systex | b8c3e8a30b5c88f8a1f1a746e8e9452fbb3bb69c3c815cb063ddd1a65744facf

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260730-see1fabd23
SHA256 b8c3e8a30b5c88f8a1f1a746e8e9452fbb3bb69c3c815cb063ddd1a65744facf
MD5 b9a677fd9d6791e6ceeb9e9ee4c956b0
SHA1 6c59f9f81ccd17afbf493676f8ffc5553d608ed5
SHA512 5e9691c8b7045a652f9a50449d88d65ac515744097903e88ac4ff9e2861288803d34e486764872832261b58e6de1aa72925b1007d3c19b84af02e71655a5d79b
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T12C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5752	CP.exe
6064	cwupjhfwrp.exe
4168	CP.exe
3752	CP.exe
4596	i_cwupjhfwrp.exe
716	trpjhbztrp.sys
6132	CP.exe
4856	pjhbztrmjh.exe
4488	CP.exe
5604	CP.exe
4964	i_pjhbztrmjh.exe
4268	ebwtomjebw.sys
4368	CP.exe
1648	eywroigebw.exe
204	CP.exe
4860	CP.exe
5924	i_eywroigebw.exe
4644	omgeywtolj.sys
3260	CP.exe
4708	gdyvtqoigd.exe
4240	CP.exe
5836	CP.exe
6136	i_gdyvtqoigd.exe
3492	dyvqolgdyv.sys
1716	CP.exe
4828	vqoigaytql.exe
4180	CP.exe
3280	CP.exe
2412	i_vqoigaytql.exe
4796	qnlfdavsqk.sys
5884	CP.exe
940	snkidaysqk.exe
2056	CP.exe
4644	CP.exe
1240	i_snkidaysqk.exe
4592	caysqkicau.sys
5356	CP.exe
3144	faxsqkicau.exe
1824	CP.exe
5008	CP.exe
4576	i_faxsqkicau.exe
4184	zxspnkicax.sys
5052	CP.exe
2084	rpmkhczxus.exe
2396	CP.exe
4380	CP.exe
3400	i_rpmkhczxus.exe
5840	nhfcausmkh.sys
480	CP.exe
3840	keczurpjhc.exe
4768	CP.exe
1952	CP.exe
564	i_keczurpjhc.exe
1840	zxrpjhbztr.sys
584	CP.exe
5948	zxrpjheczu.exe
1524	CP.exe
3692	CP.exe
4516	i_zxrpjheczu.exe
5180	mhecwtjhbz.sys
4712	CP.exe
996	hezwqojgbz.exe
6076	CP.exe
4508	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1883951556\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1666682497\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1666682497\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1883951556\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_2008585940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3092_962696655\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1046551034\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1666682497\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3092_1286764727\_locales\lv\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbytrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupjhfwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkidaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbytrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupjhfwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhfzxvpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhfzxvpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwusmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywroigebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkidaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjheczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmkhczxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwusmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywroigebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbztrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmkhczxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdyvqoigay.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4504	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2524	ipconfig.exe
584	ipconfig.exe
2288	ipconfig.exe
1288	ipconfig.exe
4300	ipconfig.exe
5912	ipconfig.exe
1852	ipconfig.exe
3236	ipconfig.exe
5352	ipconfig.exe
4992	ipconfig.exe
2584	ipconfig.exe
4716	ipconfig.exe
5832	ipconfig.exe
2324	ipconfig.exe
6076	ipconfig.exe
2668	ipconfig.exe
5600	ipconfig.exe
3104	ipconfig.exe
2096	ipconfig.exe
1984	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298974084262399"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{71B274D3-F0D2-4601-8148-E09FFC5DC8E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe
6064	cwupjhfwrp.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4596	i_cwupjhfwrp.exe
Token: SeDebugPrivilege	4964	i_pjhbztrmjh.exe
Token: SeDebugPrivilege	5924	i_eywroigebw.exe
Token: SeDebugPrivilege	6136	i_gdyvtqoigd.exe
Token: SeDebugPrivilege	2412	i_vqoigaytql.exe
Token: SeDebugPrivilege	1240	i_snkidaysqk.exe
Token: SeDebugPrivilege	4576	i_faxsqkicau.exe
Token: SeDebugPrivilege	3400	i_rpmkhczxus.exe
Token: SeDebugPrivilege	564	i_keczurpjhc.exe
Token: SeDebugPrivilege	4516	i_zxrpjheczu.exe
Token: SeDebugPrivilege	4224	i_hezwqojgbz.exe
Token: SeDebugPrivilege	2864	i_olgeywqoiy.exe
Token: SeDebugPrivilege	5892	i_jdyvqoigay.exe
Token: SeDebugPrivilege	3820	i_qnlfdxvtnl.exe
Token: SeDebugPrivilege	4960	i_nkicausnkf.exe
Token: SeDebugPrivilege	5024	i_spkhfzxvpm.exe
Token: SeDebugPrivilege	4832	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	716	i_kecwusmkez.exe
Token: SeDebugPrivilege	6028	i_hbytrojhbz.exe
Token: SeDebugPrivilege	1768	i_mjebwuomge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3092	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 5724	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 1188 wrote to memory of 4688	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5724 wrote to memory of 3572	5724	iexplore.exe	91
PID 4688 wrote to memory of 3092	4688	iexplore.exe	92
PID 3092 wrote to memory of 2820	3092	msedge.exe	93
PID 3092 wrote to memory of 4504	3092	msedge.exe	94
PID 3092 wrote to memory of 5432	3092	msedge.exe	95
PID 3092 wrote to memory of 5432	3092	msedge.exe	95
PID 3092 wrote to memory of 5432	3092	msedge.exe	95
PID 3092 wrote to memory of 5476	3092	msedge.exe	96
PID 3092 wrote to memory of 5476	3092	msedge.exe	96
PID 3092 wrote to memory of 2360	3092	msedge.exe	98
PID 3092 wrote to memory of 6092	3092	msedge.exe	99
PID 3092 wrote to memory of 2360	3092	msedge.exe	98
PID 3092 wrote to memory of 2360	3092	msedge.exe	98
PID 3092 wrote to memory of 6092	3092	msedge.exe	99
PID 3092 wrote to memory of 6092	3092	msedge.exe	99
PID 3092 wrote to memory of 4596	3092	msedge.exe	124
PID 3092 wrote to memory of 4596	3092	msedge.exe	124
PID 3092 wrote to memory of 4596	3092	msedge.exe	124
PID 3092 wrote to memory of 5928	3092	msedge.exe	101
PID 3092 wrote to memory of 5928	3092	msedge.exe	101
PID 3092 wrote to memory of 5928	3092	msedge.exe	101
PID 3092 wrote to memory of 268	3092	msedge.exe	102
PID 3092 wrote to memory of 268	3092	msedge.exe	102
PID 3092 wrote to memory of 268	3092	msedge.exe	102
PID 3092 wrote to memory of 2972	3092	msedge.exe	103
PID 3092 wrote to memory of 2972	3092	msedge.exe	103
PID 3092 wrote to memory of 2972	3092	msedge.exe	103
PID 3092 wrote to memory of 4168	3092	msedge.exe	116
PID 3092 wrote to memory of 4168	3092	msedge.exe	116
PID 3092 wrote to memory of 2372	3092	msedge.exe	106
PID 3092 wrote to memory of 2372	3092	msedge.exe	106
PID 3092 wrote to memory of 2372	3092	msedge.exe	106
PID 3092 wrote to memory of 3840	3092	msedge.exe	108
PID 3092 wrote to memory of 4704	3092	msedge.exe	109
PID 3092 wrote to memory of 4704	3092	msedge.exe	109
PID 3092 wrote to memory of 2324	3092	msedge.exe	111
PID 3092 wrote to memory of 3152	3092	msedge.exe	110
PID 3092 wrote to memory of 2152	3092	msedge.exe	112
PID 3092 wrote to memory of 2324	3092	msedge.exe	111
PID 3092 wrote to memory of 3152	3092	msedge.exe	110
PID 3092 wrote to memory of 2152	3092	msedge.exe	112
PID 1188 wrote to memory of 5752	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 6064 wrote to memory of 4168	6064	cwupjhfwrp.exe	116
PID 3092 wrote to memory of 6132	3092	msedge.exe	128
PID 3092 wrote to memory of 6132	3092	msedge.exe	128
PID 3092 wrote to memory of 5360	3092	msedge.exe	122
PID 3092 wrote to memory of 5360	3092	msedge.exe	122
PID 1188 wrote to memory of 3752	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 3092 wrote to memory of 3236	3092	msedge.exe	125
PID 3092 wrote to memory of 3236	3092	msedge.exe	125
PID 3092 wrote to memory of 3236	3092	msedge.exe	125
PID 1188 wrote to memory of 6132	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4856 wrote to memory of 4488	4856	pjhbztrmjh.exe	130
PID 1188 wrote to memory of 5604	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 1188 wrote to memory of 4368	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 1648 wrote to memory of 204	1648	eywroigebw.exe	139
PID 1188 wrote to memory of 4860	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 1188 wrote to memory of 3260	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4708 wrote to memory of 4240	4708	gdyvtqoigd.exe	148
PID 1188 wrote to memory of 5836	1188	2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 3092 wrote to memory of 5932	3092	msedge.exe	154
PID 3092 wrote to memory of 6020	3092	msedge.exe	155

C:\Users\Admin\AppData\Local\Temp\2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_b9a677fd9d6791e6ceeb9e9ee4c956b0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:3572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffec1d2c188,0x7ffec1d2c194,0x7ffec1d2c1a0
      4⤵
      PID:2820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,6357770381516383816,14294834602775061352,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
      4⤵
      System Time Discovery
      PID:4504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,8427719856616543204,12545076169752082075,262144 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2196,i,321289123827356330,5816601803519231290,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
      4⤵
      PID:5476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,13274089276587197777,2766175313422978670,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:1
      4⤵
      PID:2360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,16933813506970982839,17510812037323836907,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4076,i,6805161534740289127,1920311289228321076,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,14566622739329900482,8648627780265047106,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:9
      4⤵
      PID:5928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4124,i,10102929542119787578,7430885444771133457,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
      4⤵
      PID:268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5544,i,4495092029205959404,11909260406660981514,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,7950769629991239391,11882487049388627289,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4152,i,17877666352962437969,13268621003628221195,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8600958064795185637,11959195262543340302,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8600958064795185637,11959195262543340302,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,12758383342545917464,18177564627178618020,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,405241335169532863,16784276397915849664,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,4278708512315103827,951958682319658439,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,10904196950807008329,12354411894091588505,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:2152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,13382664920298810151,3027921753533758358,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,9500529594714969618,13074599252177532942,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7072,i,7389863834225638169,10407437269082660756,2097152 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1304,i,304003270670452593,15579753393718086569,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1308,i,3967033183867944069,16970522283583209597,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=1428 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1312,i,12361445609381911193,5516461764918395454,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,567049295644940798,13343928540557230142,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:14
      4⤵
      PID:5208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,15675093856207903198,16395247311598458336,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,1941866194114489125,3263072417148042551,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:14
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6248,i,14209385555381204262,3176364537755158679,262144 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:10
      4⤵
      PID:1112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,10385734702295640786,8630375153417768287,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=928 /prefetch:14
      4⤵
      PID:2864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,7797989437567346191,7011441622661125126,524288 --field-trial-handle=2524,i,18112779548759108419,11503122541030513854,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupjhfwrp.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5752
- - C:\Temp\cwupjhfwrp.exe
    C:\Temp\cwupjhfwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupjhfwrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\i_cwupjhfwrp.exe
    C:\Temp\i_cwupjhfwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbztrmjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\pjhbztrmjh.exe
    C:\Temp\pjhbztrmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbztrmjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5604
- - C:\Temp\i_pjhbztrmjh.exe
    C:\Temp\i_pjhbztrmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywroigebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4368
- - C:\Temp\eywroigebw.exe
    C:\Temp\eywroigebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywroigebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Temp\i_eywroigebw.exe
    C:\Temp\i_eywroigebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvtqoigd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3260
- - C:\Temp\gdyvtqoigd.exe
    C:\Temp\gdyvtqoigd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvtqoigd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5836
- - C:\Temp\i_gdyvtqoigd.exe
    C:\Temp\i_gdyvtqoigd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\vqoigaytql.exe
    C:\Temp\vqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\i_vqoigaytql.exe
    C:\Temp\i_vqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkidaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5884
- - C:\Temp\snkidaysqk.exe
    C:\Temp\snkidaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkidaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4644
- - C:\Temp\i_snkidaysqk.exe
    C:\Temp\i_snkidaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5356
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5008
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmkhczxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5052
- - C:\Temp\rpmkhczxus.exe
    C:\Temp\rpmkhczxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmkhczxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\i_rpmkhczxus.exe
    C:\Temp\i_rpmkhczxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczurpjhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:480
- - C:\Temp\keczurpjhc.exe
    C:\Temp\keczurpjhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3840
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczurpjhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1952
- - C:\Temp\i_keczurpjhc.exe
    C:\Temp\i_keczurpjhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjheczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:584
- - C:\Temp\zxrpjheczu.exe
    C:\Temp\zxrpjheczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjheczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3692
- - C:\Temp\i_zxrpjheczu.exe
    C:\Temp\i_zxrpjheczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwqojgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\hezwqojgbz.exe
    C:\Temp\hezwqojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwqojgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4508
- - C:\Temp\i_hezwqojgbz.exe
    C:\Temp\i_hezwqojgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoiy.exe ups_run
  2⤵
  PID:1140
- - C:\Temp\olgeywqoiy.exe
    C:\Temp\olgeywqoiy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoiy.exe ups_ins
  2⤵
  PID:2288
- - C:\Temp\i_olgeywqoiy.exe
    C:\Temp\i_olgeywqoiy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdyvqoigay.exe ups_run
  2⤵
  PID:2652
- - C:\Temp\jdyvqoigay.exe
    C:\Temp\jdyvqoigay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdyvqoigay.exe ups_ins
  2⤵
  PID:1696
- - C:\Temp\i_jdyvqoigay.exe
    C:\Temp\i_jdyvqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvtnl.exe ups_run
  2⤵
  PID:3424
- - C:\Temp\qnlfdxvtnl.exe
    C:\Temp\qnlfdxvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvtnl.exe ups_ins
  2⤵
  PID:992
- - C:\Temp\i_qnlfdxvtnl.exe
    C:\Temp\i_qnlfdxvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicausnkf.exe ups_run
  2⤵
  PID:1256
- - C:\Temp\nkicausnkf.exe
    C:\Temp\nkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicausnkf.exe ups_ins
  2⤵
  PID:3024
- - C:\Temp\i_nkicausnkf.exe
    C:\Temp\i_nkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkhfzxvpm.exe ups_run
  2⤵
  PID:2524
- - C:\Temp\spkhfzxvpm.exe
    C:\Temp\spkhfzxvpm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkhfzxvpm.exe ups_ins
  2⤵
  PID:3104
- - C:\Temp\i_spkhfzxvpm.exe
    C:\Temp\i_spkhfzxvpm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkhcau.exe ups_run
  2⤵
  PID:1288
- - C:\Temp\fzxrpkhcau.exe
    C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
  2⤵
  PID:4252
- - C:\Temp\i_fzxrpkhcau.exe
    C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwusmkez.exe ups_run
  2⤵
  PID:3572
- - C:\Temp\kecwusmkez.exe
    C:\Temp\kecwusmkez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwusmkez.exe ups_ins
  2⤵
  PID:3448
- - C:\Temp\i_kecwusmkez.exe
    C:\Temp\i_kecwusmkez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbytrojhbz.exe ups_run
  2⤵
  PID:4384
- - C:\Temp\hbytrojhbz.exe
    C:\Temp\hbytrojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbytrojhbz.exe ups_ins
  2⤵
  PID:4796
- - C:\Temp\i_hbytrojhbz.exe
    C:\Temp\i_hbytrojhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwuomge.exe ups_run
  2⤵
  PID:832
- - C:\Temp\mjebwuomge.exe
    C:\Temp\mjebwuomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwuomge.exe ups_ins
  2⤵
  PID:5548
- - C:\Temp\i_mjebwuomge.exe
    C:\Temp\i_mjebwuomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2464

C:\Temp\trpjhbztrp.sys
C:\Temp\trpjhbztrp.sys
1⤵
- Executes dropped EXE
PID:716

C:\Temp\ebwtomjebw.sys
C:\Temp\ebwtomjebw.sys
1⤵
- Executes dropped EXE
PID:4268

C:\Temp\omgeywtolj.sys
C:\Temp\omgeywtolj.sys
1⤵
- Executes dropped EXE
PID:4644

C:\Temp\dyvqolgdyv.sys
C:\Temp\dyvqolgdyv.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\qnlfdavsqk.sys
C:\Temp\qnlfdavsqk.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\caysqkicau.sys
C:\Temp\caysqkicau.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\zxspnkicax.sys
C:\Temp\zxspnkicax.sys
1⤵
- Executes dropped EXE
PID:4184

C:\Temp\nhfcausmkh.sys
C:\Temp\nhfcausmkh.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:1840

C:\Temp\mhecwtjhbz.sys
C:\Temp\mhecwtjhbz.sys
1⤵
- Executes dropped EXE
PID:5180

C:\Temp\romgeztrlj.sys
C:\Temp\romgeztrlj.sys
1⤵
PID:4796

C:\Temp\gdbvtqoigd.sys
C:\Temp\gdbvtqoigd.sys
1⤵
PID:1396

C:\Temp\vtnlfdxvtq.sys
C:\Temp\vtnlfdxvtq.sys
1⤵
PID:4804

C:\Temp\qnifaxvqni.sys
C:\Temp\qnifaxvqni.sys
1⤵
PID:4492

C:\Temp\ausnkicaus.sys
C:\Temp\ausnkicaus.sys
1⤵
PID:2672

C:\Temp\fcausmkhca.sys
C:\Temp\fcausmkhca.sys
1⤵
PID:3212

C:\Temp\jhcwupmkec.sys
C:\Temp\jhcwupmkec.sys
1⤵
PID:5588

C:\Temp\pmhezwurmj.sys
C:\Temp\pmhezwurmj.sys
1⤵
PID:124

C:\Temp\mjhbzwrojh.sys
C:\Temp\mjhbzwrojh.sys
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupjhfwrp.exe

Path C:\Temp\cwupjhfwrp.exe
Size 230KB
SHA256 8d09ff2c0eb389adc491c0b655cf27fb28ef2443f7a04d1a56b3cd620733e7cb
MD5 9d0b928254b2b5f961a6bc463217ca7f
SHA1 81a3a1e8d3593d059e7d17cf2a1541e9b72aa69e
SHA512 0026b60eede0b0666ea22132790172ad541f2b5e09de8c4c34af0db919c1bb7b93615653e0ca3a6624cd0dbd28089a20dbf5f832c5bc0f3b6dc7b0dff2b5a0c9
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T190344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqolgdyv.sys

Path C:\Temp\dyvqolgdyv.sys
Size 141KB
SHA256 2ab8d6ea344b04baed5350ee6fa791d95d1df17ab2d2009e67baf586384f8fd5
MD5 e660eeba023efdae3658ffcdaa5298d4
SHA1 863a1208a666cb3a5b57376fa1ae4883ae8c986e
SHA512 5113b4c66ce4fe44d8c0abdcedc3cf734b920ae7a25ff5a1b12f1baf1fb432f10564ea0781d356fa06ba07205f73ff9f7ca0fbbec686c7edab21f93af124dc54
SSDEEP 3072:esQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:esQmpcF8BzXfwV
TLSH
T118E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomjebw.sys

Path C:\Temp\ebwtomjebw.sys
Size 141KB
SHA256 80a8835681ede734cc862f3721703927cb86ef09994190c6e935148c13da102a
MD5 e35f4397fd69dc079939ba8237901e6c
SHA1 76efdfc205068417275e010f7e8bc4d6e9119502
SHA512 474ceebd3cf0b60eee2a72ccdfbb9bf9c46215ca8cecb9ed0901864d13b213e6884873806f7b1f087794a0ee0387bb15c2521b52ef4403706d3c14da76d582e4
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T1DDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywroigebw.exe

Path C:\Temp\eywroigebw.exe
Size 230KB
SHA256 f193639b93be7dbc4f4188cc1881519d741f2539ec2b0815932780d61b953c30
MD5 d5451bb083efe79b6b2d4e78750dfe19
SHA1 82030ca1c8cf4e6c4367fffc27246e869f353eec
SHA512 ecb25b2d212bf82abb40cb0c5064e3560cba977b0f5ba59852a0993ec9089a868ba20b3d8e4ae38876d31bf53b8591fbadfe0040e75e84d351338e90af526d98
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvtqoigd.exe

Path C:\Temp\gdyvtqoigd.exe
Size 230KB
SHA256 c4d97c031ccf3c4ccb744696dcb328bdd8bf1009c1377429afc7398e4912bab5
MD5 62b6a5c69dbb8d1817030eabade36066
SHA1 9477d6e400962efbe4f6b310777fd217d6a2405b
SHA512 eb12b872da9703e9e86abcfa8822f677edf648758026efac27398d0537ff7dccbc9f55ec9f05d370872b5c64dbb162ff48e718642e80f5d8b39c2b44b0ff2d9f
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T107344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwupjhfwrp.exe

Path C:\Temp\i_cwupjhfwrp.exe
Size 230KB
SHA256 94ea1de6cc385efe2d5d91d0222de19d047ff09ecbf8be2d1337cd7679ad73c2
MD5 29b4fa67b317b8a76aa5bd40af62c8fe
SHA1 151d2d9cdedd69221093c036b50a47aece18718f
SHA512 49d42d7cbe7e2b03165bdca738da8692344db827ae9994bb0b6aba312153eb6b7b6481bbb1db6cfc06a6bdbcfeb80f0437fce2d984930e745dbb1eb9310ed021
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywroigebw.exe

Path C:\Temp\i_eywroigebw.exe
Size 230KB
SHA256 1816e26290861456daa70b84c0ab7de29dc1c18f409bfa446522dc5d21604572
MD5 33f86fcd5e29c41af3b3312e187c0961
SHA1 83e2c4655f5e96975752de236c50581836431909
SHA512 671275b2734961e418f917d818c89b7c7ff029d2ce1cc100791782a975d75911cd4f6f932e3784742a12ee60571cf678b103c0b355864772501f388dc24651b2
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T11C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdyvtqoigd.exe

Path C:\Temp\i_gdyvtqoigd.exe
Size 230KB
SHA256 2a8fed29a0246d100e4bc0fda2b6c18d6d2f13faf327964344ab3e5f891d8480
MD5 824fbfd8060de38aef961d4fb82310ad
SHA1 9dd9fc1e50ef0e554c3f1537e48c841d975986a0
SHA512 d2fc4f66ac2c5dc1b3583b25c6a7abab824b627ebbf275abdf01dfd36fc066c5e8921cfa84a2806555328ca6eed8fadb9b2b3b05e767d6a2ad3d2e94b1746c14
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhbztrmjh.exe

Path C:\Temp\i_pjhbztrmjh.exe
Size 230KB
SHA256 928b7602708455b4bcdb9e02ede919d07a4f27b1023116311fe423f24af5feed
MD5 3a539aebb3f4fe21cbbaabf64e01d8d9
SHA1 d5afdb3b51cb2879fadbe97afc96fac1ff3e96a5
SHA512 6af25fb434508551f02d4f9aa09872fe42362e3277efd8de16401b29a06bb6332eee537f624c8bbc0fc2428ee99aa0891fdc1cd49ee7777cdb3136b01299242b
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigaytql.exe

Path C:\Temp\i_vqoigaytql.exe
Size 230KB
SHA256 d2a6013c466d8024b6870a4c13c1817df6c982a7893cc7692dc8520427cf948e
MD5 363e9fe0027e6ce204a935b248f1b9e6
SHA1 83358394455d2607927174c408e8c3e814a9ef56
SHA512 3b78a1c3229c4295be05c76e37d5cb0ebf4ad259379168c57b9caa84bd20a69c1f795d498555a32a3378e0c515bd59b6e200c2e4a6c48f9525bdc7c367d205c1
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T182344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywtolj.sys

Path C:\Temp\omgeywtolj.sys
Size 141KB
SHA256 57ec7da62c4938dc66dc416509c17268db7eb7fe8052da773293e9a8da5c1243
MD5 c0097c5b783b78a752b4707589288979
SHA1 c68fcc1c7014699034ab8f7bed4c111699ebb484
SHA512 5bc7b19ef27f319a40896e1f427692189ba9337db2cb869446fbd8bcf6f96362e3974ff08852bbddf6a088e7a733eb6d23444aefc2de58c402c59d0984bd902e
SSDEEP 3072:osQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:osQmpcF8BzXfwV
TLSH
T156E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrmjh.exe

Path C:\Temp\pjhbztrmjh.exe
Size 230KB
SHA256 fea6e22b5d289b98d09aa394b19eceac8d824ecc92214c1cb2cac2f3db78888d
MD5 3051e450e26d31d2280c0f1c3dcb41d8
SHA1 da71e9c3095a86a032b91ddbeca80bd1cb3f1392
SHA512 5c42373cbdcf818f0568f064d41d2ff65f74ab9e66e9956e4986e630029f5544a1b7bf53fe2ef19eb8ad7ffd14f311eb6730767782ef499573c90db6ff87ee2d
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T179344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdavsqk.sys

Path C:\Temp\qnlfdavsqk.sys
Size 141KB
SHA256 5ff4565e8006e467fc69f832e0058cd97e6a339dd3f20516e680f6df571550a5
MD5 eaacacd22ee2a1c5dcf3c5a45b953183
SHA1 4ec3b94435bef0772130babf08d54496084c6aee
SHA512 ce2f3b922f93e6cebf2187c60431985d7ad584e1a3df28a8e1703d7366ac3e1076c8aa37f52230bae6b96578979bbaed5295485e1676415a574a0f795defe762
SSDEEP 3072:isQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:isQmpcF8BzXfwV
TLSH
T14FE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkidaysqk.exe

Path C:\Temp\snkidaysqk.exe
Size 230KB
SHA256 c7c155a150d7b7bdde6012dd7720490b55eb577e8c0d31495983701e481e7ebe
MD5 238c9e929305dd094eb442187020de0a
SHA1 383dfd29fb2279a41b35e6ed5fda87ed05d3d437
SHA512 f7665df9e6cc22945d9080a213ed9e53e0999453ccabc6f5e808d21f2c9c284e358cd2b16d58c7e85d7d83735ed221c072a50b3e60fe8dd7f370109001f46905
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T182344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhbztrp.sys

Path C:\Temp\trpjhbztrp.sys
Size 141KB
SHA256 0e2c5718cd5979b6a1765beac188dc4eb0fef3ffbb7c0f304dc9d4477a2fefb3
MD5 56b99ce652ec52eaa5882170d2cef8cf
SHA1 e3d512398c2d4a96277c4648644de0ec00c3db98
SHA512 636bfbc5e589f947698fc2acc9ac2b15283bb40ec4e5e03ceba71c886c815e8213b41f99d2d7dfd22a7f288c5b9ae103c4845fbc44ece9bccb07b2ff3b45c49b
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T117E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytql.exe

Path C:\Temp\vqoigaytql.exe
Size 230KB
SHA256 3eeaae6b30cbacf7603bc03032ce42d47c07b6a2f46ce7f5eb7d1fb6481929c0
MD5 ddfb71c9967cb46d529c27cb165cfac1
SHA1 11c134dcc0e17dbdd2d36cefee3a93d8b415c625
SHA512 3694f3470141a79c4720a2fd34d54ed90521ad8166e93546aa22371a51b190b2ddee41495683cd6bbbc7ed3d16f7ca125c8f6abb7745023d87dc61cab54f88f9
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T11E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5da86af5-aef8-4d86-8014-15a0894e0e48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5da86af5-aef8-4d86-8014-15a0894e0e48.tmp
Size 40KB
SHA256 9b4c8c5604e7b556a05bd561e17ae8f97b9f261178f9a90e536c253842830046
MD5 58b26d9a1800442447398cfa87f7484e
SHA1 d9d32f3c6ce04e9ef687c3339c3b2f0d488407d5
SHA512 5c52faf5bd60dd4a75143926621e3c61b1db5f69de6a10ea11807fb0d8698d0e9678b9351af4117f893dcccd8cface6578e92bfeab88662dd7f2a28a382dad01
SSDEEP 768:yrv+4UNbdC3UVABqobGOeTt+tZu4aWADIidy8LuaeVH1S1l:ybsbw3PtZzaNsuVLhEH1e
TLSH
T1A503BF76A859CE739CFAA284B18776477EF86163C5880AD4C8DD1F8E058789E130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

4290abf9-163c-4c0f-b7bb-e693317eeab3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4290abf9-163c-4c0f-b7bb-e693317eeab3.tmp
Size 11KB
SHA256 d5b83a27af72615ca4984e072fe229b61da0c96a2a1a7f1a4f074a0e4a8496b9
MD5 1d2bb32c35fe9aa36aff898fa9113687
SHA1 03c64f36dbb2cf27bea62d814feb1b7c97912b0c
SHA512 fb849f05217593ed1ef8e54df408bdf46ca0c2f8d15b6b410183de85ec138337c0d027af31b5604fbc2955a16253d0ac1c70a52a484a9ede1a455b5051e1fc23
SSDEEP 192:sxR2Rt2Ca/fisIKvsZnzoA8p9B/g6+WNCgZfYb1Z6sG6IgV+qkJ:sxR2Hxa/fisZvSOb/5Tfo6Cy
TLSH
T1A542C81A6A28693B5CC7E21DBB55BF53D2F95032A1D46E48E7FC9A0C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 00d3c03a33ced1c33b55c4f0308dac12ae86365ea8cae485f42e3f3e4e11edf3
MD5 b73f913702e18926ef2aeaf890c61fde
SHA1 b62faa40bbe7a0feb148a3dddbb56d64947c97b2
SHA512 b0ae3e538cc611a4851b239f507c8bb6e10f3b0c3817101232161f733dfad57684f63791c81db2a53cc582378ceaa9ec5dff47c5917fb1bf46f4bd587d5c32fe
TLSH
T1CC615199076D6BE6F322717B6EE7D47971FE888601072E10D2046D785C16FF4A0F1563
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f0c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596f0c.TMP
Size 3KB
SHA256 c934c512c2d634a42de9ae9423b7e9b2e06411e8d69e24450db05ffc8859af7b
MD5 913d4aee1eae892dbdcc090c3300fd9a
SHA1 e17f9f84cd730fd15d9aa8fac7fe54b0c341c123
SHA512 d5c96b3dabe6f6043ac17a58eadb38b6daca5899f45f229e893061a4bdf55f8b80691db35a8445da99893dee6f2fe65abde316808dcee5a4187c1f606fc0cca8
TLSH
T1D0615099076D6BEAF322717B6EE7D4B971FE888601072E10D2046D785C16FF8A0F1563
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f03cecdc042a8aa32366c71aa91c00d06f0839395528c066ec068e0e0f216363
MD5 c3eb7133c5e1f2aaf1422559d88df164
SHA1 c4893d77cd5cdeb81fca83f60b6bc2ab73a68c7c
SHA512 5dc59e7d4cd00eaad02ccfde5219df378a06212d7a419dcefda2adb163bf7b5cc8a39d5e418141159956afb2e36e9e3c8085533855cdef07c7ce9a9cae57ac9c
TLSH
T131518EF7C2E8856EC90196F0AB186E2BCE2D0914832C3D5AC9E4EF6B97E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 13e5593ca0114332220b6967a8c68822fa1a91ca40afe849aaf03efa924d7cc4
MD5 bf938c919b6088c32834ac1b06bb4547
SHA1 0aee287211d154f9a4a00955fd6b2dd49e219807
SHA512 3db7a6be0f35aef5fa57c8aca39731ab885c9eb1375097a97837137aae7b130da7315a8a5f01f8433d6e114f120f58621a0d6c4f09b1fdf95d54b08c638a9c85
SSDEEP 192:sxRNRt2Ca/fis3KBsZnzoA8p9B/g6+WNCgZfYb+Z6sG6IgDo+qkJ:sxRNHxa/fis6BSOb/5Tf96CP
TLSH
T19042C81AAA28593B5CCBE219BB55BF53D2F95032A1945E48E7FC9B0C01E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ddc8c2d68c8ea12b2c47cbd8a9e80302593776b792bd7c3e2f2274482c933e67
MD5 756e53836effa29f2677c01d1d484942
SHA1 2ec6a13ac0bdfaa12376d58a951c99bacfcf6ff1
SHA512 e35610cf945b31ee8aece1a44fb56287b853df33a25840a3c242b438bf2c65393fed61a91aa14f24ceaa906e54a6b783a5f04db1d548b86890a6dc3bb1489dd4
SSDEEP 192:sxRNRt2Ca/fis3KvsZnzoA8p9B/g6+WNCgZfYb1Z6sG6IgDS+qkJ:sxRNHxa/fis6vSOb/5Tfo6Cl
TLSH
T14D42C81AAA28593B5CCBE21DBB55BF53D2F95032A1D42E48E6FC9A0C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 027f28a1579d4f0d75d4a2b7edb45de924a6a7a8bf2b7387e8c4ee98c0b56529
MD5 9b855c758e7b34fc24d531bbfa817ba8
SHA1 6bc3b241262f9ebcb278ab5d39ec4be254c8622a
SHA512 dd4d3b5f22fb5fa2907a1821457bbe94453a5d2813889ea46fba551e050ecfe565a768db1472eb2f7980b409ff86a5eaa54933f4e71e029dbf4418549c59c9d1
SSDEEP 768:Fb1p467pLuLf2tWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OV8JpJ8IbroSjH:Fb1p4SEf2tWgikfq4u1jaPJpyIo8
TLSH
T118D2DA3B640DCA7F4F804ADDEC197E9A6DA802CB96D8CD8047FA951C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a089c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a089c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3c705490029ec060086706b2937eabe5edee7a152591ec4a938f6ee9060db89d
MD5 77977659955a2ece420182ba8c031daf
SHA1 b3ecbeb677ee791ccacbc9a76ef57928e9a49063
SHA512 9a72d7c6360bb6ac0ad3c89bc7dbc19206609c64e6117dd42517f1447431976427f1be192e2cb80837db3bf90904523d708ea888b674eac371f2a3fbb17e53e1
SSDEEP 768:VFQy33wgVSJwPYB41bCOeTtptZu4aWADIidy8Luab9M6:0y3ctZzaNsuVLhb+6
TLSH
T1101338F6A8C78973D8AE5347B3BE2E469DBCD163B5944584B7D85A0DCC824BFC306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9957febe394129b3812a868e7a2e2cc24985bce598b7c6ad0b8867a7f3eefa69
MD5 e0aa6e6b262b42a0ee107645510e1ea9
SHA1 3bd49329e5f78f4048301ac2ae76f06f0dd662dc
SHA512 d967982c4fcaeb5599b78fe1119c89efdc71fd575f50baae2802e6bf9be4e104662a13f09602359bec2efff6b4ff721b8cb9a35b127be8f496ef92a2cea0708e
SSDEEP 768:F13tSJpPYBqobGOeTtrtZu4aWADIidy8Luab9M6:F136tZzaNsuVLhb+6
TLSH
T10DF2BF7AFC169D739CBAA244B2C23B4BADF4A1B3C5D849C894DD5B0E04C39AD1317C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f2c05ad947ceed49efc6af22d64da0de54a407e9356aaf1d977f43ff951599cb
MD5 cb949026aea6530777677ad051b85eb9
SHA1 2d7de1086f6be3ebc0f251077795733f0b7971c9
SHA512 2ac82098a65b73ac41f86dd4638fffbb45380c453452db5388c698a2b58198eb218d94f2de8af35b2130531b44ee08571e5beea2a9e3d4a36f32293981cb32b0
SSDEEP 768:Erv+4UNbdC3qSJpPYBqobGOeTtftZu4aWADIidy8LuaeVH1S1C:Ebsbw35tZzaNsuVLhEH1h
TLSH
T10C13BF36BC599E739CFAA244B1837A47BEF85163C5880AD4C8DD1B4E05C79AE130BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0011ab8fe6d51053ac38bba501b52d48b45ef9cebc7bda324994e6aab28669cb
MD5 15926be8d746488c4fd70408b4134b31
SHA1 cc3931267c42f1dd354b5d1681e0556e5d63ebe5
SHA512 39e3e83af9c12beeb5f77c79a9df955489061f9bba9407c2334229ca70bd2197cbec87456e94002ae919b42ee5e3eb09597843ca3846832d85c3196e528f58fb
SSDEEP 768:9rv+4UNbdC3T/TBqobGOPpZu4aWADIidy8LqUeVH1S1C:9bsbw3tpZzaNsuVLbEH1d
TLSH
T14E03BF36E859CA739CF79284B1877A077EF89263C6880AD088DD1F4E46DB4AD1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

b2970cab-603a-4a39-9352-052c303d73ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\b2970cab-603a-4a39-9352-052c303d73ae.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3092_1906875400\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-705-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/716-412-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1396-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1840-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2672-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2672-668-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3212-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3416-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-535-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4184-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4268-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4492-648-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-539-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4644-487-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-621-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-601-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-587-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5588-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download