systex | b9eab82416b70132f34d8d46b228390f4ac2029b5f516bb2f1e4908955ba7eed

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260727-jte5bayclb
SHA256 b9eab82416b70132f34d8d46b228390f4ac2029b5f516bb2f1e4908955ba7eed
MD5 c6c0cf0322bbd2e24d2e6c9132e35eea
SHA1 e3e32fb34ed3fc3a7afb3af89d1eae25a78edc91
SHA512 e622f7a241e904502981290334390708f3f6452cca64278f1fc58eb068ca694fb4b994fcd3496ad0bb4db27f0d0bf3347e936e9c890b1dc628df76581c687505
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T18A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
428	CP.exe
1260	bztrmgecwr.exe
4892	CP.exe
5036	CP.exe
1492	i_bztrmgecwr.exe
576	qoigbywqom.sys
5948	CP.exe
1952	olgeywqojg.exe
5668	CP.exe
2352	CP.exe
5784	i_olgeywqojg.exe
5312	bytqoigdyv.sys
5304	CP.exe
3108	dbytqligay.exe
2132	CP.exe
3360	CP.exe
5180	i_dbytqligay.exe
2836	lidbvtnljd.sys
5000	CP.exe
5732	vqnifdbvtn.exe
3596	CP.exe
4708	CP.exe
200	i_vqnifdbvtn.exe
5312	vsqkifaxvt.sys
5324	CP.exe
3224	sqkfdxsqki.exe
5744	CP.exe
2296	CP.exe
3844	i_sqkfdxsqki.exe
624	khfaxspkic.sys
3968	CP.exe
2784	kicaxspnkf.exe
4784	CP.exe
5812	CP.exe
4988	i_kicaxspnkf.exe
4376	khczxupmkh.sys
4608	CP.exe
1656	pjhfcausmk.exe
5964	CP.exe
3880	CP.exe
1316	i_pjhfcausmk.exe
916	hfzxrpkhca.sys
464	CP.exe
1144	urmkeczurm.exe
6012	CP.exe
616	CP.exe
4672	i_urmkeczurm.exe
2836	ezwrpjgezw.sys
2268	CP.exe
124	ezwurpjhbz.exe
260	CP.exe
2944	CP.exe
1332	i_ezwurpjhbz.exe
5412	jebztrojge.sys
5784	CP.exe
5008	geywtomgbz.exe
3420	CP.exe
4308	CP.exe
5568	i_geywtomgbz.exe
4988	trljgbztrl.sys
4272	CP.exe
2520	geywqoigay.exe
3104	CP.exe
6096	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_861192196\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_861192196\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_861192196\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_861192196\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6008_2142006389\_locales\fr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvsnkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkfdxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvsnkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmgecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmgecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkfdxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfzxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoljdby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtomgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkeczx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5032	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3668	ipconfig.exe
1696	ipconfig.exe
4328	ipconfig.exe
5332	ipconfig.exe
1440	ipconfig.exe
964	ipconfig.exe
2564	ipconfig.exe
3908	ipconfig.exe
5352	ipconfig.exe
4420	ipconfig.exe
1844	ipconfig.exe
5748	ipconfig.exe
3852	ipconfig.exe
2208	ipconfig.exe
2716	ipconfig.exe
1852	ipconfig.exe
1936	ipconfig.exe
5432	ipconfig.exe
1272	ipconfig.exe
1612	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296126511715066"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{231C6DB0-AF3F-42D4-A4C8-4784D1D9B073}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe
1260	bztrmgecwr.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe
6008	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	i_bztrmgecwr.exe
Token: SeDebugPrivilege	5784	i_olgeywqojg.exe
Token: SeDebugPrivilege	5180	i_dbytqligay.exe
Token: SeDebugPrivilege	200	i_vqnifdbvtn.exe
Token: SeDebugPrivilege	3844	i_sqkfdxsqki.exe
Token: SeDebugPrivilege	4988	i_kicaxspnkf.exe
Token: SeDebugPrivilege	1316	i_pjhfcausmk.exe
Token: SeDebugPrivilege	4672	i_urmkeczurm.exe
Token: SeDebugPrivilege	1332	i_ezwurpjhbz.exe
Token: SeDebugPrivilege	5568	i_geywtomgbz.exe
Token: SeDebugPrivilege	5352	i_geywqoigay.exe
Token: SeDebugPrivilege	3172	i_qoigaytqlj.exe
Token: SeDebugPrivilege	2876	i_sqnifdyvqn.exe
Token: SeDebugPrivilege	5236	i_axvsnkicax.exe
Token: SeDebugPrivilege	4340	i_usmkfzxvpn.exe
Token: SeDebugPrivilege	6052	i_czusmkeczx.exe
Token: SeDebugPrivilege	3804	i_bzxrpjhbzu.exe
Token: SeDebugPrivilege	5496	i_hbwuomgezw.exe
Token: SeDebugPrivilege	5652	i_bywqoljdby.exe
Token: SeDebugPrivilege	5576	i_jdbvtolgeb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 2672	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4636 wrote to memory of 3672	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 2672 wrote to memory of 2712	2672	iexplore.exe	91
PID 3672 wrote to memory of 6008	3672	iexplore.exe	92
PID 6008 wrote to memory of 5804	6008	msedge.exe	93
PID 6008 wrote to memory of 1188	6008	msedge.exe	94
PID 6008 wrote to memory of 5032	6008	msedge.exe	95
PID 6008 wrote to memory of 1188	6008	msedge.exe	94
PID 6008 wrote to memory of 1188	6008	msedge.exe	94
PID 6008 wrote to memory of 1376	6008	msedge.exe	96
PID 6008 wrote to memory of 1376	6008	msedge.exe	96
PID 6008 wrote to memory of 968	6008	msedge.exe	97
PID 6008 wrote to memory of 968	6008	msedge.exe	97
PID 6008 wrote to memory of 968	6008	msedge.exe	97
PID 6008 wrote to memory of 4196	6008	msedge.exe	98
PID 6008 wrote to memory of 4196	6008	msedge.exe	98
PID 6008 wrote to memory of 4196	6008	msedge.exe	98
PID 6008 wrote to memory of 3472	6008	msedge.exe	100
PID 6008 wrote to memory of 3472	6008	msedge.exe	100
PID 6008 wrote to memory of 3472	6008	msedge.exe	100
PID 6008 wrote to memory of 4896	6008	msedge.exe	101
PID 6008 wrote to memory of 3328	6008	msedge.exe	102
PID 6008 wrote to memory of 4896	6008	msedge.exe	101
PID 6008 wrote to memory of 4896	6008	msedge.exe	101
PID 6008 wrote to memory of 3328	6008	msedge.exe	102
PID 6008 wrote to memory of 3328	6008	msedge.exe	102
PID 6008 wrote to memory of 1600	6008	msedge.exe	103
PID 6008 wrote to memory of 1600	6008	msedge.exe	103
PID 4636 wrote to memory of 428	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 1260 wrote to memory of 4892	1260	bztrmgecwr.exe	108
PID 6008 wrote to memory of 2064	6008	msedge.exe	111
PID 6008 wrote to memory of 4340	6008	msedge.exe	112
PID 6008 wrote to memory of 2064	6008	msedge.exe	111
PID 6008 wrote to memory of 4340	6008	msedge.exe	112
PID 6008 wrote to memory of 4488	6008	msedge.exe	114
PID 6008 wrote to memory of 5328	6008	msedge.exe	117
PID 6008 wrote to memory of 5328	6008	msedge.exe	117
PID 6008 wrote to memory of 5668	6008	msedge.exe	127
PID 6008 wrote to memory of 5668	6008	msedge.exe	127
PID 4636 wrote to memory of 5036	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 6008 wrote to memory of 3224	6008	msedge.exe	121
PID 6008 wrote to memory of 3224	6008	msedge.exe	121
PID 6008 wrote to memory of 3320	6008	msedge.exe	122
PID 6008 wrote to memory of 3320	6008	msedge.exe	122
PID 4636 wrote to memory of 5948	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1952 wrote to memory of 5668	1952	olgeywqojg.exe	127
PID 4636 wrote to memory of 2352	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4636 wrote to memory of 5304	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 3108 wrote to memory of 2132	3108	dbytqligay.exe	136
PID 4636 wrote to memory of 3360	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4636 wrote to memory of 5000	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5732 wrote to memory of 3596	5732	vqnifdbvtn.exe	145
PID 4636 wrote to memory of 4708	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 6008 wrote to memory of 5124	6008	msedge.exe	151
PID 6008 wrote to memory of 1800	6008	msedge.exe	152
PID 6008 wrote to memory of 1976	6008	msedge.exe	153
PID 4636 wrote to memory of 5324	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 3224 wrote to memory of 5744	3224	sqkfdxsqki.exe	158
PID 4636 wrote to memory of 2296	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4636 wrote to memory of 3968	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2784 wrote to memory of 4784	2784	kicaxspnkf.exe	167
PID 4636 wrote to memory of 5812	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4636 wrote to memory of 4608	4636	2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1656 wrote to memory of 5964	1656	pjhfcausmk.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c6c0cf0322bbd2e24d2e6c9132e35eea_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:2712
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffa944ac188,0x7ffa944ac194,0x7ffa944ac1a0
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,1237034625601114013,676051731443435851,262144 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2024,i,11651458264485418541,11464110881787900854,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
      4⤵
      System Time Discovery
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,2695041233338087080,6842827701987899581,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,15485058351254928820,6795089327114995267,2097152 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,2052601479911048546,7746555943586411777,2097152 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,6146446006744447120,7790316662161864364,2097152 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,13357154131029048727,4552851955688910589,2097152 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4376,i,14375992505953554944,937908576219078866,2097152 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7203630885886728768,13891532801454749400,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,2045339283665411130,7281511499016697053,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,2040312855091247394,941775963641383953,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9919329410097314688,2385279518422488225,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9919329410097314688,2385279518422488225,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2392995692918060923,6921888758950296999,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,2366237087394477929,15796650323233820816,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,13328155938054461058,14987741089407924799,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,7242043218869780619,13978234403560962311,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1340,i,14371954854237008053,7973398436058622542,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,12177489864632016464,9379130116758077372,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1332,i,4217084173356331487,11876252337537996059,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,7409119291730629081,3890590163862138804,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,1657876222961403720,14970010146469730958,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:14
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,14829706601400495134,10260107125652213210,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,879615209676407474,10225254246719787499,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:14
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1456,i,16175133563635689344,649402484790039369,262144 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:10
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7618534333294670987,2137569939290521517,524288 --field-trial-handle=2272,i,3357444793975877687,13923609151670479201,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmgecwr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:428
- - C:\Temp\bztrmgecwr.exe
    C:\Temp\bztrmgecwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmgecwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Temp\i_bztrmgecwr.exe
    C:\Temp\i_bztrmgecwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\olgeywqojg.exe
    C:\Temp\olgeywqojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\i_olgeywqojg.exe
    C:\Temp\i_olgeywqojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytqligay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\dbytqligay.exe
    C:\Temp\dbytqligay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytqligay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\i_dbytqligay.exe
    C:\Temp\i_dbytqligay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnifdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Temp\vqnifdbvtn.exe
    C:\Temp\vqnifdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnifdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4708
- - C:\Temp\i_vqnifdbvtn.exe
    C:\Temp\i_vqnifdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkfdxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5324
- - C:\Temp\sqkfdxsqki.exe
    C:\Temp\sqkfdxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkfdxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2296
- - C:\Temp\i_sqkfdxsqki.exe
    C:\Temp\i_sqkfdxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxspnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\kicaxspnkf.exe
    C:\Temp\kicaxspnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxspnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\i_kicaxspnkf.exe
    C:\Temp\i_kicaxspnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhfcausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\pjhfcausmk.exe
    C:\Temp\pjhfcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhfcausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\i_pjhfcausmk.exe
    C:\Temp\i_pjhfcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkeczurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:464
- - C:\Temp\urmkeczurm.exe
    C:\Temp\urmkeczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkeczurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Temp\i_urmkeczurm.exe
    C:\Temp\i_urmkeczurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwurpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2268
- - C:\Temp\ezwurpjhbz.exe
    C:\Temp\ezwurpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwurpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2944
- - C:\Temp\i_ezwurpjhbz.exe
    C:\Temp\i_ezwurpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywtomgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5784
- - C:\Temp\geywtomgbz.exe
    C:\Temp\geywtomgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywtomgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\i_geywtomgbz.exe
    C:\Temp\i_geywtomgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\geywqoigay.exe
    C:\Temp\geywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6096
- - C:\Temp\i_geywqoigay.exe
    C:\Temp\i_geywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqlj.exe ups_run
  2⤵
  PID:2388
- - C:\Temp\qoigaytqlj.exe
    C:\Temp\qoigaytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqlj.exe ups_ins
  2⤵
  PID:3872
- - C:\Temp\i_qoigaytqlj.exe
    C:\Temp\i_qoigaytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnifdyvqn.exe ups_run
  2⤵
  PID:2568
- - C:\Temp\sqnifdyvqn.exe
    C:\Temp\sqnifdyvqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnifdyvqn.exe ups_ins
  2⤵
  PID:2832
- - C:\Temp\i_sqnifdyvqn.exe
    C:\Temp\i_sqnifdyvqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvsnkicax.exe ups_run
  2⤵
  PID:5100
- - C:\Temp\axvsnkicax.exe
    C:\Temp\axvsnkicax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvsnkicax.exe ups_ins
  2⤵
  PID:5404
- - C:\Temp\i_axvsnkicax.exe
    C:\Temp\i_axvsnkicax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfzxvpn.exe ups_run
  2⤵
  PID:524
- - C:\Temp\usmkfzxvpn.exe
    C:\Temp\usmkfzxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfzxvpn.exe ups_ins
  2⤵
  PID:4188
- - C:\Temp\i_usmkfzxvpn.exe
    C:\Temp\i_usmkfzxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkeczx.exe ups_run
  2⤵
  PID:1880
- - C:\Temp\czusmkeczx.exe
    C:\Temp\czusmkeczx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkeczx.exe ups_ins
  2⤵
  PID:5832
- - C:\Temp\i_czusmkeczx.exe
    C:\Temp\i_czusmkeczx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzxrpjhbzu.exe ups_run
  2⤵
  PID:4076
- - C:\Temp\bzxrpjhbzu.exe
    C:\Temp\bzxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzxrpjhbzu.exe ups_ins
  2⤵
  PID:3684
- - C:\Temp\i_bzxrpjhbzu.exe
    C:\Temp\i_bzxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbwuomgezw.exe ups_run
  2⤵
  PID:1072
- - C:\Temp\hbwuomgezw.exe
    C:\Temp\hbwuomgezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbwuomgezw.exe ups_ins
  2⤵
  PID:4960
- - C:\Temp\i_hbwuomgezw.exe
    C:\Temp\i_hbwuomgezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqoljdby.exe ups_run
  2⤵
  PID:5272
- - C:\Temp\bywqoljdby.exe
    C:\Temp\bywqoljdby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqoljdby.exe ups_ins
  2⤵
  PID:5388
- - C:\Temp\i_bywqoljdby.exe
    C:\Temp\i_bywqoljdby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgeb.exe ups_run
  2⤵
  PID:5432
- - C:\Temp\jdbvtolgeb.exe
    C:\Temp\jdbvtolgeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgeb.exe ups_ins
  2⤵
  PID:1416
- - C:\Temp\i_jdbvtolgeb.exe
    C:\Temp\i_jdbvtolgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5008

C:\Temp\qoigbywqom.sys
C:\Temp\qoigbywqom.sys
1⤵
- Executes dropped EXE
PID:576

C:\Temp\bytqoigdyv.sys
C:\Temp\bytqoigdyv.sys
1⤵
- Executes dropped EXE
PID:5312

C:\Temp\lidbvtnljd.sys
C:\Temp\lidbvtnljd.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\vsqkifaxvt.sys
C:\Temp\vsqkifaxvt.sys
1⤵
- Executes dropped EXE
PID:5312

C:\Temp\khfaxspkic.sys
C:\Temp\khfaxspkic.sys
1⤵
- Executes dropped EXE
PID:624

C:\Temp\khczxupmkh.sys
C:\Temp\khczxupmkh.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
- Executes dropped EXE
PID:916

C:\Temp\ezwrpjgezw.sys
C:\Temp\ezwrpjgezw.sys
1⤵
- Executes dropped EXE
PID:2836

C:\Temp\jebztrojge.sys
C:\Temp\jebztrojge.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\trljgbztrl.sys
C:\Temp\trljgbztrl.sys
1⤵
- Executes dropped EXE
PID:4988

C:\Temp\vtolgeyvqo.sys
C:\Temp\vtolgeyvqo.sys
1⤵
PID:408

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
PID:4672

C:\Temp\axvpkicays.sys
C:\Temp\axvpkicays.sys
1⤵
PID:3504

C:\Temp\kicaxsqkhf.sys
C:\Temp\kicaxsqkhf.sys
1⤵
PID:4900

C:\Temp\czuspkhfzx.sys
C:\Temp\czuspkhfzx.sys
1⤵
PID:4876

C:\Temp\eczurmjhec.sys
C:\Temp\eczurmjhec.sys
1⤵
PID:2816

C:\Temp\ebztrmjecw.sys
C:\Temp\ebztrmjecw.sys
1⤵
PID:4420

C:\Temp\jhbywurmjg.sys
C:\Temp\jhbywurmjg.sys
1⤵
PID:5400

C:\Temp\igeywqoigb.sys
C:\Temp\igeywqoigb.sys
1⤵
PID:1332

C:\Temp\dbvtnljday.sys
C:\Temp\dbvtnljday.sys
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigdyv.sys

Path C:\Temp\bytqoigdyv.sys
Size 141KB
SHA256 ee3b3aad55dd17919777c8f28056cd0f4c94b5a1d17e4e026bf3f37a43510a5d
MD5 396b950d0cb7645f3226acb435577cd8
SHA1 8c60ead3d5c7e8fa6cc6aa12b063094af53f4393
SHA512 669d57e951ac0af40f15240c0bee94fc56fba393a8fb0c074adb162ddf40aff45f6f566413e25da97a01b1319340ee32dd610406159680d6233c674cd6f84010
SSDEEP 3072:usQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:usQmpcF8BzXfwV
TLSH
T18FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmgecwr.exe

Path C:\Temp\bztrmgecwr.exe
Size 230KB
SHA256 0ab5f521e3eab70cbc44013ec0b3ca26bbd769a383ef756a1ce0637540cf3080
MD5 d1b8f7bb248cc3c1feffbd7c3095020b
SHA1 204a788bb6f08a299f81e776ec252b7825d89e2f
SHA512 8fae7fe3dc0def003458c361a995233ce5428f25fa359a288c4cdd6a710c3d167a5460dbdb4bdcea07b475217369cb370e81e2939273a11fcf40342d6da88116
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T160344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqligay.exe

Path C:\Temp\dbytqligay.exe
Size 230KB
SHA256 06e5621cb1b990ca49518cf938149d2da67b4bbf7c905f9b05936fe6d58ef034
MD5 fca4e69e2941526fbffb2212de280f0d
SHA1 381e13386eabf2623b78fa4e55aad56724958d61
SHA512 73f4252775702ae6e6c7590124c7cf6e2a68f1f99c37c27eda1bd263bfc74b0b3e42c9b74a78540579cd38e9e81e270f8db7099034f7e0dbe9d8d06368b2ea0e
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrmgecwr.exe

Path C:\Temp\i_bztrmgecwr.exe
Size 230KB
SHA256 f070f7e5bda7c39f5095da124c7015a255dcc6419e66756b2ce0610a5bfa6f36
MD5 0149c7ca524df13cc51e4d7a8715b150
SHA1 78ccc8339c1ebdda282aa13df57313e2a7d86fc3
SHA512 ccd0d91af2b97ca22786d9dbf12ce68d827e6121afb9c3b245f8f5a22ceda3bb1d3ff2bf01ad616cd22be82acf88fff26a58468d1630ff986490d61b4129cece
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T12F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbytqligay.exe

Path C:\Temp\i_dbytqligay.exe
Size 230KB
SHA256 c73a4310c4401e6a3bc09b6c68f7e8e019f6ab659d1fd28bcc91823d95007942
MD5 11b39382b0d3f9f3859b71d205fab135
SHA1 0a011b60bf30e57fc4d94e1bdb4761bcbfc50dce
SHA512 41d581099dd86d5f8295009163a818eb7031905b64f30236e1c42e8473f4e89dd309c73f08f16753e619103081634921f22ed55d382a7815cdbb1cbec96bf867
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T147344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicaxspnkf.exe

Path C:\Temp\i_kicaxspnkf.exe
Size 230KB
SHA256 49ef5baaa683f6f80b04aed0ff1132201dbf977153e8f8ce8bca2714832b23a0
MD5 3311b6908b4fc8df46e0eb7c2a1e02a4
SHA1 75aff85327353bbfa17a561424e352957b43cb28
SHA512 4778d56a001993eabc6a73a1ff44e90b7906c8fdb7dc4d671d0f9fc6ac4b35b634fb0b9f25ede2310a05d78de623cb31b5d036df1f58abaa6bd0a8fac06ab1e6
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T12E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqojg.exe

Path C:\Temp\i_olgeywqojg.exe
Size 230KB
SHA256 1385f8c78b3bfd708b28ac1408897ab02c9e6cd7c93e67714dbb43404857b6c6
MD5 f8ba562aca436f25a634f55ad6d3e0ed
SHA1 393503f046f4e6fe93f128520464221dc80d9717
SHA512 e67f43fa46fade00a239210531649ab5b183017e86edfc5bcd3a58972f55ad08f660e137f1431365f3163018bd89bea8efb6f32cc2dfcf7e0f62eb6ce362356b
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkfdxsqki.exe

Path C:\Temp\i_sqkfdxsqki.exe
Size 230KB
SHA256 459f7de90a0f23570e2a6c7efc5dff9e9001b919b8c237fde672dd5fb80c7f87
MD5 238ed3e918bccd109fe015325dc24c35
SHA1 73d7bbf1ff8feb9aa5be6786aab8063602ed6c23
SHA512 01e36f30c9f94648378ace794a13ddec478dbebe561c8922e1e925ec4b71775545f52bd30b54058250e507a37f8447dd8dad81cfc872edbb9bc179aed9639f21
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T175344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifdbvtn.exe

Path C:\Temp\i_vqnifdbvtn.exe
Size 230KB
SHA256 e783ebc13e756354eb620b31e454f2599fb36e7dbc167c440da027e9e02f4760
MD5 c2b37ece5f003f88d02067ef344bfcf9
SHA1 7bb589f67ee9a1a7c8f4d5ebbc4b511dda70cab7
SHA512 acdc613a93220ffe4ea2702e1fc461f94976d9c37397cb88123421a6514e926d1cd9644535389ea6b251799126d68373bdc931febe0d3a822ec56adc6c2b0136
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T123344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfaxspkic.sys

Path C:\Temp\khfaxspkic.sys
Size 141KB
SHA256 c8d8a3a7c837de5dee73ce595d4d81b6e1ad749d065a487906296932516a4062
MD5 610ee0e646461dd44cd604204cedc3a6
SHA1 23e0377386bbb0bf8355b6cb85eb4b8673e7dde5
SHA512 45bac573000e39727761ec0bc6d9a4d64ea77e4ff8e38be2f2ff5ff193f1166a7a78b791503406b86495c124f4dd2c3e365d8e7dc2a17d97d532caaedbc16b9b
SSDEEP 3072:2sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:2sQmpcF8BzXfwV
TLSH
T1FCE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspnkf.exe

Path C:\Temp\kicaxspnkf.exe
Size 230KB
SHA256 8ad1def13fe0a3d75de9067af8444ddd24c8d10d848a6cfc5eac22cc2ed97aa7
MD5 fa07b4c83c97c49cf9114c88b23fbdd2
SHA1 63fe7cc127c64bb8cdf1cb147fa69c7a750ab4e5
SHA512 4dc44b9e477ff9cddedb69d9493dc253200cbebb8b97af7b091887e5b3a7bc84a4a03972b99933333c0c88af2ad84bc65df4a12c15eba0c3fc94abbdf36896c6
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T14C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lidbvtnljd.sys

Path C:\Temp\lidbvtnljd.sys
Size 141KB
SHA256 308e484229e74811e7b48a7dcb0881ce7c124c098f96354640c7347558a57e80
MD5 f637a6a1a14a91636f189478db479a88
SHA1 4b7033a842ac2961df901596d2aa6b09da2b184b
SHA512 22865fb0fc271d1fdde682287da1b4c4475d59cd1f34553bde086931cd245857cd1ab7f9a00fd773cb823262232c420af7973389de971ac369a93e6836d6b973
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T12EE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqojg.exe

Path C:\Temp\olgeywqojg.exe
Size 230KB
SHA256 d2e8556de1a826245f542bb0063cb268ec30472ae087c031abeb8c0f3920a820
MD5 4228c49024d526948b1859091938fc86
SHA1 5afa5baf6d5f42dd0a632a71a07d4df8ae8544fd
SHA512 30818113b4c9409e82cd697550daa1d55fa42da3bcfbdaf0da3648bfa016b9441d818bf954f883a05d6dd1f65b925ba76a1c99f232cc9a6adf92157888f8aa7c
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T108344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbywqom.sys

Path C:\Temp\qoigbywqom.sys
Size 141KB
SHA256 1ed62a2d3fc8ddbc50f90f0f72d4132051a92ecc3c7ea3a19b5e7ae294a4e444
MD5 5cc6ae579247d9f9ac6da0696023aea0
SHA1 ab235448efb8f56556dc71d55bbb0856ac13e930
SHA512 0ffa5b3c9c910557b197c416dad73132441d16a62a9a03ca452e11bb4ce318ed26e8f3b1e4c0c041e7209486ecde5d96e226fd34c0b7e7245aef17c2a54cc3ce
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T102E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkfdxsqki.exe

Path C:\Temp\sqkfdxsqki.exe
Size 230KB
SHA256 fdd917941023c1a6ace183566f44f7c9a4dcdb11608197e88b6c998908f58d81
MD5 a3658afd11ace58f2e0a8783ba3614db
SHA1 6416521fe63c53030148a8247f804b293073368c
SHA512 284a286acdd3c45c24f63d28db9b1ad1b92c32febd18c2e838dcec1f76470ea2ecc732e47b009c3eaf067cbbee5e24878e8605f9f8d6b292762bf948ce6675a2
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T171344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifdbvtn.exe

Path C:\Temp\vqnifdbvtn.exe
Size 230KB
SHA256 6259a281ab480ce80a7f8ee105b69ce65126771f3fced34014a92e65782c0323
MD5 3bf7dca37973105dca6a4c82498b6227
SHA1 6b2418572e9ddaf19132deaf5a34a8eab45f0782
SHA512 61359bbee8c06d5b6953aef517a2ae7e171aa2c54269fe0a3fe01cadd275e15ba1e51dea5615689e8c9e79d6ef12c3cf3e1df15fc2885c9e38777ffa9ecf40e8
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T19A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkifaxvt.sys

Path C:\Temp\vsqkifaxvt.sys
Size 141KB
SHA256 c4e76fde9b1e42e28bda4872fef894742e93731ac27799f17bb338d94424a81b
MD5 2719ee8cd454574d8a1e9c3c6bc0c4a7
SHA1 89b8fa3a73a159023d1173d49b7d148b513d0602
SHA512 1aae79f818c49b3a30ea877cde35cf5ab0561e0f44a7534cf3ef3986a469fb5131fec74863572386d9d822a04d3c0e7753ca6dc4b726594b60eeb900251b1886
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T1EAE38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2023f70db971ee7825542d05e2fb69e5e94d3d3490338c5377cc7f96dbd390b3
MD5 10e4329a763d25f220979eff287318ac
SHA1 1523ae70cb63aa40dcb727d023a2e5b5ec2b2cb2
SHA512 2a37fa6690beccf38688bba19493754d15ca6348114955bfd4892077b6196f6eba090bd66b8eaca4585ac87bf43994c7f560fee85267bf42a38fe32769c3594e
TLSH
T16C51AEF7C6F8866EC90156F0AA147E2BCE2D0954832C3D5AC8E4EF1B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 60771030ab1472f5963d23b9de6b80b4afc357274b2a7271f87ba6b3d813fc2b
MD5 885a0819c59440d08f0727931a39fe4b
SHA1 762d2827491b196795f2969d83a2dd9ef593cb92
SHA512 3578ff099277a0fb7708f8b41bc270f90abfe0f97111f585739e0bed66e6949def2272f9a07f0bcff4d4cbf4f39bef7af93c44b23d8309f9363cbd7cfa3fa742
SSDEEP 192:sxRmRhCa/f9sX8IZAgZ/uTzoA8p9F/g6+WNCLxfYnp3hKGIIgViaOQJ:sxRmaa/f9sX82X/XD/5UfQRul
TLSH
T18842B7166E28993B4CC7D21DBB25BF53D6F96032A1E41E48E7FC861C14EA6DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9a107a17ad99449dda7a99f5e14e08b12b305d362aa3bbf1cdcfbef0a3e2757f
MD5 66800a4d545003c24e593abf9187d285
SHA1 5c5ca5d9bda0fa1f821a38ce2289c0a863409ab4
SHA512 70d03389b5d38292e7e9fff4a6033d472109154a8ca53956411912fe2155fc730cf73f58c0ae1511634187c87294423fcceca09118c78768b19a05fa55e2a094
SSDEEP 192:sxRVRhCa/f9sapIZAgZ/uTzoA8p9F/g6+WNCLxfYnpEhKGIIgDIiaOQJ:sxRVaa/f9sap2X/XD/5UfQCuM
TLSH
T19E42C91AAA24993B5CC7D21DBB25BF53D6F96032A1E41E48E7FC871C14E66CD620380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e7da90538178465238141ccc2d31593c8c32a177b9b67a44261a80b864533803
MD5 8324d048b0dc026d801a56ea4768ba1f
SHA1 7a0409d153f65e87eaf1669f54991116b9deb859
SHA512 cbb97f27b65a44c180f927b43ca61deb28ff13e871863c4b136c39658036d970d6447842d72535f5bcdcd5c52a3c99e971e404ade5db961b49b5e69d507101a4
SSDEEP 192:sxRVRhCa/f9sa8IZAgZ/uTzoA8p9F/g6+WNCLxfYnp3hKGIIgDyiaOQJ:sxRVaa/f9sa82X/XD/5UfQRum
TLSH
T1E842B8166A24993B4CC7D21DBB25BF53D6F96032A1E41E48E7FC861C14E66DD620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 074d489d7b0b47346d0d0f56f449aa99c86944683cd852619f4add11c452815d
MD5 a19e5f729d19f9eb0f2933933f4e035f
SHA1 6e838851722a1181ae0264c6cfb0111992e69b50
SHA512 f80929aaa770a8c6b3eb759377311c74eccfd4c0c202c32256a6b008884e0f80e8fb5b21f842ee73bd1897c83df3751fcdca296aadc264e090d70a35e3fe05c3
SSDEEP 768:wb8d+W7pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKpmu46WrohHN58:wb8d+2EfR6Wgouf6Mu1jaVpmV6tvS
TLSH
T179D2D97B740DCA7E4F800ADDEC19BE9F6DA802CB96D8C94447FA851C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d117a353b4e2bcd3a7446ff2895f3970a742f0751b273ae093b288fb23a52b96
MD5 a4415a30fe078597cc925e5ecc93e0cb
SHA1 669d54845665fe05d68d60258f7be5e6fc36c376
SHA512 ba44c2b9d717edf88e9334d06cfd002faa467d07700abb2a33eea2abed2b1ac3eb4a670f24386e65b792ccc6d7cd80ed4fc50feb0394b0305780ff6f624c5783
SSDEEP 96:KRklQUuSW0Wyf/gc0K4xgW0cUUfO0pH7kh1DZpVW9yogdVK4kgzVcbD1WEKLS2Cz:CklQUuSWLyfocIxgWbUUfO0pH7kh1DZy
TLSH
T12B911442717B1340387DEA0885A9895A82C278763219A53F37E947F64F6BE038DFD6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1e0061139db96eb452b47f4c12edf511693f672fa5659edad1c89d4b9fea3974
MD5 151dbaee421786c35f98f8c54743e10d
SHA1 c0df66e47dd829b1b4fa7a45373c3357073ffceb
SHA512 5b4d9664568e4ccc34d441e381ac5b4e27fee51d9326515123c5d438ddb959709a81b4fb763b2b65ef7e2d8ba239a8327fbdfbd0be3007808cca442ac5fea3bc
SSDEEP 768:i33fOs0DZIO0ZQRIWssNzc4ReyIsP0b9MAYU:i33f+IWsstc44bssb+At
TLSH
T11DF2CF35BC25CDB3ECEAA602F6563692BEF4612BC2E81E44D1DE9F0C09435AD075B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ab7c874c461e7d2ee9015ef289f743abf5deab1375952e0fe377600d6319891d
MD5 792279171e2263bb437e3027f4d7921d
SHA1 675b7ac07cb4766a22b46044e0a9e78f6268a746
SHA512 493f0d91907bdd44f56a36b785b21a4e9f6704af8df50f3e5249353c5fa0a88f10a5595a2e83f47d11c56b03e839b44974472169ab29cb805a0effc829ae28db
SSDEEP 768:2FQK3hwg9WsVZQ5O0ZQRIWs0Nzc4ReyIsP0b9MAYU:9K3dTIWs0tc44bssb+At
TLSH
T1501305F698D78976E8AE4743A37D2D52ADFCD167B1985984B7C94E0CCC421BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a59eb5f5258c1aee40edaf58b0fad9311dfd41dfa4349bab5d73175276ef8e3f
MD5 e8a4992c9dba441cd929c6dc32b89886
SHA1 2c44e295feb5b05a55080fe6ab94aa5dd03ff7f4
SHA512 eace36e3dd2d0b372fce80f680d28e8d60710da2278182743da4cf446fab7bcc22f52b0cb9ad7b127eb202a926088dd5aa7c69897a78d4ad780b0c5d73818cfd
SSDEEP 768:6rv+4UNbds3fODZIO0ZQRONzc4ReyIsXzeVH1S5D:6bsbS3uOtc44bsjEH1Y
TLSH
T10103DF32A868CA77ACF6A686B14B76537EF8512BC2D81E94C4DE1F0C464B5DD030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b66f59a9c8a973fe413847ce56290a6a69279232f7ea21a9933b8fb0ddb0f803
MD5 81156efc7368edbda1f4c00fa235ce7c
SHA1 938ff31488f508660e5a6f2a6cc03351bbbbccc2
SHA512 98fb111151cba1d1ab4b33b749838da6191addfd1129c4efb3c5e71158cff6d6d7a5da734eeafc7787b3ef1cfc0d9f485ae5f3cafeca4538ed9311d1f6e012a6
SSDEEP 768:irv+4UNbds3gys0DZIO0ZQRIWs4Nzc4ReyIsP02u:ibsbS3gaIWs4tc44bssV
TLSH
T13003BD32B828DDA3ACFAA245F14736937EF4216BC1C81E94C5DA4F4C46871EE275B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 96f993c099c1b2373e05a0a7d50ed8b869fab26664a38e64ab1dabc15642a925
MD5 0a7a3aa6856b05e9fad865acadebf646
SHA1 7aba8dd890bbec6a891b27583c628cc3d958e2a5
SHA512 c7ed8e9538ac6a90ce7440d851ba2dbaef9ccdc6968eac95767f5cea0da8e09809ef928e5e0782b6d541092d62650558be4a684442cca7f1be574501899c2e50
SSDEEP 768:i33gOs0DZIO0ZQRIWssNzc4ReyIsP0b9MAYU:i33g+IWsstc44bssb+At
TLSH
T1FBF2BF35BC25CDB3ECEA9602F6563692BEF4612BC2E82E44D1DE9F0C09435AD075B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8f441a84dc68e8815a876d946da42ccac64f682eb640361a2112f6ac6ef56d62
MD5 191a8ec093cc52361acccfcd93a2ca2e
SHA1 bce055222d03a6fce81e61de558de43851c258b5
SHA512 acb57e8cfc17e32e01363560db7e3e22a6b406c78d2cb40e99eb3fb4db2271a7a8b47b6fbbb488bcb7bbb9f1cd0623f7cc414f17335940c09e4f77fd3b6ad7aa
SSDEEP 768:Qrv+4UNbds3+9DZIO0ZQRIWspNzc4ReyIsP0eVH1S5s:QbsbS32IWsptc44bssEH1b
TLSH
T1E203CE32A829CD73ACFAA646F14B36937EF8216BC1940E94C5DA4F0C4A471DD175F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a27edeae-06f2-49fe-aec3-f558085acce4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a27edeae-06f2-49fe-aec3-f558085acce4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5970b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5970b2.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

d725ef2a-ddc2-4474-b61c-34d8abb1b85e.tmp

Path C:\Users\Admin\AppData\Local\Temp\d725ef2a-ddc2-4474-b61c-34d8abb1b85e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6008_1430926302\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/408-606-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/576-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/624-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/916-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-717-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2816-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3504-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-696-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-639-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4672-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4900-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4988-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5312-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5312-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-738-0x0000000000010000-0x0000000000083000-memory.dmp

Download