systex | 61e6efce63828c7ebe0d61ba6d8f9ba293ab41ad5b66c459d9c20352c86c9c04

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260730-da66ss1wh1
SHA256 61e6efce63828c7ebe0d61ba6d8f9ba293ab41ad5b66c459d9c20352c86c9c04
MD5 dac3a0e0a4df8d319762af8fd8ede3a3
SHA1 94973b5e36976f43f514ea5c1d7d76f6f4d97792
SHA512 caeabfbbea23d9569a2ebefe7e44748a8194d4b41f50e2a8cfff0ce2d8f85c33787f74e7bedb50f8c83ec082a0f0bb55419b2560ccb56e5b6c9affcbea68dcd4
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4584	CP.exe
4500	icavtnlfxv.exe
3896	CP.exe
2440	CP.exe
5696	i_icavtnlfxv.exe
2000	vpnhfdxvpn.sys
2280	CP.exe
4876	kicauspkhf.exe
5556	CP.exe
5284	CP.exe
5824	i_kicauspkhf.exe
1524	caxrpkhcau.sys
3196	CP.exe
3336	cxupkhfzxr.exe
3044	CP.exe
6016	CP.exe
5916	i_cxupkhfzxr.exe
3320	fzxrpkhfzx.sys
4288	CP.exe
1932	urpjhezwur.exe
1804	CP.exe
3660	CP.exe
4820	i_urpjhezwur.exe
480	cwurmjhbzu.sys
5636	CP.exe
5336	trmjecztrm.exe
4932	CP.exe
3888	CP.exe
6028	i_trmjecztrm.exe
5916	mgeywqojge.sys
6104	CP.exe
724	jgeywromjh.exe
2704	CP.exe
5004	CP.exe
3468	i_jgeywromjh.exe
1168	lgeyvtrljd.sys
4956	CP.exe
5396	lgdbywqoig.exe
1840	CP.exe
800	CP.exe
248	i_lgdbywqoig.exe
3532	aytqljdbvt.sys
3144	CP.exe
2660	qoigaysqli.exe
5072	CP.exe
1748	CP.exe
1524	i_qoigaysqli.exe
3320	ytnlfdavsq.sys
1220	CP.exe
1660	tnlfdxvqni.exe
5752	CP.exe
2836	CP.exe
676	i_tnlfdxvqni.exe
5452	fdxvpnhfax.sys
3140	CP.exe
2708	xusnhfaxsp.exe
244	CP.exe
5168	CP.exe
4896	i_xusnhfaxsp.exe
3124	kicaxspkic.sys
5340	CP.exe
5432	hfzxupmkic.exe
716	CP.exe
4868	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_906189461\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2012_1734337536\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_82749216\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_875081016\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_875081016\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_154304406\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_906189461\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_154304406\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_906189461\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_906189461\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2012_1128384073\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywromjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavtnlfxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgebvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgebvtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupkhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjecztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupkhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavtnlfxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqgaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicauspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicauspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqgaytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhezwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywromjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjecztrm.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5300	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6072	ipconfig.exe
2620	ipconfig.exe
3888	ipconfig.exe
3328	ipconfig.exe
1128	ipconfig.exe
3508	ipconfig.exe
4396	ipconfig.exe
3820	ipconfig.exe
1532	ipconfig.exe
4924	ipconfig.exe
2824	ipconfig.exe
3380	ipconfig.exe
1360	ipconfig.exe
2104	ipconfig.exe
2676	ipconfig.exe
1504	ipconfig.exe
3340	ipconfig.exe
3736	ipconfig.exe
3672	ipconfig.exe
5972	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298533709538185"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{A6EFFE50-0272-4130-9651-016BD231D3D4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe
4500	icavtnlfxv.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5696	i_icavtnlfxv.exe
Token: SeDebugPrivilege	5824	i_kicauspkhf.exe
Token: SeDebugPrivilege	5916	i_cxupkhfzxr.exe
Token: SeDebugPrivilege	4820	i_urpjhezwur.exe
Token: SeDebugPrivilege	6028	i_trmjecztrm.exe
Token: SeDebugPrivilege	3468	i_jgeywromjh.exe
Token: SeDebugPrivilege	248	i_lgdbywqoig.exe
Token: SeDebugPrivilege	1524	i_qoigaysqli.exe
Token: SeDebugPrivilege	676	i_tnlfdxvqni.exe
Token: SeDebugPrivilege	4896	i_xusnhfaxsp.exe
Token: SeDebugPrivilege	3264	i_hfzxupmkic.exe
Token: SeDebugPrivilege	4436	i_mkecwupmhe.exe
Token: SeDebugPrivilege	2060	i_upjecwuomh.exe
Token: SeDebugPrivilege	5692	i_ljgeywrojg.exe
Token: SeDebugPrivilege	2676	i_tolgebvtrl.exe
Token: SeDebugPrivilege	5460	i_ywqgaytqlj.exe
Token: SeDebugPrivilege	4248	i_lfdavtnlfd.exe
Token: SeDebugPrivilege	960	i_cavsnlfdxv.exe
Token: SeDebugPrivilege	3604	i_spkhfausnk.exe
Token: SeDebugPrivilege	5768	i_spnzxrpjhc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4748	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4216 wrote to memory of 5808	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5808 wrote to memory of 2576	5808	iexplore.exe	91
PID 4748 wrote to memory of 2012	4748	iexplore.exe	92
PID 2012 wrote to memory of 4784	2012	msedge.exe	93
PID 2012 wrote to memory of 5300	2012	msedge.exe	94
PID 2012 wrote to memory of 5068	2012	msedge.exe	95
PID 2012 wrote to memory of 5068	2012	msedge.exe	95
PID 2012 wrote to memory of 5068	2012	msedge.exe	95
PID 2012 wrote to memory of 3720	2012	msedge.exe	96
PID 2012 wrote to memory of 3720	2012	msedge.exe	96
PID 2012 wrote to memory of 2580	2012	msedge.exe	98
PID 2012 wrote to memory of 2580	2012	msedge.exe	98
PID 2012 wrote to memory of 2580	2012	msedge.exe	98
PID 2012 wrote to memory of 2800	2012	msedge.exe	99
PID 2012 wrote to memory of 2800	2012	msedge.exe	99
PID 2012 wrote to memory of 2800	2012	msedge.exe	99
PID 2012 wrote to memory of 4336	2012	msedge.exe	101
PID 2012 wrote to memory of 4336	2012	msedge.exe	101
PID 2012 wrote to memory of 4336	2012	msedge.exe	101
PID 2012 wrote to memory of 1068	2012	msedge.exe	102
PID 2012 wrote to memory of 5464	2012	msedge.exe	100
PID 2012 wrote to memory of 1068	2012	msedge.exe	102
PID 2012 wrote to memory of 1068	2012	msedge.exe	102
PID 2012 wrote to memory of 5464	2012	msedge.exe	100
PID 2012 wrote to memory of 5464	2012	msedge.exe	100
PID 2012 wrote to memory of 724	2012	msedge.exe	104
PID 2012 wrote to memory of 724	2012	msedge.exe	104
PID 2012 wrote to memory of 4476	2012	msedge.exe	105
PID 2012 wrote to memory of 4476	2012	msedge.exe	105
PID 2012 wrote to memory of 1260	2012	msedge.exe	106
PID 2012 wrote to memory of 1260	2012	msedge.exe	106
PID 2012 wrote to memory of 5448	2012	msedge.exe	108
PID 2012 wrote to memory of 3888	2012	msedge.exe	109
PID 2012 wrote to memory of 3888	2012	msedge.exe	109
PID 4216 wrote to memory of 4584	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 4500 wrote to memory of 3896	4500	icavtnlfxv.exe	115
PID 2012 wrote to memory of 1280	2012	msedge.exe	118
PID 2012 wrote to memory of 1280	2012	msedge.exe	118
PID 2012 wrote to memory of 5328	2012	msedge.exe	120
PID 2012 wrote to memory of 5560	2012	msedge.exe	121
PID 2012 wrote to memory of 5328	2012	msedge.exe	120
PID 2012 wrote to memory of 5560	2012	msedge.exe	121
PID 4216 wrote to memory of 2440	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4216 wrote to memory of 2280	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4876 wrote to memory of 5556	4876	kicauspkhf.exe	128
PID 4216 wrote to memory of 5284	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4216 wrote to memory of 3196	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 3336 wrote to memory of 3044	3336	cxupkhfzxr.exe	137
PID 4216 wrote to memory of 6016	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4216 wrote to memory of 4288	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 1932 wrote to memory of 1804	1932	urpjhezwur.exe	146
PID 4216 wrote to memory of 3660	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 2012 wrote to memory of 2620	2012	msedge.exe	152
PID 2012 wrote to memory of 4708	2012	msedge.exe	153
PID 2012 wrote to memory of 248	2012	msedge.exe	154
PID 4216 wrote to memory of 5636	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 5336 wrote to memory of 4932	5336	trmjecztrm.exe	159
PID 4216 wrote to memory of 3888	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4216 wrote to memory of 6104	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 724 wrote to memory of 2704	724	jgeywromjh.exe	168
PID 4216 wrote to memory of 5004	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 4216 wrote to memory of 4956	4216	2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe	175
PID 5396 wrote to memory of 1840	5396	lgdbywqoig.exe	177

C:\Users\Admin\AppData\Local\Temp\2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_dac3a0e0a4df8d319762af8fd8ede3a3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffd5d4ec188,0x7ffd5d4ec194,0x7ffd5d4ec1a0
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,15349023400002754179,3981337532872992936,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
      4⤵
      System Time Discovery
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,16086622412109065240,7615354112357042188,262144 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2768,i,2293588145991200712,15833970845199480214,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:13
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,17273001034138876297,5680093940369190720,2097152 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,14007075617028866067,6603047923988146950,2097152 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,14389038947456823311,17723245798555501168,2097152 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:9
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,5649773127495220911,11787877658880604358,2097152 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4464,i,8968599825354659572,17126595388467911181,2097152 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,12358493164730927,13498937801130710370,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,12498435922553661942,1893250792823726598,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,4015185430421544081,15940890559923139885,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,17137463782834029577,13885342404889439939,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,17137463782834029577,13885342404889439939,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,10291872839185926711,3033460998108322874,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,7136751030769325785,3642840155123250108,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,3203643419605402228,1594997690236401034,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:5328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,6259858309035293795,1832287119251785948,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,6032835902173667651,7162756215737221659,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,12103018955362891950,2598160496934933230,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,16797062603553494383,6633714140615013197,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
      4⤵
      PID:248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,429929440005184122,9498884424447042032,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,8176118782167400413,652755337909609267,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:3772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,11501465852628018196,14444553940555631139,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,9105202576238287680,1381496788235751830,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
      4⤵
      PID:2584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,12320808714039629236,1730296248032679215,262144 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:10
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,4558802328599622547,1594498054839257002,524288 --field-trial-handle=2392,i,15129413114246555235,14858906271343631350,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:2648
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:2576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavtnlfxv.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4584
- - C:\Temp\icavtnlfxv.exe
    C:\Temp\icavtnlfxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavtnlfxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2440
- - C:\Temp\i_icavtnlfxv.exe
    C:\Temp\i_icavtnlfxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicauspkhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2280
- - C:\Temp\kicauspkhf.exe
    C:\Temp\kicauspkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicauspkhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5284
- - C:\Temp\i_kicauspkhf.exe
    C:\Temp\i_kicauspkhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxupkhfzxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\cxupkhfzxr.exe
    C:\Temp\cxupkhfzxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxupkhfzxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6016
- - C:\Temp\i_cxupkhfzxr.exe
    C:\Temp\i_cxupkhfzxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhezwur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4288
- - C:\Temp\urpjhezwur.exe
    C:\Temp\urpjhezwur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhezwur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\i_urpjhezwur.exe
    C:\Temp\i_urpjhezwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjecztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5636
- - C:\Temp\trmjecztrm.exe
    C:\Temp\trmjecztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjecztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3888
- - C:\Temp\i_trmjecztrm.exe
    C:\Temp\i_trmjecztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywromjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6104
- - C:\Temp\jgeywromjh.exe
    C:\Temp\jgeywromjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywromjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5004
- - C:\Temp\i_jgeywromjh.exe
    C:\Temp\i_jgeywromjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdbywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\lgdbywqoig.exe
    C:\Temp\lgdbywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdbywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:800
- - C:\Temp\i_lgdbywqoig.exe
    C:\Temp\i_lgdbywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3144
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Temp\tnlfdxvqni.exe
    C:\Temp\tnlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2836
- - C:\Temp\i_tnlfdxvqni.exe
    C:\Temp\i_tnlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusnhfaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3140
- - C:\Temp\xusnhfaxsp.exe
    C:\Temp\xusnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusnhfaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5168
- - C:\Temp\i_xusnhfaxsp.exe
    C:\Temp\i_xusnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxupmkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5340
- - C:\Temp\hfzxupmkic.exe
    C:\Temp\hfzxupmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxupmkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_hfzxupmkic.exe
    C:\Temp\i_hfzxupmkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run
  2⤵
  PID:6020
- - C:\Temp\mkecwupmhe.exe
    C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins
  2⤵
  PID:4928
- - C:\Temp\i_mkecwupmhe.exe
    C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upjecwuomh.exe ups_run
  2⤵
  PID:2516
- - C:\Temp\upjecwuomh.exe
    C:\Temp\upjecwuomh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upjecwuomh.exe ups_ins
  2⤵
  PID:2888
- - C:\Temp\i_upjecwuomh.exe
    C:\Temp\i_upjecwuomh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgeywrojg.exe ups_run
  2⤵
  PID:5444
- - C:\Temp\ljgeywrojg.exe
    C:\Temp\ljgeywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgeywrojg.exe ups_ins
  2⤵
  PID:2972
- - C:\Temp\i_ljgeywrojg.exe
    C:\Temp\i_ljgeywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgebvtrl.exe ups_run
  2⤵
  PID:1036
- - C:\Temp\tolgebvtrl.exe
    C:\Temp\tolgebvtrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgebvtrl.exe ups_ins
  2⤵
  PID:5488
- - C:\Temp\i_tolgebvtrl.exe
    C:\Temp\i_tolgebvtrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqgaytqlj.exe ups_run
  2⤵
  PID:3480
- - C:\Temp\ywqgaytqlj.exe
    C:\Temp\ywqgaytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqgaytqlj.exe ups_ins
  2⤵
  PID:2948
- - C:\Temp\i_ywqgaytqlj.exe
    C:\Temp\i_ywqgaytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdavtnlfd.exe ups_run
  2⤵
  PID:5652
- - C:\Temp\lfdavtnlfd.exe
    C:\Temp\lfdavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdavtnlfd.exe ups_ins
  2⤵
  PID:3116
- - C:\Temp\i_lfdavtnlfd.exe
    C:\Temp\i_lfdavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run
  2⤵
  PID:4924
- - C:\Temp\cavsnlfdxv.exe
    C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnlfdxv.exe ups_ins
  2⤵
  PID:2676
- - C:\Temp\i_cavsnlfdxv.exe
    C:\Temp\i_cavsnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhfausnk.exe ups_run
  2⤵
  PID:4848
- - C:\Temp\spkhfausnk.exe
    C:\Temp\spkhfausnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhfausnk.exe ups_ins
  2⤵
  PID:2056
- - C:\Temp\i_spkhfausnk.exe
    C:\Temp\i_spkhfausnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnzxrpjhc.exe ups_run
  2⤵
  PID:1192
- - C:\Temp\spnzxrpjhc.exe
    C:\Temp\spnzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnzxrpjhc.exe ups_ins
  2⤵
  PID:264
- - C:\Temp\i_spnzxrpjhc.exe
    C:\Temp\i_spnzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5428

C:\Temp\vpnhfdxvpn.sys
C:\Temp\vpnhfdxvpn.sys
1⤵
- Executes dropped EXE
PID:2000

C:\Temp\caxrpkhcau.sys
C:\Temp\caxrpkhcau.sys
1⤵
- Executes dropped EXE
PID:1524

C:\Temp\fzxrpkhfzx.sys
C:\Temp\fzxrpkhfzx.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\cwurmjhbzu.sys
C:\Temp\cwurmjhbzu.sys
1⤵
- Executes dropped EXE
PID:480

C:\Temp\mgeywqojge.sys
C:\Temp\mgeywqojge.sys
1⤵
- Executes dropped EXE
PID:5916

C:\Temp\lgeyvtrljd.sys
C:\Temp\lgeyvtrljd.sys
1⤵
- Executes dropped EXE
PID:1168

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:3532

C:\Temp\ytnlfdavsq.sys
C:\Temp\ytnlfdavsq.sys
1⤵
- Executes dropped EXE
PID:3320

C:\Temp\fdxvpnhfax.sys
C:\Temp\fdxvpnhfax.sys
1⤵
- Executes dropped EXE
PID:5452

C:\Temp\kicaxspkic.sys
C:\Temp\kicaxspkic.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\upmkecxupn.sys
C:\Temp\upmkecxupn.sys
1⤵
PID:248

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
PID:4128

C:\Temp\ljheywromg.sys
C:\Temp\ljheywromg.sys
1⤵
PID:5908

C:\Temp\oljdbztrlj.sys
C:\Temp\oljdbztrlj.sys
1⤵
PID:2612

C:\Temp\ytnljgbywq.sys
C:\Temp\ytnljgbywq.sys
1⤵
PID:1448

C:\Temp\vtnlfdyvqn.sys
C:\Temp\vtnlfdyvqn.sys
1⤵
PID:3180

C:\Temp\fdxvpnlfdx.sys
C:\Temp\fdxvpnlfdx.sys
1⤵
PID:4444

C:\Temp\dxvkfcxvpn.sys
C:\Temp\dxvkfcxvpn.sys
1⤵
PID:5972

C:\Temp\xspkicausm.sys
C:\Temp\xspkicausm.sys
1⤵
PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caxrpkhcau.sys

Path C:\Temp\caxrpkhcau.sys
Size 141KB
SHA256 6201fdf3896471f9f7e58fc88bc4a6e7b81aab699be0fcf879494948e51440e1
MD5 303971bad9093e4b0a3e4f49459685a4
SHA1 f4c8fa3b3298c6ee2bab471c38daddd10bcc1192
SHA512 58befd61e22d8283b2042511ec883f445884fbe15a5e4aa9e1781a983af8ecfd76f8571c0313758f435b77ae14a5042219dd972251fe7e691170078e3e74182d
SSDEEP 3072:fsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:fsQmpcF8BzXfwV
TLSH
T157E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwurmjhbzu.sys

Path C:\Temp\cwurmjhbzu.sys
Size 141KB
SHA256 538a5816adf0bf4f640e28bcfcf45e6dab3601ad11424d7975dfcb7dcb3997f0
MD5 0bf3fd55e6b690ec3a644be98f03baf2
SHA1 22e906a1dc462d7e4f5e561738bf81c53ff42de3
SHA512 b5cca4734f3a1acb1902e788775fa0a50575bb05006eb16f87245abc972c0dcfee09340d453f593997e119ddb73613103fea5be8f5cfdf5e51ed0d33fd0f999b
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T1C1E38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupkhfzxr.exe

Path C:\Temp\cxupkhfzxr.exe
Size 230KB
SHA256 d730638982719883603a652e51e3ac47c2498a04996cd8a783f0c52a7e505c1f
MD5 199400b6e9082d9fd2fad606c267394d
SHA1 ae1cb40dcedf8ca82a545d901b4f2c93849d7c34
SHA512 81fb729e26738370d39e733ffacef5684d9d6ebf36ea7ddd6aa9c94668d707bbd6ae35baa9ec58a1290f339b6a8177ddfc35e5d7f84eb3357e8ce28c9bfca3cd
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T13B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrpkhfzx.sys

Path C:\Temp\fzxrpkhfzx.sys
Size 141KB
SHA256 2afea7d200a9723662fab2383d904166d2db72970b25b176a7e232255067ac7f
MD5 775db1d31edf2a98b09b9c82a6c0c454
SHA1 a70cce8c491ddf28cc2d17965fdccc1504fda245
SHA512 c55fd3afc5089f46acb25481029c0f52338cd960529a0494108884c7caadc08eb1415622e048e8899c0f28c9f54da518578fa072f4f7119224d8904dc99555b8
SSDEEP 3072:LsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:LsQmpcF8BzXfwV
TLSH
T185E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxupkhfzxr.exe

Path C:\Temp\i_cxupkhfzxr.exe
Size 230KB
SHA256 b0d5ffffaf4927e774c4dbc462186506ffb9f5fc4e1503656d689b1585994d0a
MD5 f97b22124d397e42d3ae3b4d4d816e61
SHA1 2e71b3ccce6231971b2e2f6398942ef725a3b7b4
SHA512 23388b4eb5012ea6c957a1d3a2246a6f4eab2702bcd51bb03ae68c60e1b1c2ff16b1e17c3fc8aa883c50c5df968bff38cf4b8ee6680105d09b9318c5d744b667
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T130344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icavtnlfxv.exe

Path C:\Temp\i_icavtnlfxv.exe
Size 230KB
SHA256 0cffd7d6063a42dc18406cc222f91a41828b715aff88814c0d786fc47ac532ad
MD5 2ab014a0e016796e5bf4d23f3f75730d
SHA1 58509fd1932f73984415ca1c58c018d042f5ac7d
SHA512 648cc5e34038f51098164f8d4020464f58de6fa85412696038626bbb9e63b9572bdd43f2e9714c6dc087ef5f2bef23511414b487b8330dcbbcfea60b0eabf8ad
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T128344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeywromjh.exe

Path C:\Temp\i_jgeywromjh.exe
Size 230KB
SHA256 954135077b8a7c9e0adb1f6762cfee921f3f828fe4a6d8a925829e07f5811c8f
MD5 79473e273ff8e302bcdfdd35617eef26
SHA1 e3bfc743b307e915da4869d8cf7186585712b976
SHA512 0275e42a3363f73202d41e5effdc0b282f9a2d02d47ffc5c9ff9ff147cd551dc7ef83170b59fd5b923423626f168ad5aa25b8c571d03a884cecd2a19d747dc2c
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T13C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicauspkhf.exe

Path C:\Temp\i_kicauspkhf.exe
Size 230KB
SHA256 2e7bff5db7c24c0ddf3e49864129e0aec9234a84d91a5b9299d36632a686dac6
MD5 af3286ce57409461fb45f0356967dd88
SHA1 288dc1181c8754c6c8a73733b5ea629a3e4d2ee0
SHA512 79f4a08bf167f0ac7d7b8527581cfe42debdba2828b7defdcab3233a2e1608d3f5ee85530e1c2ce03735cbef94dc19a8aee8969472963fd144839bd85617afae
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T197344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjecztrm.exe

Path C:\Temp\i_trmjecztrm.exe
Size 230KB
SHA256 33b1452c68e1bdce6d92bc4be4f6ba3509276cafc960ba6fc780ea891a9147e5
MD5 44f26cebda614a3b2c291d8f03fc26b3
SHA1 4b495324e25977e963bd63ef821e164b0aefa428
SHA512 b3c7d07b51e7bef112c495bf8247b971fd8f51981c15a20cfd5c12fab35757568bc2afe0303ec6d98ca2df47ac510db9d3e8b1e7d1b97d11eb47b8a41213fb23
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhezwur.exe

Path C:\Temp\i_urpjhezwur.exe
Size 230KB
SHA256 e2a0eb9d4863f8a126838f88dd6d37f069aa01b356cbb8f431c42a1d683631c0
MD5 2ee4c1e72146f50eab817445ee860f00
SHA1 ad0d041d495af6ccc9b19ca1b74b3961d084c950
SHA512 1f05839cb65ed0efa9ce3e34067b5cbff156179a2190bee2389da895b2efee00c1bbf90c69d97053d384bbc146224d36d6c2497c7955562102bb3392c4a6d3ee
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavtnlfxv.exe

Path C:\Temp\icavtnlfxv.exe
Size 230KB
SHA256 2ef3d2e38b16e97fd7e8c770bc748eabec94676e72ddc48c431f5a0d6897b93b
MD5 07e28a08f5dd3d463d8ef2d617f1978f
SHA1 09ff2bf02f7b3afeb3eb4169e64c8169f2db58e2
SHA512 7d521145a64d96b3f7914af3039eb4101bf850b0a03c2c84f213d65dc22965b7f87e1db9f8546ab751a8cd23a5d4a0858245a76e0e2d981f7496eceb708d1c45
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeywromjh.exe

Path C:\Temp\jgeywromjh.exe
Size 230KB
SHA256 09869253ec605b5649ae8ec14f97e0d391acfa77f3871788f189c88a9ecf4feb
MD5 435cc8fce64292677c4de5043e214511
SHA1 058db7a617b1e4537c3d590915ffc9941a1c49a5
SHA512 f0a3057b6946d5f2b0676d8a0f5f50851cb3bf23dcfd9072df2ac05beaba5ef71d7646f01b23dcf7030e76b4f8f8807097d670663bfb141683559b9e04f1e935
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicauspkhf.exe

Path C:\Temp\kicauspkhf.exe
Size 230KB
SHA256 987283d3725ccbcb108140b447791096d85ee79efa28d30281fa8006db942024
MD5 e154cd8860c0c2d440fe2a327f9da4a4
SHA1 16b7470095824df8462e32af8ec5015910a2c974
SHA512 af1e766c2df0a8a98befff16ce88b32ef9e22b3febf8719b444ea3d809bb47993d95583597d3315001aabb0753dc4225e4008acd585a4eccc9af91e5adb87793
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywqojge.sys

Path C:\Temp\mgeywqojge.sys
Size 141KB
SHA256 72e408cff78452194ddef4b3cafc1212c4321f658afd9f9a4611998bcb659a7e
MD5 089d810f1891d96e2d72685ef605389b
SHA1 b0c671c9e7605223ca09c6dfdee6b75ee792d79e
SHA512 055bf1d30631865291f71a344fad16f8a12af6a749aa57460b1c7aeea0f5ecd985bf698e7b25cfb9b5ce7195b2f03fc39a17d0ef8683254d11826dbc39c1d667
SSDEEP 3072:PsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:PsQmpcF8BzXfwV
TLSH
T13AE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecztrm.exe

Path C:\Temp\trmjecztrm.exe
Size 230KB
SHA256 6a7d6401c4a12ece1d39eb0252577e7c01e083d14ff6633b0b46fa5c1d77a8d5
MD5 979adab393ee379c4c8541116ca6fec5
SHA1 1ebf9136044245088475d2b92a52639f87cc1a53
SHA512 decd73e4c7c6fd92af732b6e894d04a8fa69d1a0218ba3c8de83f6068ab1d3ab5f7057ea708f54204bde05b0cc21515f6089479ad2b167ba367ef29704d1f4f1
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T132344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhezwur.exe

Path C:\Temp\urpjhezwur.exe
Size 230KB
SHA256 c920c2f6d637910f98866398db7c93395ba583047c6b69397596006c4334f225
MD5 46bc5bdc1286f616199d320f25932156
SHA1 28bb64883a6ac0b1878757a371de924af14fcbe4
SHA512 5bc2b6cc627dcdad9eda2800236f473acb4317858cd61c5693e2e6857745bfdd6e4449fa5c1aac7cb6d42f787a6125235e0f3bb4fbe1e1937ec0024d686417f3
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T16C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfdxvpn.sys

Path C:\Temp\vpnhfdxvpn.sys
Size 141KB
SHA256 393f3c8e9077dfcd53e7984983bfb3b1706f8764272557178b9048393e3b63b0
MD5 15b70d2b07b51e166005833236f60e41
SHA1 1cbefdc3d6ef42a7b63cd1deccb6b9b2a2dc916f
SHA512 455318471fbb3f674c411acf66910135fdaa9789fc36bf4fa7395345b3534c17f02b618d6e3664afb13ae9bcfbfc87d51b885f69ae100c8672718b240e90d363
SSDEEP 3072:ssQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ssQmpcF8BzXfwV
TLSH
T1B7E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1e1747e8ec88f59c9c8ec9149750722b631a261146ff67a9a78010cf7e5c42b3
MD5 e67147410770c5fa5fb621064d198687
SHA1 e2f620bd49787ad89cfa96b79541be92fbaf936e
SHA512 3de5eff02233ee38f2e5fd85e38c3c01777f7920c466a4a867a6e6dc9b513ef9571802fa0453ab380db05cc7493cf036dff3026d722cf41ec40f4b0806d73c06
TLSH
T14A514073336D09D8EB2A857520E296B632F5C35E8707AE4282995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0dad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a0dad.TMP
Size 2KB
SHA256 8cb3d494a65752aa1e3be2b413941382b104240beff5b02d1778542ee3cbcb5b
MD5 518f3285d95f51206f246e941cda2f1d
SHA1 db87324d7bef49d48f5d70b4fa66cb27de598fc0
SHA512 58ead639c58cb1e8f2ec6ad0912e916a4d87902b2d7f1349b7f1aa1a2054ab987f66b08c54ecb0aa246f3697fe956247e19b69b4732fffd3e2b1f0dbcd26e67b
TLSH
T1DA514173336C09D8EB2A847520E2D6B632F5C35E8707AE8286995CB77906F4052F2C5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f523b59006edaaf5acbaee652e14abe96a1abed4b558cc145fad5f60f31deee8
MD5 ff6aef557eb410e63f5cc64d137c6823
SHA1 42675726ad8a7d04c15d082c136287aa7960fa8e
SHA512 6b76c63647f9d3241547ad8750765a5957460fc9155e6c7e01f30d9e199578480f76153492a9df16a64544daa4fead7b20917424971432b1c25205031b787070
TLSH
T1F3518DF7C2E8866D891156F0AB147E1BCE2D0A54832C3D5AC8E4AF6B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f118b6e8ef87f9af16b9537108aed0bb41980551f9581c362110f9dd1c5eec91
MD5 316e9b560e33d9b0a9b38bf2e836383c
SHA1 6d4fb3e7c1d49bb5b897a14f98bfbef76d00d72a
SHA512 52203c574bbc67ae9c5dbf5bfe70ded81daeea746988d9699bd13df653a8eb3ba8fea960f64bc6f60e8eb53f550dc2b58ee9b65cf9401135c40f889f6d257afd
SSDEEP 192:sxR0RsCn/fQsTuwZAo9GzoA8p9g/g6+WNCNDfYD9HSSuGQvIgVA8XJ:sxR0Rn/fQsTuujVi/5UfZSiz
TLSH
T1F842C71A6E28997B4CC7D219FB157F53D2F95032A1946E48F7FC9A0C14EA6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2647af7d186d32212c7e3ffeed19330792779bac9b092a94d68ef7dd01a4f6ad
MD5 144de517c3af9316036561bfcc5702ab
SHA1 d171266bc1d442afb8cabb47057436a09ac2a772
SHA512 218662660772ae8f16ea7028ad0e56957a6eeecf8282bc2b0da43d46c1c66acc8f467218985828a3ad6630e56541766d63ee000e302558e89e7c89a845645539
SSDEEP 192:sxRzRsCn/fQskuwZAo9GzoA8p9g/g6+WNCNDfYD9HSSuGQvIgDLA8XJ:sxRzRn/fQskuujVi/5UfZSih
TLSH
T13B42C71AAE28997B4CC7D219FB557F53D2F95032A1946E48F7FC9A0C14EA6CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 17790a043ef669faccc15f2da0e6bf321bdcb8f74cdf980325967291aa7aafe3
MD5 d56a2b749e4dddfed0a44ab85e2d0406
SHA1 2aa20e9fcd181b28c9fae56a7d44915496849d0a
SHA512 4d0999f35eff0f2b17cbe1a5215881b15d79711b45ae41473cfc32dfb7c28fa163e7a447f8b231aa1987100cd44a8b86d48f1fb6351cc62dc095606c5c03de31
SSDEEP 192:sxRzRsCn/fQskKwZAo9GzoA8p9g/g6+WNCNDfYD9DSSuGQvIgDZA8XJ:sxRzRn/fQskKujVi/5UfrSi7
TLSH
T1D442C81AAE28597B4CC7E219BB557F53E2F95032A1946E48F7FC9B0C10EA6CD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 745c12de8a518fbc1cefcaf8d2b2b63ffce641657fc94a7873cf1cd80aae0436
MD5 a210dc6cbfa95147de41f60702bf7afc
SHA1 e64d3b17408c81c25f454ad24d8e25d1fe16c14a
SHA512 65f25b110ab7bf23cd0131adb7b593f8059dd79bc5b029eebdcad1c8a3c9c0a3d7045f0441533c646379105b30b7e13d16b535fec4682768336eabf000de574f
SSDEEP 768:azfWXq7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVtD3c16jropQl2C:azfWXCEf30Wg/XfHfu1ja6D3y6QpQj
TLSH
T125D2DA7B640CCE7F4F800AD9AD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e8f437e3863206d088a9187d80ca7c1bb02e96e6eb2085457cde598417bd8a3d
MD5 78ed9096a4cb2956e7824fe3b3cbb79d
SHA1 4c033cf6512b688ed6b193142cdaedb25e548c0f
SHA512 1bce743e629cf19a177a186044055ef9609fe630505a487fddb6c38595ec36703bf086b261eb1662dd589ca3f0f1cbfd740833d06f421344641a2725063827b0
SSDEEP 96:KREFw0Oy2UWS/fg8UK4Rg2Uc00/uUJHoZs4q26gWeDzgggK41gCgcwgziI7sVSWp:CEFw0Oy2rS/I8oRg2700/uUJHoZs4q2/
TLSH
T175914200323A1691787E75588675982EC6D1B8B37129A52F37AC51960F6AE03CCFCADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1374cdb66b8fcda99eb770e3c853a3d5c9dc6947e59b0beac45c543ad2412650
MD5 595242e109b81447989a748c16cbe179
SHA1 8488b748f9b4d1f015e4e4dcc2cfb69b0629a570
SHA512 a891f9b50934191de8dfdc5a2de986fe06c35161c09eee5354491ebe451d0c8403ea0bcbe8b2944ab25975c29b7e0083306b3e88d31e744d49d7c199166882a7
SSDEEP 384:nWZcIt38Nf+U9cecbhu2WZlf8hyEGB5R/fUMy2rEoajo4cdR8eHhVODjYPNDUMPy:Et3suuHi0lrEnjN3Gac1FPMb9M4
TLSH
T196F2BF757D65DDB38CEAE341B5833B42BEE016A3C5D80E98E6D9EB0D05835AC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a65397a394824facc6015bb3fcadc0125e225de9bec3b72c240aee81774d18ed
MD5 f342b50f1a2d97c6c5747590b3e31e30
SHA1 4f817161b047422bfce60f57a6919881e059f453
SHA512 b4560d9abe5fc0c91c943cea45f562bf663e91ea533a6f665b9ce375ff2b8877ac6bdb2502590e67fed2db588c7db5499dfa3e2dd63f54fec52988e3e910e30b
SSDEEP 384:nGZcIj38Nf+U9cecbBKu24Hfc5yEGB5R/fUjy2rEoajo4cdR8eHhVODjYPNDUMPy:Uj3sbuksErEnjN3Gac1FPMb9M4
TLSH
T1C91317F4A8E78972C8DE9343637E6E42ADBCD163B5884984B7D55E0CCC825BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 a7c972abba08ab1209d9d4e987113751f39fed84c063c510aeac47872659ee67
MD5 2780a28e44715fe3da11e24cdfccbe23
SHA1 057d904d322eb02ad4cb381ab49533ce47d0bc67
SHA512 23fe40e54606f5d07a8c90ccd1f66309d267df95134b694576a55a48b0461ca0fdf0799f17a02752d11efb8283cdffa4a3ee88fcd405c75b070444a0448a78da
SSDEEP 768:Rrv+4UNbdS3vSi0UrEnjN3Gac1FPMeVH1SC8:Rbsbg3gUQnjMajEH12
TLSH
T19C03BF3169A8DEB34CEBE385B04776437EB412A3C5840FA4D9D9AB0D06875DC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4aaf59a29408b1a6f4653d70ec04b861fe9838028e6bfbc3c7390a048f66217
MD5 d31998ac1f6270b6ccbc51981c721f82
SHA1 df63bbae6fd02b10793621937f5c50fd98bd5a2b
SHA512 36ea9d68195c2706f472b9cea5c193b1d28a71b9e19060e4da0dda066c891de780177f73a8b361aeb3f5f47aa06e7ca6d4dc0ba4c7b4e1a57126d8e6b7391efa
SSDEEP 384:nOsrv+89zHqlDNP9oidS38NfkU9cecbtu2WZlf8hyEGB5R/fUsy2rEoajo4cdR8x:5rv+4UNbdS3y0uHi0vrEnjN3Gac1FPMt
TLSH
T19C03BF357968DEB38CFAD245B5437A43BFF4159388C40AA8DAC9AB0C05875ED270BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 eb05ee95e77c6e1485ffe7361508aff40e95f8ed4c85ece5bbc019add5e3b5e6
MD5 71670a6c35b08429953b1b988c0b2f75
SHA1 d51ed48d2f12efedcecdc6f0dc132846c4022688
SHA512 28e06674c0670ab927f4e377e8d5f1df9204568ba5433df494d4f513af53c5d58b5f33622868538a33cf9f8816be5aa28a76795c10bff9b73bfe92906200eddd
SSDEEP 768:rrv+4UNbdS3qmi0drEnjN3Gac1ZBeVH1SCz:rbsbg3hdQnjMa2EH1V
TLSH
T11903CF3669A89AB38CEBD38571477A037FF4125386940BE4CADD6B0D029B5DC230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 107dc532f1939ac76e47648baeb6de9396efef59e8702cd9dc0d7441a2fd99e6
MD5 2d70da61471928f9d23543b18dad389f
SHA1 ffe9983f9cbce9fac3d34198183e56b22bedf98c
SHA512 3c5da67543bfd485afcdaf7fce16a2d7fbdfa22fb8c8c8cdffc7fb7682cc38bf92caab0f679c01d155e8c2e252a23f383fea73603cb13b8088679e19b2d890e2
SSDEEP 384:nHZcIt38Nf3U9cecbhu2WZlf8hyEGB5R/fUMy2rEoajo4cdR8eHhVODjYPNDUMPy:vt31uuHi0lrEnjN3Gac1FPMb9M4
TLSH
T1BCF2BF757D65DDB38CEAE341B5833B43BEE016A3C5D80E98E6D9EB0D05835AC170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2de1a293-2760-400f-b561-a21c4d6d6859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2de1a293-2760-400f-b561-a21c4d6d6859.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59e4e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59e4e8.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

317c72c0-d889-4f2d-945c-51dbb40e897d.tmp

Path C:\Users\Admin\AppData\Local\Temp\317c72c0-d889-4f2d-945c-51dbb40e897d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2012_393639742\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/248-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/480-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1168-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1524-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2000-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2612-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-597-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3180-677-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3320-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3532-557-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3532-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4128-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4444-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5452-568-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5908-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-527-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download