systex | 0703aa7f5af59f1cd4f811af95689cb52401f7acd45e59ebb1ad70ad87113fa4

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260809-x57klavajd
SHA256 0703aa7f5af59f1cd4f811af95689cb52401f7acd45e59ebb1ad70ad87113fa4
MD5 da93eb235c5c689b87e392b0c6cf084e
SHA1 3df99696c17ebbf64bd16b32d6d334e1cf077ef2
SHA512 c0273c9fdea0919e2a7acc1f3827ce8112abf9614fa77912fb6e7245b3abf4b1d50f6e9373cdbe83fe503d21a707465cd5979c6dd77077865c35b1b43aa7b1b7
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T124344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1320	CP.exe
5276	trpjeywrpj.exe
5916	CP.exe
5488	CP.exe
1656	i_trpjeywrpj.exe
3204	ztqojgbztq.sys
3520	CP.exe
5264	qoljdbytrl.exe
4700	CP.exe
2140	CP.exe
3456	i_qoljdbytrl.exe
1752	oljdbvtgdy.sys
4072	CP.exe
1832	dywqolgdyw.exe
3380	CP.exe
5964	CP.exe
2336	i_dywqolgdyw.exe
5620	tnlgdyvqol.sys
1460	CP.exe
6000	tnlyvqoiga.exe
3584	CP.exe
4268	CP.exe
1636	i_tnlyvqoiga.exe
3492	lfdxvqniga.sys
5760	CP.exe
3008	yvqnigaxvs.exe
1284	CP.exe
5624	CP.exe
248	i_yvqnigaxvs.exe
1060	vsnkicaxvs.sys
4504	CP.exe
4880	uspnhfzxsp.exe
2688	CP.exe
5608	CP.exe
5648	i_uspnhfzxsp.exe
3288	iczxsmcaxs.sys
4688	CP.exe
5740	zurpkhcaus.exe
924	CP.exe
5184	CP.exe
2380	i_zurpkhcaus.exe
2884	jhfzxrpnhe.sys
2676	CP.exe
760	eczxrpmheu.exe
2748	CP.exe
2684	CP.exe
3796	i_eczxrpmheu.exe
5700	bzxrpmgecw.sys
1664	CP.exe
1476	omgezurpjh.exe
5620	CP.exe
3860	CP.exe
5392	i_omgezurpjh.exe
920	gebwtomgey.sys
2240	CP.exe
2364	eywqomgebw.exe
2264	CP.exe
1720	CP.exe
5732	i_eywqomgebw.exe
3964	gbztroiywq.sys
3208	CP.exe
5836	yvtoljdbvt.exe
1676	CP.exe
1524	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_1077648410\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_1077648410\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4120_2074467786\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4120_817420815\_locales\fr_CA\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpjeywrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtoljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daywqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daywqoigdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwuomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdxvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbytqljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdxvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczxrpmheu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwuomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpjeywrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczxrpmheu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
408	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2704	ipconfig.exe
2336	ipconfig.exe
1636	ipconfig.exe
3108	ipconfig.exe
5552	ipconfig.exe
5008	ipconfig.exe
3872	ipconfig.exe
4168	ipconfig.exe
4176	ipconfig.exe
4232	ipconfig.exe
4768	ipconfig.exe
5972	ipconfig.exe
2060	ipconfig.exe
4144	ipconfig.exe
1960	ipconfig.exe
1468	ipconfig.exe
4912	ipconfig.exe
1984	ipconfig.exe
1936	ipconfig.exe
2772	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307772442684222"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{61638186-FC4D-4EB6-9D49-014FDC8B75BD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe
5276	trpjeywrpj.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	i_trpjeywrpj.exe
Token: SeDebugPrivilege	3456	i_qoljdbytrl.exe
Token: SeDebugPrivilege	2336	i_dywqolgdyw.exe
Token: SeDebugPrivilege	1636	i_tnlyvqoiga.exe
Token: SeDebugPrivilege	248	i_yvqnigaxvs.exe
Token: SeDebugPrivilege	5648	i_uspnhfzxsp.exe
Token: SeDebugPrivilege	2380	i_zurpkhcaus.exe
Token: SeDebugPrivilege	3796	i_eczxrpmheu.exe
Token: SeDebugPrivilege	5392	i_omgezurpjh.exe
Token: SeDebugPrivilege	5732	i_eywqomgebw.exe
Token: SeDebugPrivilege	1328	i_yvtoljdbvt.exe
Token: SeDebugPrivilege	3204	i_daywqoigdy.exe
Token: SeDebugPrivilege	2040	i_gdxvqnliga.exe
Token: SeDebugPrivilege	2204	i_axvqkicavs.exe
Token: SeDebugPrivilege	4376	i_causmkifzx.exe
Token: SeDebugPrivilege	3256	i_mkhczusmke.exe
Token: SeDebugPrivilege	704	i_ecwuomhezw.exe
Token: SeDebugPrivilege	3660	i_bzwuomgebw.exe
Token: SeDebugPrivilege	5284	i_eywqojgbvt.exe
Token: SeDebugPrivilege	6140	i_ljgbytqljd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 936	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4100 wrote to memory of 4108	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 936 wrote to memory of 4120	936	iexplore.exe	91
PID 4108 wrote to memory of 1800	4108	iexplore.exe	92
PID 4120 wrote to memory of 5492	4120	msedge.exe	93
PID 4120 wrote to memory of 408	4120	msedge.exe	94
PID 4120 wrote to memory of 240	4120	msedge.exe	95
PID 4120 wrote to memory of 240	4120	msedge.exe	95
PID 4120 wrote to memory of 240	4120	msedge.exe	95
PID 4120 wrote to memory of 5796	4120	msedge.exe	96
PID 4120 wrote to memory of 5796	4120	msedge.exe	96
PID 4120 wrote to memory of 5596	4120	msedge.exe	98
PID 4120 wrote to memory of 5596	4120	msedge.exe	98
PID 4120 wrote to memory of 5596	4120	msedge.exe	98
PID 4120 wrote to memory of 2068	4120	msedge.exe	99
PID 4120 wrote to memory of 2068	4120	msedge.exe	99
PID 4120 wrote to memory of 2068	4120	msedge.exe	99
PID 4120 wrote to memory of 4360	4120	msedge.exe	100
PID 4120 wrote to memory of 4556	4120	msedge.exe	101
PID 4120 wrote to memory of 5640	4120	msedge.exe	102
PID 4120 wrote to memory of 4360	4120	msedge.exe	100
PID 4120 wrote to memory of 4360	4120	msedge.exe	100
PID 4120 wrote to memory of 4556	4120	msedge.exe	101
PID 4120 wrote to memory of 4556	4120	msedge.exe	101
PID 4120 wrote to memory of 5640	4120	msedge.exe	102
PID 4120 wrote to memory of 5640	4120	msedge.exe	102
PID 4120 wrote to memory of 4940	4120	msedge.exe	103
PID 4120 wrote to memory of 4940	4120	msedge.exe	103
PID 4120 wrote to memory of 5436	4120	msedge.exe	104
PID 4120 wrote to memory of 5436	4120	msedge.exe	104
PID 4120 wrote to memory of 5436	4120	msedge.exe	104
PID 4120 wrote to memory of 4676	4120	msedge.exe	106
PID 4120 wrote to memory of 4676	4120	msedge.exe	106
PID 4120 wrote to memory of 4480	4120	msedge.exe	107
PID 4120 wrote to memory of 4480	4120	msedge.exe	107
PID 4120 wrote to memory of 1272	4120	msedge.exe	109
PID 4100 wrote to memory of 1320	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 4120 wrote to memory of 5136	4120	msedge.exe	112
PID 4120 wrote to memory of 5136	4120	msedge.exe	112
PID 4120 wrote to memory of 4080	4120	msedge.exe	113
PID 4120 wrote to memory of 4080	4120	msedge.exe	113
PID 5276 wrote to memory of 5916	5276	trpjeywrpj.exe	115
PID 4120 wrote to memory of 952	4120	msedge.exe	120
PID 4120 wrote to memory of 952	4120	msedge.exe	120
PID 4120 wrote to memory of 2464	4120	msedge.exe	121
PID 4120 wrote to memory of 2464	4120	msedge.exe	121
PID 4100 wrote to memory of 5488	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4100 wrote to memory of 3520	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 5264 wrote to memory of 4700	5264	qoljdbytrl.exe	128
PID 4100 wrote to memory of 2140	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4100 wrote to memory of 4072	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1832 wrote to memory of 3380	1832	dywqolgdyw.exe	137
PID 4100 wrote to memory of 5964	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4100 wrote to memory of 1460	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 6000 wrote to memory of 3584	6000	tnlyvqoiga.exe	146
PID 4100 wrote to memory of 4268	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4120 wrote to memory of 2748	4120	msedge.exe	152
PID 4120 wrote to memory of 5284	4120	msedge.exe	153
PID 4120 wrote to memory of 5376	4120	msedge.exe	154
PID 4100 wrote to memory of 5760	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 3008 wrote to memory of 1284	3008	yvqnigaxvs.exe	159
PID 4100 wrote to memory of 5624	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4100 wrote to memory of 4504	4100	2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 4880 wrote to memory of 2688	4880	uspnhfzxsp.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_da93eb235c5c689b87e392b0c6cf084e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff9d710c188,0x7ff9d710c194,0x7ff9d710c1a0
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,9459829926874878833,279152727374660453,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
      4⤵
      System Time Discovery
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,10797148039495441606,7941932296300879367,262144 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:2
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10268638067275727457,14383571289220619631,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,9483944341842131847,10431568885483413103,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,7003461243101226805,7959523710123616071,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,10069879461750247540,2020530419713596755,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,11199738076330326795,8902447160589430528,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:9
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4444,i,14546515989837983245,4393042711890304782,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,14487662749770012994,5363322684508569669,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:14
      4⤵
      PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5244,i,12550731696649057544,8580599466457778043,2097152 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,702082574285521865,10622828744516461035,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4068,i,12136803442277846920,4813011861605042232,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11186893282779954457,3442674298547400572,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,11186893282779954457,3442674298547400572,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,9085096928674346017,17554443146916057503,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,10431442600849202248,573855414529531096,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,13148960049039798875,3731029435283405773,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,2890690491724827738,13068082616673245439,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,18341982405862306185,17757946020706918822,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:2748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,11055858373039145126,108563030757934075,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,15279467782970072240,2414859356168040419,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,1524675064659678190,10097489539948708022,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:3404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=940,i,17291947756286925029,5246116994693981246,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6308,i,11582684334380346819,1953466329130854327,262144 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:10
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,16628596473986648444,13095913148936498856,524288 --field-trial-handle=2452,i,15603098742360326580,13482363796223289440,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:6004
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trpjeywrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1320
- - C:\Temp\trpjeywrpj.exe
    C:\Temp\trpjeywrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trpjeywrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5488
- - C:\Temp\i_trpjeywrpj.exe
    C:\Temp\i_trpjeywrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoljdbytrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\qoljdbytrl.exe
    C:\Temp\qoljdbytrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoljdbytrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2140
- - C:\Temp\i_qoljdbytrl.exe
    C:\Temp\i_qoljdbytrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dywqolgdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4072
- - C:\Temp\dywqolgdyw.exe
    C:\Temp\dywqolgdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dywqolgdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\i_dywqolgdyw.exe
    C:\Temp\i_dywqolgdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlyvqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1460
- - C:\Temp\tnlyvqoiga.exe
    C:\Temp\tnlyvqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlyvqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4268
- - C:\Temp\i_tnlyvqoiga.exe
    C:\Temp\i_tnlyvqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaxvs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5760
- - C:\Temp\yvqnigaxvs.exe
    C:\Temp\yvqnigaxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1284
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaxvs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\i_yvqnigaxvs.exe
    C:\Temp\i_yvqnigaxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4504
- - C:\Temp\uspnhfzxsp.exe
    C:\Temp\uspnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5608
- - C:\Temp\i_uspnhfzxsp.exe
    C:\Temp\i_uspnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurpkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Temp\zurpkhcaus.exe
    C:\Temp\zurpkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurpkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5184
- - C:\Temp\i_zurpkhcaus.exe
    C:\Temp\i_zurpkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczxrpmheu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2676
- - C:\Temp\eczxrpmheu.exe
    C:\Temp\eczxrpmheu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczxrpmheu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2684
- - C:\Temp\i_eczxrpmheu.exe
    C:\Temp\i_eczxrpmheu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezurpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1664
- - C:\Temp\omgezurpjh.exe
    C:\Temp\omgezurpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezurpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3860
- - C:\Temp\i_omgezurpjh.exe
    C:\Temp\i_omgezurpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqomgebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2240
- - C:\Temp\eywqomgebw.exe
    C:\Temp\eywqomgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqomgebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Temp\i_eywqomgebw.exe
    C:\Temp\i_eywqomgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtoljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3208
- - C:\Temp\yvtoljdbvt.exe
    C:\Temp\yvtoljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtoljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\i_yvtoljdbvt.exe
    C:\Temp\i_yvtoljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daywqoigdy.exe ups_run
  2⤵
  PID:2208
- - C:\Temp\daywqoigdy.exe
    C:\Temp\daywqoigdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daywqoigdy.exe ups_ins
  2⤵
  PID:4844
- - C:\Temp\i_daywqoigdy.exe
    C:\Temp\i_daywqoigdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdxvqnliga.exe ups_run
  2⤵
  PID:5952
- - C:\Temp\gdxvqnliga.exe
    C:\Temp\gdxvqnliga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdxvqnliga.exe ups_ins
  2⤵
  PID:5960
- - C:\Temp\i_gdxvqnliga.exe
    C:\Temp\i_gdxvqnliga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvqkicavs.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\axvqkicavs.exe
    C:\Temp\axvqkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvqkicavs.exe ups_ins
  2⤵
  PID:4620
- - C:\Temp\i_axvqkicavs.exe
    C:\Temp\i_axvqkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkifzx.exe ups_run
  2⤵
  PID:1808
- - C:\Temp\causmkifzx.exe
    C:\Temp\causmkifzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkifzx.exe ups_ins
  2⤵
  PID:4984
- - C:\Temp\i_causmkifzx.exe
    C:\Temp\i_causmkifzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczusmke.exe ups_run
  2⤵
  PID:1280
- - C:\Temp\mkhczusmke.exe
    C:\Temp\mkhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczusmke.exe ups_ins
  2⤵
  PID:3336
- - C:\Temp\i_mkhczusmke.exe
    C:\Temp\i_mkhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomhezw.exe ups_run
  2⤵
  PID:5632
- - C:\Temp\ecwuomhezw.exe
    C:\Temp\ecwuomhezw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomhezw.exe ups_ins
  2⤵
  PID:3400
- - C:\Temp\i_ecwuomhezw.exe
    C:\Temp\i_ecwuomhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwuomgebw.exe ups_run
  2⤵
  PID:5668
- - C:\Temp\bzwuomgebw.exe
    C:\Temp\bzwuomgebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwuomgebw.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_bzwuomgebw.exe
    C:\Temp\i_bzwuomgebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqojgbvt.exe ups_run
  2⤵
  PID:4696
- - C:\Temp\eywqojgbvt.exe
    C:\Temp\eywqojgbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqojgbvt.exe ups_ins
  2⤵
  PID:2880
- - C:\Temp\i_eywqojgbvt.exe
    C:\Temp\i_eywqojgbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgbytqljd.exe ups_run
  2⤵
  PID:1800
- - C:\Temp\ljgbytqljd.exe
    C:\Temp\ljgbytqljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgbytqljd.exe ups_ins
  2⤵
  PID:3664
- - C:\Temp\i_ljgbytqljd.exe
    C:\Temp\i_ljgbytqljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4672

C:\Temp\ztqojgbztq.sys
C:\Temp\ztqojgbztq.sys
1⤵
- Executes dropped EXE
PID:3204

C:\Temp\oljdbvtgdy.sys
C:\Temp\oljdbvtgdy.sys
1⤵
- Executes dropped EXE
PID:1752

C:\Temp\tnlgdyvqol.sys
C:\Temp\tnlgdyvqol.sys
1⤵
- Executes dropped EXE
PID:5620

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\vsnkicaxvs.sys
C:\Temp\vsnkicaxvs.sys
1⤵
- Executes dropped EXE
PID:1060

C:\Temp\iczxsmcaxs.sys
C:\Temp\iczxsmcaxs.sys
1⤵
- Executes dropped EXE
PID:3288

C:\Temp\jhfzxrpnhe.sys
C:\Temp\jhfzxrpnhe.sys
1⤵
- Executes dropped EXE
PID:2884

C:\Temp\bzxrpmgecw.sys
C:\Temp\bzxrpmgecw.sys
1⤵
- Executes dropped EXE
PID:5700

C:\Temp\gebwtomgey.sys
C:\Temp\gebwtomgey.sys
1⤵
- Executes dropped EXE
PID:920

C:\Temp\gbztroiywq.sys
C:\Temp\gbztroiywq.sys
1⤵
- Executes dropped EXE
PID:3964

C:\Temp\lgeyvqoiga.sys
C:\Temp\lgeyvqoiga.sys
1⤵
PID:2176

C:\Temp\fdavtqoiga.sys
C:\Temp\fdavtqoiga.sys
1⤵
PID:5868

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
PID:1328

C:\Temp\nkfcxusnkf.sys
C:\Temp\nkfcxusnkf.sys
1⤵
PID:4760

C:\Temp\mkeczxupmk.sys
C:\Temp\mkeczxupmk.sys
1⤵
PID:2004

C:\Temp\mkecwuomhe.sys
C:\Temp\mkecwuomhe.sys
1⤵
PID:4132

C:\Temp\cwuomgebzw.sys
C:\Temp\cwuomgebzw.sys
1⤵
PID:3692

C:\Temp\ljdbwtomge.sys
C:\Temp\ljdbwtomge.sys
1⤵
PID:5868

C:\Temp\ljdbvtoljg.sys
C:\Temp\ljdbvtoljg.sys
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqolgdyw.exe

Path C:\Temp\dywqolgdyw.exe
Size 230KB
SHA256 f076fd15b120b6e760f8673884557371c04c7ca4d412623221e652a895915d21
MD5 8f5fe58e4ac18b7408020811c762aa46
SHA1 4dc7ce443ae0d573e5cd56c3000cbc8fa82910aa
SHA512 e98e24841956668b350e30056219a57eb4e2f31ac98295dc63ad4cb2e605402a55544bd8df8be4567ca3252c68c28cb562f350c31617a33392a1a4d70ded255c
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqolgdyw.exe

Path C:\Temp\i_dywqolgdyw.exe
Size 230KB
SHA256 841b566d5ae05af7bddf62bf1b18c50e6dfdb7cdd82dae32f59caa41ca48de8f
MD5 82341d1aeb739a67e1f81ca2a41ff720
SHA1 8562db13b335d2b1f56b08731e791c158120117e
SHA512 f73df58375d3b838a1632bdbb380bc7601b72c26c4c5adf0d83ea3e4bedf245bfdab88d5049fc5d09d9b8388b5398af362cd349e2d057820f1a945c2093ce07d
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T15E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoljdbytrl.exe

Path C:\Temp\i_qoljdbytrl.exe
Size 230KB
SHA256 f4d5784f67d592fadf083ea2978aff72c76baf5958e05b8bb31eb3581bff789e
MD5 4d09ccf70722f2ffab2c445fc6abb5c5
SHA1 53ecb80554569638d17143d4ef177a9d55f34da7
SHA512 f804c835cb9f553d3f241e3ef70dda44a499cd86c3c6711503077832d886560995a1b1273b2c15c53ba0d604b88347c79a96912c61c3160d93106f2e153b29a0
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T17C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlyvqoiga.exe

Path C:\Temp\i_tnlyvqoiga.exe
Size 230KB
SHA256 cf5ef1fb528b5a619528ed69948ebb4a0e88b69ad295e2a2c534834cd32977a9
MD5 3d7a6e18ae8ecf255f496c567c647782
SHA1 52b69dbe0639a23c8fb3998d02b8d772ae14b5ab
SHA512 2217a9b0d209a102fd0a31fe6035d271b0a2e94313912b88b950fd3e360aeab6bc9d5c854a0dfe1430f973c00e8f26d89116b46b8e514aa6814affac7683176a
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trpjeywrpj.exe

Path C:\Temp\i_trpjeywrpj.exe
Size 230KB
SHA256 2550137858b37f2655f8413f7bd10221e73cc786d1c187c8263a872af133c89d
MD5 9213f94424f35363f8f1142308d02e97
SHA1 03b0785e071c24047e09cb461d68374c9b2442ed
SHA512 d033a106ba0917afbfa56835bfb7dac16e6c529d9a3dccd28b2e68a215a78fa27e9e27633108a270523f1d4ec30a99e49cc2100949297ab827708bd15669c1fb
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnigaxvs.exe

Path C:\Temp\i_yvqnigaxvs.exe
Size 230KB
SHA256 60adc66b1d5c78148f48606c849f8385a02a3d2cc292d5359a1d2a23abedb005
MD5 13e3811a33b9180d1ae417cc6abacd3d
SHA1 e40f89b0575327864a2bbc4efc67b626bba9550f
SHA512 148df80e37c2f485d54c800aeb18094fc2a80745fb6a876f1350a9bca07f74ec71f86297ad0b68310d8f73eadd14044ce5a3c9cd0bb8711808c6a878648a1ee6
SSDEEP 3072:3JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:3ghLQ0sQmpcF8BzXfwVfAI
TLSH
T192344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqniga.sys

Path C:\Temp\lfdxvqniga.sys
Size 141KB
SHA256 c516c6637fadeef789c81619566dfcefd1999637144da89fee7760959cb6f29d
MD5 46f121744589af2bd4ddab054fbd0209
SHA1 d045f68d088e5723285c15640086986cbf5f5222
SHA512 5d2734b8edafab727786746c46f6c02e390cba45e873982c71075cde3f2994068e50b63266d54fae70b492934c67c796e35358ded4590e30cce9f342e3c30a7e
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T14CE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oljdbvtgdy.sys

Path C:\Temp\oljdbvtgdy.sys
Size 141KB
SHA256 2878ca2ceebc3722b009635afd41b0d5c4975274b17dd6d7bb979019b65c30b7
MD5 c529bfbe199e83065c64ff0174df337a
SHA1 29fd993decd12d1667d47f3082105ed805a47492
SHA512 eb04ef49f645fe2bf38ab695a18b5b502589c65c12ee6cd2b63f44f23a2c22cb8e7d0e2a7887caf398630898e3d2580b66d0b680c66b2514813189ac1e9a369d
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T1DDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoljdbytrl.exe

Path C:\Temp\qoljdbytrl.exe
Size 230KB
SHA256 76f4469445edfa1f76056d0a072b6b9e6743fbb9883431032bbc112d09e8fa0a
MD5 24edb52b60142b84198e523db560a883
SHA1 e5c2666c14819044b6616a1446e9e1bd7d8e08ec
SHA512 bd7578f035b0a46de1d55d3da1d3156502ec716899bb4485f4a704effd271ac89a078405b2eeccb14bb891e5302f1bd8982d320af9797915ef8c042fccd14daa
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqol.sys

Path C:\Temp\tnlgdyvqol.sys
Size 141KB
SHA256 e33a11b4d7901e62e367afc7c481e28e85e0e02c4850899eacce9f277d12e425
MD5 7ec54c10da5da2985ba9bd28640856e6
SHA1 a4160071fe1cc8d92f1f6ad16aaa46dfbd22d562
SHA512 efc36cb5c8131b72be22b29b5801c0300db2919f1391d805e8b6dbdb3cc5539ce76cd0c4deb500c92397eecb8e8d56ea952e74bc678b3e447e5eb455d73f02ea
SSDEEP 3072:SsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:SsQmpcF8BzXfwV
TLSH
T11DE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlyvqoiga.exe

Path C:\Temp\tnlyvqoiga.exe
Size 230KB
SHA256 102aaad6103073aea129fb32cdd88ad3f5a9ea796b56d7e32a375c162c7dcade
MD5 23ab1e5ba546afc17edfaea6f284e9b6
SHA1 5078918202215c5545db6b8ccb8300041a65f096
SHA512 5591c8c62fccef6b5d69847848d436eb81e3f05a3797fdff3ea3e8e766741896af61403be37bff8bda948f990a965117e98a294f21c931142aebf41641e667ed
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T169344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjeywrpj.exe

Path C:\Temp\trpjeywrpj.exe
Size 230KB
SHA256 49d5c2e79e79880781b64c96852a942a1213da2ae263020caa1b3d1b2fa7f63c
MD5 0d86b7ce90d59cfbba6a3c76b8b02821
SHA1 743dd19279279f210a976d4772f3789b64689bb0
SHA512 2f50a8b4617d75e898cedffcf61529b4955dcfd27413d9847ff6f78cfa7a3c1377b8fbfe690a8ea7292aa31724b160f643c477408437f5c78d47162271f19fe2
SSDEEP 3072:nJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:nghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspnhfzxsp.exe

Path C:\Temp\uspnhfzxsp.exe
Size 230KB
SHA256 c87880858d899a20398bcaa685a3097939ee9d6c03b24f5c8be777a7aa5ca369
MD5 69d1f402117ffae9a8f0eb8015918129
SHA1 6d9b482c774380b87e23349f261684a6da984c88
SHA512 b84a5af4753c7dd96f765b1de4244ad3b064a0057cebf240677298da492d9185d68e0f64f9ff8d31371c75c4aa8e23ac6c0b75d3a2814e406ce00258d11c1512
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T152344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkicaxvs.sys

Path C:\Temp\vsnkicaxvs.sys
Size 141KB
SHA256 47958b4b8d6833b06d2afc9409e6723d6eab5d3683cb1a366d9f709e92f4e17a
MD5 ddb555ec642cf9f7bd6334c87589315a
SHA1 b96aa42b4906beb06f55b5c1c13fb22878549abf
SHA512 3ab8708036d4b7ba0539363abb85416fcb20ce1719c494078e91b55d3b6d8f4c55620a323bc81977d895a33b846c31b9ebbe7bb341bf731a298513518b05419c
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T1AEE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigaxvs.exe

Path C:\Temp\yvqnigaxvs.exe
Size 230KB
SHA256 614fb0ef76195ce4a926e288b4d20a77cb4d831f88fcb7a09b61dbe47fcfccea
MD5 b9a1cbdce7e8fc8ef5b105b7d1f0601a
SHA1 ac251d36f0966f0189d79a99d9d2f4946ccc35b4
SHA512 dfdc3b78e5434074d7bdcc89ebc2b1cb122e461544001b9812d0c138f12677a19d901edef318f5670bde241629b866f5c99435e6e3bf1ad4395142ac8d18085e
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:SghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztqojgbztq.sys

Path C:\Temp\ztqojgbztq.sys
Size 141KB
SHA256 aebc447881cace6db9c57c4e65e62cf216d3e7da4c54a7f367f240b37565d2c9
MD5 42ee013d11422d7f02215858e28340ed
SHA1 84f263fc476ff39b80001964fc09c5246409fcef
SHA512 c6a833695ce7e8e779681cc411c255e40dcfb48fe255964d5d3c2f21811bb8491d24ce6cfd35d90aa50c2abab125e64e77d5bc0b8a7363c13789010c08cd1ee7
SSDEEP 3072:bsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:bsQmpcF8BzXfwV
TLSH
T176E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f600a965f1e9a89e11ccdfb3d12540b7a9f9ae5ee04db6c44c2aab49a3ca26c1
MD5 5feac21c30de5ed3699969d6b8ae07d9
SHA1 0a851d01534aded8ff0e2d349e4e2f09cde57943
SHA512 fdedfaedbbb2be4bf8e21f4866e2939b92258d3200694710ecb054aae1b4f5586e3f9d532b75b99ed15db48741ad0a364f36869e4a51c51f89307ab381c72227
TLSH
T17F5152530321CBC1F3E245B260E97559BAF9A8590227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5992b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5992b1.TMP
Size 2KB
SHA256 f9e48c6f22f0bafc8d1b359b5d2084760793de76cc6bccc16a5c3f22e75b21e9
MD5 10489f4377c6f24a25d5dbab557a1d80
SHA1 7dd9938828a26c27e9054fcd6d0becc601b334be
SHA512 830b26541fb6542725ac77534f1095e77f09ffb02b345f2f6ebe9600699be593fe9a24e5f7af358161f75c76e3fcc14a75b08a33b98edb2726515d2c2739de7f
TLSH
T1EB5152530311CBC1F3E245B265E97549BEF9A8990227AE01834CAD789D72F0C91F9F53
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9c117230af151acc0af2a8d67a911af573a338aca922c31559d428f457201d21
MD5 9511518efcfc267b824a12d76cdeb14e
SHA1 7e677bfe6f7babf991cebe2f4e9e7c5f767ba5e6
SHA512 abd906824ec9d4b637776d97b6f1137151ce0284df98ca7b6396ef156fdfca82a03ac604a6e2620798e3af131be5273345f5ba1890168a96686ec55159962037
TLSH
T11041AEF3C3E4857E9A0196F0AA146E1FDE1D0925432C7C5AC9E4EE2B93E3471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63e3483342c561c7246e8d1a2c15d8b2d10a18db95afa9bfe6f5e9fdde947dbb
MD5 86f052a397b70b0658ab60ed9c699696
SHA1 78614d67458119b0d5f0733749d3685bb22c5799
SHA512 d0b0d738d4a143ed627f7a459dd6554018ef561d65a18be93e8c74249dbcf97fd0f6c7cf2cfc1d48f86fdd0a18ff3d1d1245363d2735f992ea191e88a673a50c
SSDEEP 192:sxRLR8CL/fss02kDde5lSHzoD8p97/g6+WNCAH/YCFDuORGAIgVlVGJ:sxRLJL/fssJkc5lSh/5l/hj4
TLSH
T15842E915AE28A93B8CC7D20DBB55BF63D3F95032A1911E58E7FC8A1C05EB6DD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d7ded16847cd46af7d1e4c34d8170180b6e10fd19c9b829121c8eb3263db3b70
MD5 7fa793598822f1b117bd777150ed2182
SHA1 ca6f5c2db0dcf5a094e111afa629621e7a9241e5
SHA512 9aebd7612b12b328f7bf2d38aa83e7a273d3537c12d4bd046772dd4d296241507b5e8920c9e08b4952d47fd3148b573e517c6398fdbb9ed314865b32c1246145
SSDEEP 192:sxRwR8CL/fssR2BGZ/YzoD8p97/g6+WNCAH/YCkRuORGAIgD8lVGJ:sxRwJL/fssgBw/oh/5l/kjd
TLSH
T1AB42E915A928AD3B9CC7D20CBB56BF63D3F95032A1901F58A7FC9A1C01E76CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 77fc53bca78ef4efed51c5237c5809eb21096f6ed30d6e44c998178c4cd20ffd
MD5 e0bda93fe917cdaa7ba89b50e62573b2
SHA1 ca99b848e8b15babccaec6e0bf3f0f205d694e96
SHA512 c4f01bda1cb981e74f72b3c2c02e9699839ae49ef463d74a12e14603fe1361ebff331d077d1cb10840b2aeefc8d60ad6a11dcb1a5ee072787b1cac580a7dcb35
SSDEEP 192:sxRwR8CL/fssR2kGZ/YzoD8p97/g6+WNCAH/YCFDuORGAIgDGlVGJ:sxRwJL/fssgkw/oh/5l/hjn
TLSH
T11342D915AE28A93B8CC7D20DBB56BF63D3F95032A1901E58A6FC9A1C05E76CD621740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 4d5f8c7b9e69ca0bda47320880e85f5ecfe5f9f6d79a267b0e1672c255dae67c
MD5 78e66d2aab3394118bb2697a87c751bf
SHA1 9a9d707d6a7c807d0f3c055e9ae23ec0b60d25ee
SHA512 61352d92239565a937ed981ef358309568349f14c0a2547bcc562cf3639253c7c2cc5885078dbf784bf7b96d673c14e06143e090bc461e3db42adb4622021e18
SSDEEP 768:jC+vp27pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVAX0QqcgroZWo:jC+vpWEfDQWgQ+f4+u1jaTX0Vcrf
TLSH
T106D2EA7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD5047FA841C02C67EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 99847d6fcccbe20e14207a912c72bd233658d93aca7b9c9056f7ee6faa3a7636
MD5 7e625f6c63aa7444dd4449d529d453e5
SHA1 73b1f029d09be33333fdaf9f863e98084cd715fa
SHA512 d429f9cffd8518df150ae14196f744d7982ec604601143a7fda8d089b7765870b350e094f30860d45c5ea8efacf827ec346ad4470dffd31ca5cb3556a32f0534
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHIuoIuZIusIu4IuqIu2Iu6IugWIueIuDIj:CbEBVj5JAdSp9/EgTK7j6dJOHIuoIuZi
TLSH
T1D1911404317A0291787EB50C807D8C2E96C5B4B33519E52B7BA846661F66F43BEFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5af6229a56e437e6f630917ab632a96ca41eb1f79cb19d969138cd591db5ac39
MD5 cf2f8268916adce26112ccd2e31ffc7a
SHA1 6009e48c70a939f2a893512982c3413d13c43cd4
SHA512 dd66a9dd5217fd3108346fce43d0d5e06e36268c661f50a80e15bf984aa16fe9eb87045a3cbc9f14697c06206e7e3323c7696af3988d463b77b1f5bee13b8786
SSDEEP 768:5c3LhjgKty9oJ5p8+p3bd66j+4BRv86aLIW62ewBKZOOR:5c3wCJn8+p3Z6n4y82evZf
TLSH
T14AF2AFB1EC699D338CF5E648B6963B436EF411A3E5C01E98E5ED6B0D009325D2B0FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2add3ffb3400344bb37077a0990e7f627c3449c2c1aaa80b266188cf3cd2eb2e
MD5 09cdcbb0f90ff9a71133897c81d5e010
SHA1 bc98110fa614448f9a9d95f5fed11f773b7cb747
SHA512 d2fad7536e08df6ebbf12fd264830f1eecb0faa1c418100ceb43b0e72ffe911a4a823634c2abf4b092af8534aac625f85b574c1e18543f3b73b1ef50c4206f1a
SSDEEP 768:UFQ232wgIgj3dty9owp8+p3bd66j+4BRv86aLIW62ewBKZOOR:323lCO8+p3Z6n4y82evZf
TLSH
T10C1327F298D78936D8EE9747A37D2E429DBCC063B5845994B7C86E0CCC821BFD70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 531758fe1cf926062fc59026574c33def38377aad8a2845a11aa5ae56b4c6172
MD5 e84093f29436b210a35a035d6c7ee6f8
SHA1 b4ba5368efb07722dcf7d470582515d425d88a80
SHA512 16e63f2370a4487b4b3082e482a99d97df07420810f9bcbf35cc152dbf8de788b9b21700074e3eea4a7d58e7614156d99fbb65a2da91286729126ca3dccb1308
SSDEEP 768:frv+4UNbdD3RaKty9oJNp8+p3bd66j+4BRv86aLIT62bwCl1:fbsbp3CCJL8+p3Z6n4y30ww
TLSH
T13F03BE72E9689D339CF6C64472877B837FF821A395C10EC4E4D92B4E409A25E270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 fff444f9e32fc594c4fb156ec3aafbc7018427ba191a98ce96548c964a476157
MD5 443f077cb8f010223c0b843bc19038f9
SHA1 e6fb91ff407dd8989cd983f10392075192a2aa56
SHA512 5a70cc96c4cdd10563d30a659cf0c46f4cee6532ffa581bb23c4312f70ef8cd04e47c98445483c236898faa898be8686a47da4f030f7199fbe8d27657489016a
SSDEEP 768:Rrv+4UNbdD38hjgKty9oJ2p8+p3bd66j+4BRv86aLIW62ewBKZOON:Rbsbp3pCJg8+p3Z6n4y82evZr
TLSH
T16B13BF72F86D9D338CF6D644B2877B837EB811A394C00EA8E5DD6B4D019619D2B0FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fcc3f745a5dd8bf465ea9a1301274a68c1e86b456e1b0ad55a600cef4ca14843
MD5 2588a047115a1ecf8b758441bd1d0603
SHA1 e3629076a34b186ce1a79ce68159a0e40629bf36
SHA512 22c7a0e7bad6b2446b78799946bd812e7939656306fab734acfdcc2ba2ff3a5d9231eae7bdaeae8abb0ce158b761cc549d48b2bf3fe10ead1cb987fa42740414
SSDEEP 768:Irv+4UNbdD3DcKtyZNp8+p3bd66j+4BRv86aLIiR2bwCl1:Ibsbp3mZL8+p3Z6n4yr0ww
TLSH
T1EE03CF73F95899339CF2C644B2467B437FF851A396C10AC4E5DD2B4E419A29E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a987fea10204a247d08b5f4cea746607eaff9e90e3d9c888e4e30fffc8804ea1
MD5 fce52f1bccf446ea5abdcd66558e8468
SHA1 29d8acec9792b4868e76ff9c0ede83418702318b
SHA512 d9db9a62817885c88a90d1c2f107e44d1e4f1500c3a81c3f33b91c6ced393ae6a4e8a8af9b9889e2a12d62436ee64b521b6ba9130c7deed14801b7774afae5b0
SSDEEP 768:Hc38hjgKty9oJ5p8+p3bd66j+4BRv86aLIW62ewBKZOOR:Hc3pCJn8+p3Z6n4y82evZf
TLSH
T19FF2AEB2EC699D338CF5D648B6963B836EF411A3E5C01E98E5DD6B0D009325D2B0FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 49dc2c1ddcc8a3ce1f940b9f2d724bdb7e9fbe3a93c121b9398f9b544fb417fb
MD5 7834a2670eb4cea0d24d1b9c4b82434d
SHA1 d0037f9a82c90c6acc9979467373986b1f1843ce
SHA512 116030be75d120803e6b7034cb5f354e6a756adebb6f50b22fc9cf6d308227e7307aca0e336f9559f20623307f61d695aba707fd049a73a27740161e7d02d55e
SSDEEP 768:Jrv+4UNbdD3csKty9oJNp8+p3bd66j+4BRv86aLIW62bwClW:Jbsbp31CJL8+p3Z6n4y80wT
TLSH
T17003BE72E9689D339CF6C644B2867B837FF811A395C10ED4E4D96B4E009725E270F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

35badac7-4b58-450c-9486-5710c658397f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35badac7-4b58-450c-9486-5710c658397f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe59694f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59694f.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

18118a4c-0f51-4610-a092-dab150d84d9a.tmp

Path C:\Users\Admin\AppData\Local\Temp\18118a4c-0f51-4610-a092-dab150d84d9a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4120_104045687\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/920-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1060-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1328-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1752-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2004-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2176-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2884-403-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2884-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3204-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3288-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3692-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3964-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3964-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4132-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-531-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5620-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5620-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5700-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download