systex | cce18c65a6714cedbe000c499a5146ace3437b81e0523d021a88f98bd1cf9d81

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260808-tq7p9shr5x
SHA256 cce18c65a6714cedbe000c499a5146ace3437b81e0523d021a88f98bd1cf9d81
MD5 3ea0454a2851d9afb8efbcb556f3a0f0
SHA1 5f6b3b83b322afa919a436f1e6ac5b97def56a87
SHA512 23c65036f93bd88655d74650400906499994b2d3bf70219dba9d577bb4eaa1ca93a964ece540632552f6b4cf6239b345f8723e051cf54e280678dab6b7cef798
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T103344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5080	CP.exe
2772	vpnhfzupfc.exe
2816	CP.exe
4304	CP.exe
2748	i_vpnhfzupfc.exe
2132	zxrpjhbzus.sys
5552	CP.exe
4880	smkhczusmk.exe
1504	CP.exe
3880	CP.exe
548	i_smkhczusmk.exe
4980	jhbztrmjeb.sys
204	CP.exe
6136	ebzuomjebw.exe
4460	CP.exe
4064	CP.exe
4772	i_ebzuomjebw.exe
2664	jhbztrljeb.sys
4840	CP.exe
2252	ywqomjdbzw.exe
3432	CP.exe
2832	CP.exe
2132	i_ywqomjdbzw.exe
4904	jgebwtomge.sys
2776	CP.exe
1836	gbytrljdbw.exe
5472	CP.exe
3372	CP.exe
4732	i_gbytrljdbw.exe
6140	yvtqljdbvt.sys
1508	CP.exe
256	bysqlidbvt.exe
2520	CP.exe
2992	CP.exe
2668	i_bysqlidbvt.exe
2988	ysqkidaysq.sys
5292	CP.exe
1200	qnifdxvqni.exe
4852	CP.exe
2164	CP.exe
3312	i_qnifdxvqni.exe
2696	fdxvsnlfdx.sys
2928	CP.exe
4092	xvpnhfausq.exe
2948	CP.exe
2152	CP.exe
5416	i_xvpnhfausq.exe
5900	fzxspnkica.sys
4328	CP.exe
2524	axpnhczxsm.exe
2996	CP.exe
4316	CP.exe
1272	i_axpnhczxsm.exe
5004	xusmkecxup.sys
5812	CP.exe
2692	rpmhfzxrpj.exe
3504	CP.exe
2168	CP.exe
2120	i_rpmhfzxrpj.exe
1468	euomhezxrp.sys
4836	CP.exe
200	urmkeczurm.exe
6140	CP.exe
3540	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_612653930\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_1589968823\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_612653930\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_1577817493\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_1589968823\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_1589968823\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3796_802771943\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_1589968823\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3796_449560890\_locales\en\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwugbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrpjztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfausq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrpjztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwugbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdaysqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzuomjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkeczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomjdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axpnhczxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bysqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzupfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzupfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomjdbzw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfcausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axpnhczxsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdaysqoifd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4312	ipconfig.exe
4252	ipconfig.exe
2012	ipconfig.exe
2408	ipconfig.exe
3356	ipconfig.exe
588	ipconfig.exe
4992	ipconfig.exe
4704	ipconfig.exe
1724	ipconfig.exe
3100	ipconfig.exe
5376	ipconfig.exe
4236	ipconfig.exe
2144	ipconfig.exe
3676	ipconfig.exe
1400	ipconfig.exe
5928	ipconfig.exe
4372	ipconfig.exe
5460	ipconfig.exe
4732	ipconfig.exe
1472	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306794169018060"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{59C6AC60-2753-4860-8F77-B2935AE6DC8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe
2772	vpnhfzupfc.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe
3796	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2748	i_vpnhfzupfc.exe
Token: SeDebugPrivilege	548	i_smkhczusmk.exe
Token: SeDebugPrivilege	4772	i_ebzuomjebw.exe
Token: SeDebugPrivilege	2132	i_ywqomjdbzw.exe
Token: SeDebugPrivilege	4732	i_gbytrljdbw.exe
Token: SeDebugPrivilege	2668	i_bysqlidbvt.exe
Token: SeDebugPrivilege	3312	i_qnifdxvqni.exe
Token: SeDebugPrivilege	5416	i_xvpnhfausq.exe
Token: SeDebugPrivilege	1272	i_axpnhczxsm.exe
Token: SeDebugPrivilege	2120	i_rpmhfzxrpj.exe
Token: SeDebugPrivilege	4200	i_urmkeczurm.exe
Token: SeDebugPrivilege	5536	i_cwugbztrlj.exe
Token: SeDebugPrivilege	2844	i_wtrljebztr.exe
Token: SeDebugPrivilege	4964	i_eywqoigayt.exe
Token: SeDebugPrivilege	5628	i_fdaysqoifd.exe
Token: SeDebugPrivilege	2748	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	3676	i_usnkfcausn.exe
Token: SeDebugPrivilege	1216	i_xupnhfzxsp.exe
Token: SeDebugPrivilege	1248	i_urmkecwuom.exe
Token: SeDebugPrivilege	5532	i_ztrpjztrpj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1652	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4952 wrote to memory of 5548	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5548 wrote to memory of 3796	5548	iexplore.exe	91
PID 1652 wrote to memory of 4200	1652	iexplore.exe	92
PID 3796 wrote to memory of 5308	3796	msedge.exe	93
PID 3796 wrote to memory of 940	3796	msedge.exe	94
PID 3796 wrote to memory of 3304	3796	msedge.exe	95
PID 3796 wrote to memory of 3304	3796	msedge.exe	95
PID 3796 wrote to memory of 3304	3796	msedge.exe	95
PID 3796 wrote to memory of 5696	3796	msedge.exe	96
PID 3796 wrote to memory of 5696	3796	msedge.exe	96
PID 3796 wrote to memory of 4488	3796	msedge.exe	98
PID 3796 wrote to memory of 4488	3796	msedge.exe	98
PID 3796 wrote to memory of 4488	3796	msedge.exe	98
PID 3796 wrote to memory of 2252	3796	msedge.exe	99
PID 3796 wrote to memory of 2252	3796	msedge.exe	99
PID 3796 wrote to memory of 2252	3796	msedge.exe	99
PID 3796 wrote to memory of 1420	3796	msedge.exe	100
PID 3796 wrote to memory of 1420	3796	msedge.exe	100
PID 3796 wrote to memory of 1420	3796	msedge.exe	100
PID 3796 wrote to memory of 5320	3796	msedge.exe	101
PID 3796 wrote to memory of 5320	3796	msedge.exe	101
PID 3796 wrote to memory of 5320	3796	msedge.exe	101
PID 3796 wrote to memory of 4248	3796	msedge.exe	102
PID 3796 wrote to memory of 4248	3796	msedge.exe	102
PID 3796 wrote to memory of 4248	3796	msedge.exe	102
PID 3796 wrote to memory of 1036	3796	msedge.exe	103
PID 3796 wrote to memory of 1036	3796	msedge.exe	103
PID 3796 wrote to memory of 1036	3796	msedge.exe	103
PID 4952 wrote to memory of 5080	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2772 wrote to memory of 2816	2772	vpnhfzupfc.exe	108
PID 3796 wrote to memory of 1964	3796	msedge.exe	111
PID 3796 wrote to memory of 1964	3796	msedge.exe	111
PID 3796 wrote to memory of 3092	3796	msedge.exe	112
PID 3796 wrote to memory of 3092	3796	msedge.exe	112
PID 3796 wrote to memory of 4968	3796	msedge.exe	114
PID 3796 wrote to memory of 1200	3796	msedge.exe	115
PID 3796 wrote to memory of 1200	3796	msedge.exe	115
PID 4952 wrote to memory of 4304	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 3796 wrote to memory of 4128	3796	msedge.exe	120
PID 3796 wrote to memory of 4128	3796	msedge.exe	120
PID 3796 wrote to memory of 2144	3796	msedge.exe	121
PID 3796 wrote to memory of 2144	3796	msedge.exe	121
PID 3796 wrote to memory of 3288	3796	msedge.exe	122
PID 3796 wrote to memory of 3288	3796	msedge.exe	122
PID 4952 wrote to memory of 5552	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 4880 wrote to memory of 1504	4880	smkhczusmk.exe	127
PID 4952 wrote to memory of 3880	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4952 wrote to memory of 204	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 6136 wrote to memory of 4460	6136	ebzuomjebw.exe	136
PID 4952 wrote to memory of 4064	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4952 wrote to memory of 4840	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2252 wrote to memory of 3432	2252	ywqomjdbzw.exe	145
PID 4952 wrote to memory of 2832	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 3796 wrote to memory of 1072	3796	msedge.exe	151
PID 3796 wrote to memory of 5656	3796	msedge.exe	152
PID 3796 wrote to memory of 2692	3796	msedge.exe	153
PID 4952 wrote to memory of 2776	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1836 wrote to memory of 5472	1836	gbytrljdbw.exe	158
PID 4952 wrote to memory of 3372	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4952 wrote to memory of 1508	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 256 wrote to memory of 2520	256	bysqlidbvt.exe	167
PID 4952 wrote to memory of 2992	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4952 wrote to memory of 5292	4952	2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_3ea0454a2851d9afb8efbcb556f3a0f0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:4200
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffb6e9cc188,0x7ffb6e9cc194,0x7ffb6e9cc1a0
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,2866474728751360432,11867907195345650505,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:11
      4⤵
      System Time Discovery
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,4847909937567775435,5508584058857682842,262144 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2668,i,12496335725331249092,16790601511468713265,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17394423556388673435,17318430378978905393,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,12745169563552906004,13618978773573498414,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,13950913216870074817,14840360968470932662,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4444,i,12611950380075537531,7345596545970560330,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,5004851127307360984,7797426774693789367,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5396,i,176196531823737557,4796070036050099962,2097152 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
      4⤵
      PID:1036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,1282630276370462048,4972704810626735415,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,17461551406500632440,623748070416115853,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3383552440165749631,2610734839524994146,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,3383552440165749631,2610734839524994146,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4470741831106967659,18250840293719377937,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,10151188741372727473,5344048604984536517,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:4128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,14815842293008317135,10832741605125028679,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,16131660133273284671,9760381143799473534,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
      4⤵
      PID:3288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,9604526558044647596,3730750173569557805,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=1424 /prefetch:14
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,16410409888876247728,6953500168379841421,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,8374303869190680649,3696758540402111200,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,7468813184617147147,14059587096560499559,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,5531009982861401299,639714754162198279,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,4006270208950339391,4810557576530884945,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
      4⤵
      PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,7768683041363648199,11793681203577644184,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6568,i,8128194513143086206,11411713321808151280,262144 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:10
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12000876326341986635,9768832401515683753,524288 --field-trial-handle=2616,i,15674608045552915137,3336811133367095928,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:14
      4⤵
      PID:3020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfzupfc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080
- - C:\Temp\vpnhfzupfc.exe
    C:\Temp\vpnhfzupfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfzupfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4304
- - C:\Temp\i_vpnhfzupfc.exe
    C:\Temp\i_vpnhfzupfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhczusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5552
- - C:\Temp\smkhczusmk.exe
    C:\Temp\smkhczusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhczusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3880
- - C:\Temp\i_smkhczusmk.exe
    C:\Temp\i_smkhczusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebzuomjebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\ebzuomjebw.exe
    C:\Temp\ebzuomjebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebzuomjebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4064
- - C:\Temp\i_ebzuomjebw.exe
    C:\Temp\i_ebzuomjebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqomjdbzw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\ywqomjdbzw.exe
    C:\Temp\ywqomjdbzw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqomjdbzw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\i_ywqomjdbzw.exe
    C:\Temp\i_ywqomjdbzw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2776
- - C:\Temp\gbytrljdbw.exe
    C:\Temp\gbytrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\i_gbytrljdbw.exe
    C:\Temp\i_gbytrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bysqlidbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1508
- - C:\Temp\bysqlidbvt.exe
    C:\Temp\bysqlidbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bysqlidbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\i_bysqlidbvt.exe
    C:\Temp\i_bysqlidbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5292
- - C:\Temp\qnifdxvqni.exe
    C:\Temp\qnifdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2164
- - C:\Temp\i_qnifdxvqni.exe
    C:\Temp\i_qnifdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfausq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\xvpnhfausq.exe
    C:\Temp\xvpnhfausq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfausq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Temp\i_xvpnhfausq.exe
    C:\Temp\i_xvpnhfausq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axpnhczxsm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Temp\axpnhczxsm.exe
    C:\Temp\axpnhczxsm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axpnhczxsm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4316
- - C:\Temp\i_axpnhczxsm.exe
    C:\Temp\i_axpnhczxsm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhfzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\rpmhfzxrpj.exe
    C:\Temp\rpmhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhfzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2168
- - C:\Temp\i_rpmhfzxrpj.exe
    C:\Temp\i_rpmhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkeczurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\urmkeczurm.exe
    C:\Temp\urmkeczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkeczurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3540
- - C:\Temp\i_urmkeczurm.exe
    C:\Temp\i_urmkeczurm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwugbztrlj.exe ups_run
  2⤵
  PID:5644
- - C:\Temp\cwugbztrlj.exe
    C:\Temp\cwugbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwugbztrlj.exe ups_ins
  2⤵
  PID:4896
- - C:\Temp\i_cwugbztrlj.exe
    C:\Temp\i_cwugbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljebztr.exe ups_run
  2⤵
  PID:5116
- - C:\Temp\wtrljebztr.exe
    C:\Temp\wtrljebztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljebztr.exe ups_ins
  2⤵
  PID:4888
- - C:\Temp\i_wtrljebztr.exe
    C:\Temp\i_wtrljebztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigayt.exe ups_run
  2⤵
  PID:5004
- - C:\Temp\eywqoigayt.exe
    C:\Temp\eywqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigayt.exe ups_ins
  2⤵
  PID:5460
- - C:\Temp\i_eywqoigayt.exe
    C:\Temp\i_eywqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdaysqoifd.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\fdaysqoifd.exe
    C:\Temp\fdaysqoifd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdaysqoifd.exe ups_ins
  2⤵
  PID:2132
- - C:\Temp\i_fdaysqoifd.exe
    C:\Temp\i_fdaysqoifd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  PID:2904
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  PID:1240
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfcausn.exe ups_run
  2⤵
  PID:2552
- - C:\Temp\usnkfcausn.exe
    C:\Temp\usnkfcausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfcausn.exe ups_ins
  2⤵
  PID:2508
- - C:\Temp\i_usnkfcausn.exe
    C:\Temp\i_usnkfcausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnhfzxsp.exe ups_run
  2⤵
  PID:1092
- - C:\Temp\xupnhfzxsp.exe
    C:\Temp\xupnhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnhfzxsp.exe ups_ins
  2⤵
  PID:4804
- - C:\Temp\i_xupnhfzxsp.exe
    C:\Temp\i_xupnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwuom.exe ups_run
  2⤵
  PID:5276
- - C:\Temp\urmkecwuom.exe
    C:\Temp\urmkecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwuom.exe ups_ins
  2⤵
  PID:4936
- - C:\Temp\i_urmkecwuom.exe
    C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrpjztrpj.exe ups_run
  2⤵
  PID:1012
- - C:\Temp\ztrpjztrpj.exe
    C:\Temp\ztrpjztrpj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrpjztrpj.exe ups_ins
  2⤵
  PID:5940
- - C:\Temp\i_ztrpjztrpj.exe
    C:\Temp\i_ztrpjztrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:804

C:\Temp\zxrpjhbzus.sys
C:\Temp\zxrpjhbzus.sys
1⤵
- Executes dropped EXE
PID:2132

C:\Temp\jhbztrmjeb.sys
C:\Temp\jhbztrmjeb.sys
1⤵
- Executes dropped EXE
PID:4980

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Temp\jgebwtomge.sys
C:\Temp\jgebwtomge.sys
1⤵
- Executes dropped EXE
PID:4904

C:\Temp\yvtqljdbvt.sys
C:\Temp\yvtqljdbvt.sys
1⤵
- Executes dropped EXE
PID:6140

C:\Temp\ysqkidaysq.sys
C:\Temp\ysqkidaysq.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\fdxvsnlfdx.sys
C:\Temp\fdxvsnlfdx.sys
1⤵
- Executes dropped EXE
PID:2696

C:\Temp\fzxspnkica.sys
C:\Temp\fzxspnkica.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\xusmkecxup.sys
C:\Temp\xusmkecxup.sys
1⤵
- Executes dropped EXE
PID:5004

C:\Temp\euomhezxrp.sys
C:\Temp\euomhezxrp.sys
1⤵
- Executes dropped EXE
PID:1468

C:\Temp\wromgebzuo.sys
C:\Temp\wromgebzuo.sys
1⤵
PID:1572

C:\Temp\wqomgeywqo.sys
C:\Temp\wqomgeywqo.sys
1⤵
PID:2508

C:\Temp\dywqoigayw.sys
C:\Temp\dywqoigayw.sys
1⤵
PID:4312

C:\Temp\dyvqnligay.sys
C:\Temp\dyvqnligay.sys
1⤵
PID:5520

C:\Temp\vsnkidxvtn.sys
C:\Temp\vsnkidxvtn.sys
1⤵
PID:5928

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:5692

C:\Temp\usmkhfcxup.sys
C:\Temp\usmkhfcxup.sys
1⤵
PID:6040

C:\Temp\hfzxuhfzxr.sys
C:\Temp\hfzxuhfzxr.sys
1⤵
PID:5416

C:\Temp\urpjhezwur.sys
C:\Temp\urpjhezwur.sys
1⤵
PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bysqlidbvt.exe

Path C:\Temp\bysqlidbvt.exe
Size 230KB
SHA256 515c134bbb48de30a8f377bd5318d3b3e0e4fba0f8c3db1331b2102810ed7cd6
MD5 a81e1e5b1d8e43a53fc53e867acdbb4a
SHA1 7c0622933d967f825cbc6d7eb91e231e58d135be
SHA512 6d903b8983bf5d557322af2621305c557f4c9b7e9b1dd0e3005a3f86420a182d6336d38f80aa1a52355b17674637ab5ac9e38928b12cfe08c8ddc62276d51841
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T126344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebzuomjebw.exe

Path C:\Temp\ebzuomjebw.exe
Size 230KB
SHA256 7a550ee3f34e700c400726f86bbd07d5abbb9bfaf209c674a3356b93fccae7ed
MD5 d3410fcb782891421dc5dda2cb208e82
SHA1 ddbd7152841451f96e2ca5f7813f8baa69537318
SHA512 da655b3e08fa5cf6a986fabdcb3a28e46e68ec447ac6c7da2c70344ebc605752e522f233ee9aced1ffc5fd96133b2e3cb293099a35b8fa5fd5fea486991bba05
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T186344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbw.exe

Path C:\Temp\gbytrljdbw.exe
Size 230KB
SHA256 9119ad24bcd8ad4583ba4eb721b80cc89494804c6d380935ae3f79e053888cdf
MD5 343799c7e1eda55fb54dca17ee0793a3
SHA1 ae7dc122f48235d6ed3eb8f32e53b283239708bb
SHA512 1a87841687bc48ef1796b0281fcd4773a92610e5bef6102f05a333c5ca67642294c58e6cdd6dbe306cc5e7cfac919a3ddc6e67911324e4067de58c0bd969982f
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T14A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebzuomjebw.exe

Path C:\Temp\i_ebzuomjebw.exe
Size 230KB
SHA256 981cf394cffc90438e6eb33f9b9131592393e95d391a959a391bc6609944a287
MD5 a7d0af165adf5703fd30fc79b19713cb
SHA1 8f25d9b550b93c060a2622f0d50f92fc10ce9ce8
SHA512 ea8365bb58894b2c631117a06a0d76b8b98341d975c137f2e99601d47ea3e156a8a6918f1abe670d2135f2420c31ae1d72d8583963919ec595f2829fa5d85844
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T1ED344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbytrljdbw.exe

Path C:\Temp\i_gbytrljdbw.exe
Size 230KB
SHA256 d53cb46b077899899663ac4d6c8dcff909a0a58f28295f1cf334f4d5ea8e19b5
MD5 5c1fd9a5ec6e3454952bb1ce2888755c
SHA1 6a6a77bbd7a87bf3117bffda1e5c0a66297b9c13
SHA512 d44cfcb3d491607b27867c6a3ed5c2a337778aacea6ae3d0d4a14384c2c8dabc7119943cc70d5eef78f1099cb5a0102d35939cf6ddbab3b6137cb581651f1105
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T19B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smkhczusmk.exe

Path C:\Temp\i_smkhczusmk.exe
Size 230KB
SHA256 fcddd3484e85b86fc7254e36c232b5e4fa631a54fc37a8ab8a25c4ac00033994
MD5 09d5624c11f287660c57d9fc3033a220
SHA1 4cbee4814c73591d0eb58c52ed8b697ccff98a93
SHA512 06f1bdd2fc3d102d290e014fb6a4606c4f75a95e19888884b2361ad3ea69964154169d3b1d4a483f35b08d1156ff676023f3658ff80053f8b63b0550f809fcad
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfzupfc.exe

Path C:\Temp\i_vpnhfzupfc.exe
Size 230KB
SHA256 651502e82f09a435bb9e81e92f5bbf09e17bf47978db2efa9eb05c3f15956096
MD5 406c8cb5e93a7123f071666b8b393228
SHA1 207e423b0f25f54e4315251a6fc8baf155bee6ee
SHA512 6ccedf1bb4814dfa26843896ad9651839c3e757e3e3013fb242d7f6c402766a9aff71052c6ba186246bbd052534589f2b8e9cee2bf78f39f25d9a9061f40ee02
SSDEEP 3072:3JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:3ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqomjdbzw.exe

Path C:\Temp\i_ywqomjdbzw.exe
Size 230KB
SHA256 0e820b469f8ff4b8cb55220079ad10770f3a0f0d7356d247a09cb31b1ca54efc
MD5 f567d8a2c72ccae6341ac3df006f72b6
SHA1 01883eb7607fe1312c9065ef082afcba2aeca9ca
SHA512 51bc0416be759978ecf97f285c625b6fa141b0bc210963d5424190e2e450dd0866c27bbdcfbc4788ce25a3d727e88310b7f8ea5f5524f0cb96a32568fc66eaf7
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T189344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgebwtomge.sys

Path C:\Temp\jgebwtomge.sys
Size 141KB
SHA256 0b4f496be70a5e2b0f8358fa6aef69b1fe4e7dd6a4dcba9790714a57c5bca54c
MD5 cdbbbb66a585c596c4cdfcfdc35a3ba5
SHA1 8456591f93fdbc35f0a94854a4abade024d77092
SHA512 225d205d395c94210063144984a171b7d2f2ff405281a71f6d1a3e86ca0852264f383e28a0839a6edcdbedca525ac047ac7243f215ab5b31c3e7b2f500b46f1e
SSDEEP 3072:RsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:RsQmpcF8BzXfwV
TLSH
T179E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrljeb.sys

Path C:\Temp\jhbztrljeb.sys
Size 141KB
SHA256 09f5f3179504b0ef791797b97e4c486d554176787b95452b774df05f309e7a2d
MD5 ef5779c232994bce3bc58fbc2bc08dea
SHA1 1ad69844c47105310a511079269ca332be6d5821
SHA512 6c14dae2e580cb5efaca053f944c0a26c389834246cdfebacefeb10266b471a44bd961006f89f9bf1450e593be7fd8d18c58fd8aa1f20e6329f1ce5c1faf9ea7
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T140E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztrmjeb.sys

Path C:\Temp\jhbztrmjeb.sys
Size 141KB
SHA256 7fca6303a9cb60239a8aa235e67385e7a1cf7a0e3c937496e2f7bb421457dd90
MD5 d340543dcd8efe00e2953811a3b97b39
SHA1 c21341573457d9b00444159b43cb772c9422deed
SHA512 cb99c2301bb39da5e9a31badeba28d11957668a80a22fbfbee11780b82a7a57ca1be589c275b96aa96a3cda0d5686dcbd10882a816a9f3acdeb082935fedf642
SSDEEP 3072:EsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ8:EsQmpcF8BzXfwV
TLSH
T149E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczusmk.exe

Path C:\Temp\smkhczusmk.exe
Size 230KB
SHA256 55805fd06f307a9526dd98a60cb324502613368645f393e82412f972b2d6f6b5
MD5 a386a0da94009b09f8ab43e3304de142
SHA1 8bf83964bb4207faeba32497a099f1517088bb87
SHA512 abfe02c805be55ec38e18a2d50ca129c375df7df37ae1e18db6217364d47c81738fdde59f79bdd869e6abede51e048a4445f00be2a1b1221fa492df0e3511a5d
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T13E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfzupfc.exe

Path C:\Temp\vpnhfzupfc.exe
Size 230KB
SHA256 1537e68bacd669d4c7102e6de7293a0bf42b690311a5c660c31298ad72fd657f
MD5 e75a5ee87a397c59591c6746084958aa
SHA1 85c19263099157d02dca14975b465c3c3fa17658
SHA512 ab626f3c182846329e34e14681f9b1a00999bb34852ba9a68c06f2a9ca9cd2e144afeff4f9a4a5968f0070944cd0cf2e09c4f8217a9da5b10771628c4b29afc3
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T11A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtqljdbvt.sys

Path C:\Temp\yvtqljdbvt.sys
Size 141KB
SHA256 caaf1815f7712dd8b3efda34be5612f8d6dab7dd79cdedd6b4d0579936fedfad
MD5 600c56980036318c21c5014baaeb8a1f
SHA1 2419183d2f4920f0ebd3605b221f76b31a43b255
SHA512 0c40e0bea6128b3f4dc85c1e020e7c47321ad25f24ff5c3546e6d2a82b92f44a96bf4df3fd73856f041dc4c5df191391a8ba9fc1f7cb39f216bd5d6b079d68d9
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T138E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomjdbzw.exe

Path C:\Temp\ywqomjdbzw.exe
Size 230KB
SHA256 456eec3c7f34c7d711a0332c1fbcff0a7d7b321c2216206ee1ba23232e0b1c4a
MD5 388577977ff1c76ea0d3bde309a59209
SHA1 52abb81da4a74a8809ce1a098c9dd10f64a6393e
SHA512 b17ea45ba55e01e787322f79f5a936bc14c35a43386fbcbefaed945c9201af4cb2132b4e3149998cd0bd6d9871d62e7a64f12896338e1d54f0a485227ad52dc6
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T18B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhbzus.sys

Path C:\Temp\zxrpjhbzus.sys
Size 141KB
SHA256 8d822e40f1873f14d5ff4d085a8f18764619d6838877d2a2de9f50d2b40d653c
MD5 876ce2c2950907609d9b6f318f4b1ec1
SHA1 625055b9958306f8789a26b2d0bfa7b23b5169be
SHA512 025185ec468253c1c14292c5f59ccfaeb311f83b900e83ac4d99f6d9e0660ea6e4fa84846772ea0102d54c0aaf4404ae41b6b29ed694dd85ffd7e5f946c3c9f7
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T115E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 34d8404b690cbd43a8462765542aa474ea4efec9fa0292f81ee64d37473e6743
MD5 1375ddf592b9cb07427a11176fc5bf17
SHA1 c210624f1b2b0b7d248c82ac6b8aa4abe8492ca0
SHA512 a89e29ee7cb4df1ce5f48f225965d6d8271b49f3f31cec35c6e9c7fba807a26fd4fdd4f70f7fdd48d8a5ffc4e81685500f65c4c7e72c20ee8af8c255896bc8a3
TLSH
T1A4313F9943B325EAE7A6EDB310D1C26637F18C9A3507AE60E4C49DB88A05F7483D0833
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594a2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594a2e.TMP
Size 1KB
SHA256 dfab54b3981689b3bf34b7c2248c4b8211778f1bd2b25de4ea8c3a399e97a50c
MD5 aa74fd4475eb4dd8250aed5033b0e73d
SHA1 279f5f45df21f47e34124dc99e44dad1dd436433
SHA512 da7a673a627849f75234c6b39a64401db78a4ed4f7d7cce5713cf706fc709a25887f65c9a2e4d9b8f31c29fe9ef9473f27b322b6e92a5f410ebd430fd9d6a302
TLSH
T12931419943A325EAE7A6ECB310D1C26637F18C9A3507AE61E4C89DB88A05F7483D0433
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b122622abb13aa3aa01b143c1cd3abd635acd1c26cf99c7652a86f1d5c4b331c
MD5 ddf7ea13f51bf06bc17d5c5735dbcb5b
SHA1 a7999c7e7090ce1c916eb633bfbdf55fd6b3c9d3
SHA512 f3d68cf2f0953ee5c186c5a3ff408b4085d29d7059583698e98426755fd4ee4b4498f4882b2254acbb4d87c0b5fe6bacb4711f6f6b91656e3356685e89054018
TLSH
T15941CEF3C7E4966DC90156F0AA146E1BCE2D0915832C7C5AC9E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 01254359b45a448aced879373bc89e1d8a4d0bfa3e3af08f89c9294249229990
MD5 a33012253c77dd72687b85b563fb718b
SHA1 976465fe1deacbfeed745e91431f0fe6a7661d4d
SHA512 99535caafe9c64d36c3ef701e3ce51dfed04f5ceac470ce22234f2c6de44fcfbc0ab66809be3211a509f4a6a250f012e46d831203b4d43769a3ef6e548058943
SSDEEP 192:sxRSRyCw/fJsjnHm2Sm7a7WzoD8p9a/g6+WNC3k/Y3y22q+G7rIgVlVGcJ:sxRSLw/fJsjn2Q0/59/FsZAA
TLSH
T18342C8166E28A93B4CCBD219BB65BF53D6F9503261D12E58E7FC9A0C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 738723de18e9e8096055188b92f41cc4d24546a101deb5d48473a7b9da95975b
MD5 37b715db68a8a65ff8ea51a50c7b561f
SHA1 950c113fead08c0c181fb94af6738a0a289c89a2
SHA512 0cf2f80f450aedb468bce8e5b39e2d3107aebf14529097fe83892095dd2f294f24aa4840ad36bbbff7559fb73f23e6e9ab07f314aaf5955f883b34f855ec33f7
SSDEEP 192:sxRtRyCw/fJse4OHm2Sm7a7WzoD8p9a/g6+WNC3k/Y3xYq+G7rIgDnlVGcJ:sxRtLw/fJse4O2Q0/59/qZGA
TLSH
T17442EA16AE28A93B5CCBD21DBB557F53E6F9503260D12E58E7FC8A0C04E66DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 df8ba01864d6eb6130fa2495882cb57b871b088728bd3e049f943ca6fe756c92
MD5 cc55aef12edc662436fa7b50f488cea4
SHA1 facb165e5b221247eb3ea387ddf090de5051f7a6
SHA512 0693a7a54acbe03e2d7beccb2a8392c3edcde1434536c79bc5a428f01ff38de678c4ca5f880bbacb1e7b883abd8a40034b16df61493d3b17a380e8ff983170bb
SSDEEP 192:sxRtRyCw/fJse4O8ZzmWzoD8p9a/g6+WNC3k/Y3xYq+G7rIgDnlVGcJ:sxRtLw/fJse4OCZ0/59/qZGA
TLSH
T17442E9266E28A93B4CCBD20DBB557F53E6F9503260D41E18A7FC9A1C14EA6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 82df93a573f987ed8629e97281027a04c37135e1d9e0b86a56e17e57438fa321
MD5 905973b1be7dc43a4060562c23db4039
SHA1 46a08bba448f6acab9dc96962fc6ce9bb009b5ba
SHA512 d3de2b624c54ffe8592c6ee70472da931dcf0b0d04d40525825dd7f177dcef8ad0b9f7232365fe2abcff918ab2072bfc44acd8afda92cd3914ee621d597209ab
SSDEEP 192:sxRtRyCw/fJsenHm2Sm7a7WzoD8p9a/g6+WNC3k/Y3y22q+G7rIgD9lVGcJ:sxRtLw/fJsen2Q0/59/FsZUA
TLSH
T1C542E926AE28A93B4CCBD21DBB55BF53D6F9503260D12E58E7FC8A0C04E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 413e4a8b0727e2e45420a9828b128212cab98a5eb21d0d8719cf3e6e8ba860a7
MD5 77394653cd38b1ca838bb9eda21a3cd5
SHA1 d125c9718b39035ed514f65d1e154b0a8816af38
SHA512 be45344098d01da6656d921a12914777486f990088bb040d27960646702047b4f19838c5947672d85ee5ba9a74a50a0c9653b8a4f9ac1acf3b578ecf52fe69ce
SSDEEP 768:GTEbd97pLuLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVz2gMWctro6NiV:GTEbdrEf3kWg0CfKsu1jak2gFcG6EV
TLSH
T102D2DB7B640DCB7E4F804ADDEC1ABA9B6D6802CB9698CD4047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1d846e9023520d275e762e817bf2f7d741bb9ff4756f51a77dc02cf6c59af922
MD5 2a50ff3bacafd8e85fe75c2c672543cc
SHA1 cb3ee8024b7b2a244af288f42c92f1f57d376afd
SHA512 b5de7fa447108983e332aa0c9b079d1617ebd0eda45910a7502a8e5a6ea3bd487f6d8bbbf79336cc02a827fd7a2872706c83b03bebfc4a4db571282c7e5812a5
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH5WnjRzHDW3EygrDK4aglDcJh8fnAH0VAF:C1i7PF/DWrwfX9mgpct1o7zsH5WnjRzY
TLSH
T1C2914555313B0240387DA90D90FDAC1FD6C2B8A3751DB56B3BA951924F2AE038DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e4d8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e4d8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 878c8d8bac4b094c255f1338951f7e9b255b620470582f3db739ec4538504d9f
MD5 b4d1482d9f8bc7359e55f1bdd51a8a3b
SHA1 09e8f0b9f93a51d7532c1c79fcd1278064f54031
SHA512 d929c2b844cf239e6a6993f8582a3379356a8cd585b162ec7659351ae11425b608de29f27f2f23e8eb01ef6a572f0ab6ca6574b72f7b3262799aa4bb9fd85d2c
SSDEEP 768:PFQ03WwgsEmMfktfZOffFFWfFTMvShCQR0q:S03dfAfef+vSgq
TLSH
T16A1318F598E39937D9AE4787573D6E02AEBCD163B5885984BBD84D0CCC821BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 6e8e3dc930dc188fc9d036b34510be7e165594ea0aefae80917758d0b86d60a6
MD5 653bb8eff08c7a17e686b18e8f7f5722
SHA1 54ffc27732b036d652362b1b752d95bea8964a9b
SHA512 30a050fc19f141e85e7d83577d6dfb5056af2ec63116868c9cae60e712ecdc91a18bdeec1e677de882e87dd9b7009171c9416efffc683ea31dc3aec761da5507
SSDEEP 384:nBZcIv38Nf+7xaXvxFY7mM2cHGfd+UJfRXOVyS5lfFXFWfFXBJoe9vShCiDBTayN:Jv3V9mMXc+wfZOffFFWfFT7vShCQR0q
TLSH
T197E2AE71DC7169339DE69789A60A7B13BEE55137C5C84B48CAED5F0C05C32AE132BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6b9c7bece3027f658a481d2f2ca5a548a56754466d6031eb9e5536bdbc2aa085
MD5 56f5998e04a7e396b24044f793ef9388
SHA1 60aa16330badbfcf9f938bca9137950fc9780d58
SHA512 fb67abd90f2ebacb0dd63cc0c959b4ff1de252c8731d44a5762715c1d5b55c6634e5f85e919d2096f519e087fcad329c931b0b79f425340fe9a64d8d43be0565
SSDEEP 768:Qrv+4UNbd43e9yMXc+wfZOffFFWfFTUvShCQR0f:QbsbO3owfAfef+vSgf
TLSH
T13503AE31E8756A739EF29648B20A7B13BFA85167C5C84A54CEDD5F0C06C35AE131BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0417ee023941efaf0601806258db09de79666bb2ea09ff5f77e1e23b0247761a
MD5 0bf0f33fff308772ac5b9f01404882e2
SHA1 b20c1ea20367098455fe6fcb5d033e40ed9bf6f3
SHA512 ad48f08ac5191c94e35b730489fefd56f6d754043ec2981ab7c9b4d7aeffffd10c2c093f6ee16b194336fcb1cc1725f92361fa5417fad0fc100ce3c6730ebcdf
SSDEEP 768:Rrv+4UNbd43LHtkc+wfZOffFFxvShCQtjl2bwWV:RbsbO3LUwfAf5vSt0wO
TLSH
T1BA03CF32E86899339DE79248764ABB63BEB86173C8C54744DACD1F0D018369F370BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b25e558cd9641deff4d0b4be3cc4374cee9ef42da1c4f82007be8fe7c7b898b5
MD5 5cf848ca7777bbfd0a5f567d1ca1e28c
SHA1 85a749d07e3a50e4d74865a6065e45ab0f9aaf81
SHA512 4e13d5c7c81b635bb4e67daa80b0be2cc5fb9442e1c03f992c7799618ffaff8e4a6459abd27f5575a7999c1bfd7da30f10aeb51fbe7c0a2e85f20345e04c7356
SSDEEP 768:lrv+4UNbd43ptac+wfZOffFFWfFTdvShCQs02bwWV:lbsbO30wfAfefDvSD0wO
TLSH
T1B603BF31E97869739EE39648720ABB23BFB95163C4C54744DADD0B0D028369F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 44c9e20256ccbd2f9c06b48d1fda7a867701d9e9db766f3762fdca2db51c16dc
MD5 7ad61eba0ad58f396176b69d36697078
SHA1 9aa6b0becb72c642f028791a1ac11ea675ba7f1e
SHA512 195fac951a7f13d9db2a28fe34952d5937655743284b149ff40ad51625aadf6f739f95fd7971d44efad339490543e07da9a943ab4d3ee44a674bc4eee154b7e3
SSDEEP 768:2rv+4UNbd43ByAc+wfZOffFFWfFTdvShCQR02bwW2:2bsbO3dwfAfefDvSg0w5
TLSH
T1D803CE31E97869339EE79648720ABB53BFB95163C4C54644CADD0F0C028369F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

2e773b3c-0993-45a5-803c-c0d003bc910b.tmp

Path C:\Users\Admin\AppData\Local\Temp\2e773b3c-0993-45a5-803c-c0d003bc910b.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3796_607596319\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1468-609-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1572-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2132-423-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2508-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2664-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2696-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-732-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4904-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4980-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5416-715-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5520-673-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5692-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5928-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-711-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6140-532-0x0000000000010000-0x0000000000083000-memory.dmp

Download