp

Download

memory/2112-169-0x0000000000370000-0x00000000003BB000-memory.dmp

Download

memory/2164-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2164-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2364-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2364-302-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-297-0x0000000000C90000-0x0000000000CDB000-memory.dmp

Download

memory/2408-300-0x0000000000C90000-0x0000000000CDB000-memory.dmp

Download

memory/2440-399-0x0000000000E20000-0x0000000000E6B000-memory.dmp

Download

memory/2440-398-0x0000000000E20000-0x0000000000E6B000-memory.dmp

Download

memory/2464-504-0x00000000006A0000-0x00000000006EB000-memory.dmp

Download

memory/2464-514-0x00000000006A0000-0x00000000006EB000-memory.dmp

Download

memory/2816-316-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

memory/2816-314-0x00000000009B0000-0x00000000009FB000-memory.dmp

Download

memory/2928-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2928-349-0x00000000008F0000-0x000000000093B000-memory.dmp

Download

memory/2928-346-0x00000000008F0000-0x000000000093B000-memory.dmp

Download

memory/2940-445-0x00000000001F0000-0x000000000023B000-memory.dmp

Download

memory/2940-444-0x00000000001F0000-0x000000000023B000-memory.dmp

Download

memory/2956-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3024-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3024-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-425-0x0000000000DB0000-0x0000000000DFB000-memory.dmp

Download

memory/3332-428-0x0000000000DB0000-0x0000000000DFB000-memory.dmp

Download

memory/3388-234-0x0000000000F70000-0x0000000000FBB000-memory.dmp

Download

memory/3388-237-0x0000000000F70000-0x0000000000FBB000-memory.dmp

Download

memory/3396-419-0x0000000000190000-0x00000000001DB000-memory.dmp

Download

memory/3396-417-0x0000000000190000-0x00000000001DB000-memory.dmp

Download

memory/3568-452-0x00000000002F0000-0x000000000033B000-memory.dmp

Download

memory/3568-453-0x00000000002F0000-0x000000000033B000-memory.dmp

Download

memory/3800-489-0x0000000000D40000-0x0000000000D8B000-memory.dmp

Download

memory/3800-491-0x0000000000D40000-0x0000000000D8B000-memory.dmp

Download

memory/4088-352-0x00000000002C0000-0x000000000030B000-memory.dmp

Download

memory/4088-353-0x00000000002C0000-0x000000000030B000-memory.dmp

Download

memory/4140-482-0x0000000000A60000-0x0000000000AAB000-memory.dmp

Download

memory/4140-479-0x0000000000A60000-0x0000000000AAB000-memory.dmp

Download

memory/4180-281-0x00000000008B0000-0x00000000008FB000-memory.dmp

Download

memory/4180-284-0x00000000008B0000-0x00000000008FB000-memory.dmp

Download

memory/4200-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4280-401-0x0000000000330000-0x000000000037B000-memory.dmp

Download

memory/4280-403-0x0000000000330000-0x000000000037B000-memory.dmp

Download

memory/4284-258-0x0000000000960000-0x00000000009AB000-memory.dmp

Download

memory/4284-261-0x0000000000960000-0x00000000009AB000-memory.dmp

Download

memory/4456-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4632-473-0x0000000000DA0000-0x0000000000DEB000-memory.dmp

Download

memory/4632-471-0x0000000000DA0000-0x0000000000DEB000-memory.dmp

Download

memory/4688-358-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4688-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-342-0x0000000000CE0000-0x0000000000D2B000-memory.dmp

Download

memory/4744-340-0x0000000000CE0000-0x0000000000D2B000-memory.dmp

Download

memory/4964-241-0x0000000000430000-0x000000000047B000-memory.dmp

Download

memory/4964-252-0x0000000000430000-0x000000000047B000-memory.dmp

Download

memory/4988-469-0x0000000000B30000-0x0000000000B7B000-memory.dmp

Download

memory/4988-468-0x0000000000B30000-0x0000000000B7B000-memory.dmp

Download

memory/4996-355-0x0000000000AB0000-0x0000000000AFB000-memory.dmp

Download

memory/4996-357-0x0000000000AB0000-0x0000000000AFB000-memory.dmp

Download

memory/5112-501-0x0000000000C50000-0x0000000000C9B000-memory.dmp

Download

memory/5112-502-0x0000000000C50000-0x0000000000C9B000-memory.dmp

Download

memory/5184-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5228-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5228-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5260-407-0x0000000000E80000-0x0000000000ECB000-memory.dmp

Download

memory/5260-406-0x0000000000E80000-0x0000000000ECB000-memory.dmp

Download

memory/5328-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5480-423-0x0000000000B70000-0x0000000000BBB000-memory.dmp

Download

memory/5480-422-0x0000000000B70000-0x0000000000BBB000-memory.dmp

Download

memory/5488-372-0x0000000000FD0000-0x000000000101B000-memory.dmp

Download

memory/5488-374-0x0000000000FD0000-0x000000000101B000-memory.dmp

Download

memory/5896-309-0x00000000003E0000-0x000000000042B000-memory.dmp

Download

memory/5896-306-0x00000000003E0000-0x000000000042B000-memory.dmp

Download

memory/5900-465-0x00000000004C0000-0x000000000050B000-memory.dmp

Download

memory/5900-463-0x00000000004C0000-0x000000000050B000-memory.dmp

Download

memory/5908-360-0x0000000000340000-0x000000000038B000-memory.dmp

Download

memory/5908-361-0x0000000000340000-0x000000000038B000-memory.dmp

Download

memory/5928-391-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5952-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5980-75-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/5980-72-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/6068-254-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download