systex | cb08af699fac0fad92a419270a1cb1eec649df6ff2b01e348c13b23edf133246

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260810-mtkatafp9z
SHA256 cb08af699fac0fad92a419270a1cb1eec649df6ff2b01e348c13b23edf133246
MD5 24646b5ce3f63946582784718a7f3c30
SHA1 561e105a88f2b3532d36d00a017f29317f320b08
SHA512 d0e9eb9742707135d786587041c723df7cbfc2ecb61dec8dd1056c8be71c93447fd3845a626f0399e01c11284473fee0e7718df96775b6c9ee2945905df69bdf
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5628	CP.exe
1744	wrohbwrmhb.exe
5968	CP.exe
5060	CP.exe
2300	i_wrohbwrmhb.exe
1188	ytrljgbztr.sys
3432	CP.exe
6092	olgeywqoig.exe
4608	CP.exe
4160	CP.exe
952	i_olgeywqoig.exe
2896	rojgeywqol.sys
5812	CP.exe
2416	oigdywqoid.exe
3128	CP.exe
2108	CP.exe
5852	i_oigdywqoid.exe
5548	ligdywqoig.sys
5224	CP.exe
1120	fdbvtnlfdy.exe
4488	CP.exe
5672	CP.exe
4220	i_fdbvtnlfdy.exe
2540	dyvqnifays.sys
2384	CP.exe
5064	vqnifaxvpn.exe
1648	CP.exe
1248	CP.exe
5588	i_vqnifaxvpn.exe
4420	pnhfdxusqk.sys
1044	CP.exe
5056	xvsnkhfaxs.exe
2448	CP.exe
2196	CP.exe
3004	i_xvsnkhfaxs.exe
4060	faxvpnhfzx.sys
4724	CP.exe
1188	zuspkhczxs.exe
2300	CP.exe
2800	CP.exe
5836	i_zuspkhczxs.exe
2308	mkeczxrpkh.sys
5956	CP.exe
4936	hfzxusmkhc.exe
6020	CP.exe
1008	CP.exe
3832	i_hfzxusmkhc.exe
4232	kecwuomjhe.sys
3088	CP.exe
4748	eczwuomgez.exe
3124	CP.exe
4904	CP.exe
3644	i_eczwuomgez.exe
5604	jhbztrljeb.sys
5044	CP.exe
4276	geywuomgey.exe
5552	CP.exe
4220	CP.exe
1228	i_geywuomgey.exe
252	mgeywqojge.sys
5520	CP.exe
5376	bvtqolgdyv.exe
1172	CP.exe
4404	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2370525\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1753925727\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2370525\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1753925727\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1358000810\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_710388940\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2370525\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1753925727\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4744_1919693192\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_710388940\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_2370525\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1296319270\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4744_1887937822\_locales\mr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxusmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrohbwrmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrohbwrmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuspkhczxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxusmkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdywqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtnkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvtnkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuspkhczxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtqolgdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfspkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4952	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4348	ipconfig.exe
1480	ipconfig.exe
5912	ipconfig.exe
4244	ipconfig.exe
5724	ipconfig.exe
4388	ipconfig.exe
3284	ipconfig.exe
6120	ipconfig.exe
3448	ipconfig.exe
4500	ipconfig.exe
3584	ipconfig.exe
4660	ipconfig.exe
3292	ipconfig.exe
2572	ipconfig.exe
964	ipconfig.exe
3412	ipconfig.exe
5284	ipconfig.exe
4688	ipconfig.exe
2852	ipconfig.exe
5276	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308323330369187"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{EA84259B-E88A-410D-97B2-B6E6935EB25C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe
1744	wrohbwrmhb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	i_wrohbwrmhb.exe
Token: SeDebugPrivilege	952	i_olgeywqoig.exe
Token: SeDebugPrivilege	5852	i_oigdywqoid.exe
Token: SeDebugPrivilege	4220	i_fdbvtnlfdy.exe
Token: SeDebugPrivilege	5588	i_vqnifaxvpn.exe
Token: SeDebugPrivilege	3004	i_xvsnkhfaxs.exe
Token: SeDebugPrivilege	5836	i_zuspkhczxs.exe
Token: SeDebugPrivilege	3832	i_hfzxusmkhc.exe
Token: SeDebugPrivilege	3644	i_eczwuomgez.exe
Token: SeDebugPrivilege	1228	i_geywuomgey.exe
Token: SeDebugPrivilege	5108	i_bvtqolgdyv.exe
Token: SeDebugPrivilege	2964	i_gdbwtolgey.exe
Token: SeDebugPrivilege	5380	i_dyvtnkidav.exe
Token: SeDebugPrivilege	2172	i_xvpnlfdxvp.exe
Token: SeDebugPrivilege	3436	i_nhfspkhcau.exe
Token: SeDebugPrivilege	5496	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	3076	i_mkecwupmhe.exe
Token: SeDebugPrivilege	5384	i_bzwrojhbzt.exe
Token: SeDebugPrivilege	4908	i_ojhbztrljd.exe
Token: SeDebugPrivilege	4060	i_gbytqoljdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4744	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5524 wrote to memory of 1540	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5524 wrote to memory of 5048	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5048 wrote to memory of 4744	5048	iexplore.exe	91
PID 1540 wrote to memory of 5980	1540	iexplore.exe	92
PID 4744 wrote to memory of 4400	4744	msedge.exe	93
PID 4744 wrote to memory of 4952	4744	msedge.exe	94
PID 4744 wrote to memory of 4480	4744	msedge.exe	95
PID 4744 wrote to memory of 3384	4744	msedge.exe	96
PID 4744 wrote to memory of 4480	4744	msedge.exe	95
PID 4744 wrote to memory of 4480	4744	msedge.exe	95
PID 4744 wrote to memory of 3384	4744	msedge.exe	96
PID 4744 wrote to memory of 2560	4744	msedge.exe	98
PID 4744 wrote to memory of 2560	4744	msedge.exe	98
PID 4744 wrote to memory of 2560	4744	msedge.exe	98
PID 4744 wrote to memory of 2624	4744	msedge.exe	99
PID 4744 wrote to memory of 2624	4744	msedge.exe	99
PID 4744 wrote to memory of 2624	4744	msedge.exe	99
PID 4744 wrote to memory of 5560	4744	msedge.exe	100
PID 4744 wrote to memory of 5792	4744	msedge.exe	101
PID 4744 wrote to memory of 5560	4744	msedge.exe	100
PID 4744 wrote to memory of 5560	4744	msedge.exe	100
PID 4744 wrote to memory of 5792	4744	msedge.exe	101
PID 4744 wrote to memory of 5792	4744	msedge.exe	101
PID 4744 wrote to memory of 3448	4744	msedge.exe	102
PID 4744 wrote to memory of 3448	4744	msedge.exe	102
PID 4744 wrote to memory of 3448	4744	msedge.exe	102
PID 4744 wrote to memory of 1160	4744	msedge.exe	103
PID 4744 wrote to memory of 1160	4744	msedge.exe	103
PID 4744 wrote to memory of 1160	4744	msedge.exe	103
PID 4744 wrote to memory of 2580	4744	msedge.exe	105
PID 4744 wrote to memory of 2580	4744	msedge.exe	105
PID 5524 wrote to memory of 5628	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 4744 wrote to memory of 1396	4744	msedge.exe	107
PID 4744 wrote to memory of 1396	4744	msedge.exe	107
PID 4744 wrote to memory of 1396	4744	msedge.exe	107
PID 1744 wrote to memory of 5968	1744	wrohbwrmhb.exe	110
PID 4744 wrote to memory of 4200	4744	msedge.exe	113
PID 4744 wrote to memory of 3536	4744	msedge.exe	114
PID 4744 wrote to memory of 4200	4744	msedge.exe	113
PID 4744 wrote to memory of 3536	4744	msedge.exe	114
PID 4744 wrote to memory of 3736	4744	msedge.exe	116
PID 4744 wrote to memory of 2608	4744	msedge.exe	117
PID 4744 wrote to memory of 2608	4744	msedge.exe	117
PID 4744 wrote to memory of 2856	4744	msedge.exe	118
PID 4744 wrote to memory of 2856	4744	msedge.exe	118
PID 5524 wrote to memory of 5060	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4744 wrote to memory of 2612	4744	msedge.exe	123
PID 4744 wrote to memory of 2612	4744	msedge.exe	123
PID 4744 wrote to memory of 4932	4744	msedge.exe	124
PID 4744 wrote to memory of 4932	4744	msedge.exe	124
PID 5524 wrote to memory of 3432	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 6092 wrote to memory of 4608	6092	olgeywqoig.exe	129
PID 5524 wrote to memory of 4160	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 5524 wrote to memory of 5812	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 2416 wrote to memory of 3128	2416	oigdywqoid.exe	138
PID 5524 wrote to memory of 2108	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 5524 wrote to memory of 5224	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 1120 wrote to memory of 4488	1120	fdbvtnlfdy.exe	147
PID 5524 wrote to memory of 5672	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	150
PID 4744 wrote to memory of 3204	4744	msedge.exe	153
PID 4744 wrote to memory of 5728	4744	msedge.exe	154
PID 4744 wrote to memory of 1392	4744	msedge.exe	155
PID 5524 wrote to memory of 2384	5524	2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5064 wrote to memory of 1648	5064	vqnifaxvpn.exe	160

C:\Users\Admin\AppData\Local\Temp\2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_24646b5ce3f63946582784718a7f3c30_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:5980
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x300,0x7fff63aac188,0x7fff63aac194,0x7fff63aac1a0
      4⤵
      PID:4400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,9311910069182340950,10311141155199684099,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
      4⤵
      System Time Discovery
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,10433469325621605189,1097823594877093731,262144 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,17227511822789615322,11505635134919998925,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:13
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,13346149867806422921,13106624089660301974,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5056543591488530560,1651731906810540814,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:2624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4360,i,18084196251936725124,17403747387693035532,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:1
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,14865965146111125326,8684919291948901097,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:9
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4532,i,15954086205981898515,5639559523761088255,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
      4⤵
      PID:3448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5360,i,14849904551101663439,3581901374646382541,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,7476120777556070978,15378966007327890441,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5724,i,17805173539435980563,13946474928872548972,2097152 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:1
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,9627859545480667728,4053497704950197978,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,13515357802372550251,1550632476031245154,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,14130178610851299126,10784704424208902703,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,14130178610851299126,10784704424208902703,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,2118602839578604184,12093693301903065889,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:2608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,12353037684119399169,9018277596644584012,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,8918829909789884880,3964236949723356835,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,10632583150946535021,4396117437344641903,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,1696784057857429506,728242293138068765,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=1380 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,9786618271945007213,6453243970921312781,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,9222667234950786152,8474805629868870209,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,15194454337441130730,12383440293836426041,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
      4⤵
      PID:3112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15739811200517996364,5492982328531450959,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:2172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,3710397323539031984,4387663316977163207,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17632350270960943295,6776132196671563667,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4432,i,13861908141905028019,5164199659151642713,262144 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:10
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,193022664461936876,5962700487781048270,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,12719567462853037806,16067795957043088043,524288 --field-trial-handle=2328,i,1041621368208574323,4901477162666573571,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
      4⤵
      PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrohbwrmhb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5628
- - C:\Temp\wrohbwrmhb.exe
    C:\Temp\wrohbwrmhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrohbwrmhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5060
- - C:\Temp\i_wrohbwrmhb.exe
    C:\Temp\i_wrohbwrmhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\olgeywqoig.exe
    C:\Temp\olgeywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4160
- - C:\Temp\i_olgeywqoig.exe
    C:\Temp\i_olgeywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdywqoid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\oigdywqoid.exe
    C:\Temp\oigdywqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdywqoid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Temp\i_oigdywqoid.exe
    C:\Temp\i_oigdywqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbvtnlfdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5224
- - C:\Temp\fdbvtnlfdy.exe
    C:\Temp\fdbvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbvtnlfdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5672
- - C:\Temp\i_fdbvtnlfdy.exe
    C:\Temp\i_fdbvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnifaxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2384
- - C:\Temp\vqnifaxvpn.exe
    C:\Temp\vqnifaxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnifaxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1248
- - C:\Temp\i_vqnifaxvpn.exe
    C:\Temp\i_vqnifaxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkhfaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1044
- - C:\Temp\xvsnkhfaxs.exe
    C:\Temp\xvsnkhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkhfaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2196
- - C:\Temp\i_xvsnkhfaxs.exe
    C:\Temp\i_xvsnkhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zuspkhczxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\zuspkhczxs.exe
    C:\Temp\zuspkhczxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zuspkhczxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2800
- - C:\Temp\i_zuspkhczxs.exe
    C:\Temp\i_zuspkhczxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxusmkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5956
- - C:\Temp\hfzxusmkhc.exe
    C:\Temp\hfzxusmkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxusmkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1008
- - C:\Temp\i_hfzxusmkhc.exe
    C:\Temp\i_hfzxusmkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczwuomgez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3088
- - C:\Temp\eczwuomgez.exe
    C:\Temp\eczwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczwuomgez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4904
- - C:\Temp\i_eczwuomgez.exe
    C:\Temp\i_eczwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywuomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5044
- - C:\Temp\geywuomgey.exe
    C:\Temp\geywuomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywuomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\i_geywuomgey.exe
    C:\Temp\i_geywuomgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtqolgdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5520
- - C:\Temp\bvtqolgdyv.exe
    C:\Temp\bvtqolgdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtqolgdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\i_bvtqolgdyv.exe
    C:\Temp\i_bvtqolgdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbwtolgey.exe ups_run
  2⤵
  PID:4240
- - C:\Temp\gdbwtolgey.exe
    C:\Temp\gdbwtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbwtolgey.exe ups_ins
  2⤵
  PID:564
- - C:\Temp\i_gdbwtolgey.exe
    C:\Temp\i_gdbwtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvtnkidav.exe ups_run
  2⤵
  PID:5416
- - C:\Temp\dyvtnkidav.exe
    C:\Temp\dyvtnkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvtnkidav.exe ups_ins
  2⤵
  PID:5036
- - C:\Temp\i_dyvtnkidav.exe
    C:\Temp\i_dyvtnkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnlfdxvp.exe ups_run
  2⤵
  PID:892
- - C:\Temp\xvpnlfdxvp.exe
    C:\Temp\xvpnlfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnlfdxvp.exe ups_ins
  2⤵
  PID:1652
- - C:\Temp\i_xvpnlfdxvp.exe
    C:\Temp\i_xvpnlfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfspkhcau.exe ups_run
  2⤵
  PID:472
- - C:\Temp\nhfspkhcau.exe
    C:\Temp\nhfspkhcau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfspkhcau.exe ups_ins
  2⤵
  PID:1472
- - C:\Temp\i_nhfspkhcau.exe
    C:\Temp\i_nhfspkhcau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:4080
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  PID:5852
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhe.exe ups_run
  2⤵
  PID:3188
- - C:\Temp\mkecwupmhe.exe
    C:\Temp\mkecwupmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2652
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhe.exe ups_ins
  2⤵
  PID:3332
- - C:\Temp\i_mkecwupmhe.exe
    C:\Temp\i_mkecwupmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzwrojhbzt.exe ups_run
  2⤵
  PID:2008
- - C:\Temp\bzwrojhbzt.exe
    C:\Temp\bzwrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzwrojhbzt.exe ups_ins
  2⤵
  PID:2288
- - C:\Temp\i_bzwrojhbzt.exe
    C:\Temp\i_bzwrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrljd.exe ups_run
  2⤵
  PID:6140
- - C:\Temp\ojhbztrljd.exe
    C:\Temp\ojhbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrljd.exe ups_ins
  2⤵
  PID:1924
- - C:\Temp\i_ojhbztrljd.exe
    C:\Temp\i_ojhbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytqoljdb.exe ups_run
  2⤵
  PID:4192
- - C:\Temp\gbytqoljdb.exe
    C:\Temp\gbytqoljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytqoljdb.exe ups_ins
  2⤵
  PID:5360
- - C:\Temp\i_gbytqoljdb.exe
    C:\Temp\i_gbytqoljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3204

C:\Temp\ytrljgbztr.sys
C:\Temp\ytrljgbztr.sys
1⤵
- Executes dropped EXE
PID:1188

C:\Temp\rojgeywqol.sys
C:\Temp\rojgeywqol.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\ligdywqoig.sys
C:\Temp\ligdywqoig.sys
1⤵
- Executes dropped EXE
PID:5548

C:\Temp\dyvqnifays.sys
C:\Temp\dyvqnifays.sys
1⤵
- Executes dropped EXE
PID:2540

C:\Temp\pnhfdxusqk.sys
C:\Temp\pnhfdxusqk.sys
1⤵
- Executes dropped EXE
PID:4420

C:\Temp\faxvpnhfzx.sys
C:\Temp\faxvpnhfzx.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\mkeczxrpkh.sys
C:\Temp\mkeczxrpkh.sys
1⤵
- Executes dropped EXE
PID:2308

C:\Temp\kecwuomjhe.sys
C:\Temp\kecwuomjhe.sys
1⤵
- Executes dropped EXE
PID:4232

C:\Temp\jhbztrljeb.sys
C:\Temp\jhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:5604

C:\Temp\mgeywqojge.sys
C:\Temp\mgeywqojge.sys
1⤵
- Executes dropped EXE
PID:252

C:\Temp\ljdbvtolge.sys
C:\Temp\ljdbvtolge.sys
1⤵
PID:3268

C:\Temp\aysqolfdxv.sys
C:\Temp\aysqolfdxv.sys
1⤵
PID:6072

C:\Temp\dxvsnlfdxv.sys
C:\Temp\dxvsnlfdxv.sys
1⤵
PID:4192

C:\Temp\kicavsnkfd.sys
C:\Temp\kicavsnkfd.sys
1⤵
PID:956

C:\Temp\pkhfzxusmk.sys
C:\Temp\pkhfzxusmk.sys
1⤵
PID:692

C:\Temp\rpmhbzurmk.sys
C:\Temp\rpmhbzurmk.sys
1⤵
PID:4552

C:\Temp\pjhezwurmc.sys
C:\Temp\pjhezwurmc.sys
1⤵
PID:6124

C:\Temp\jgebztrljd.sys
C:\Temp\jgebztrljd.sys
1⤵
PID:3228

C:\Temp\qojgbytqlj.sys
C:\Temp\qojgbytqlj.sys
1⤵
PID:4600

C:\Temp\gaysqligdb.sys
C:\Temp\gaysqligdb.sys
1⤵
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnifays.sys

Path C:\Temp\dyvqnifays.sys
Size 141KB
SHA256 787e6225368233774913f77436810f9885188c772048e33d3ad3bdaed087df0a
MD5 3888b553945e64131ef9ad6ca1b95381
SHA1 3c31c78f1cd0da34ea637aee7b0ed6580a7ff61e
SHA512 427e97e01b003eae9ef8d195ce5839472716d9df593a899d2e0f71af1a149905fa43af2c077429b73434619265028438e378bfed560f5cc039830ef54972a7da
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T1CEE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdbvtnlfdy.exe

Path C:\Temp\fdbvtnlfdy.exe
Size 230KB
SHA256 61d9b2a1db43fda95be0751e2c94ce5e0c9b92f77255f71de8f9c48612e8083b
MD5 5cd229f5e3982eb109415a5435d2c6eb
SHA1 855960228620a39269e5dca98e946c5bf1bce59a
SHA512 4bbeab47180775e26cd116be2887dc68fd3a53c775402a09f6bb435dc06c839b523cfe92d258574262ff8a8cb9017408ddaed31780ea0557933fcafb61809d66
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T19E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdbvtnlfdy.exe

Path C:\Temp\i_fdbvtnlfdy.exe
Size 230KB
SHA256 bf36d0a14968ffd40665f48a5d62fcd0e65ebd98aea6a02ac55c2dd862c5804a
MD5 925f1ccd8f036bfe8d955e742654f702
SHA1 998ab2a32e173b8518416be8fcbb7a9442fa641f
SHA512 c4e1e5039a44d8b197bcabfe6aa8ef04f9d0d5beebc1b4d3349b87719370fbf9e7d47bd11f2e69852e77fe640c4c1bf476c3158bc23415dfc342ba7d0c60524b
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T13B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oigdywqoid.exe

Path C:\Temp\i_oigdywqoid.exe
Size 230KB
SHA256 044c03e5ad0e0eb12a92cfe5fb677cb5f43eae285707b44767193458be9d1eb5
MD5 a07b9391eaf2ae512a8a9b7bd324f320
SHA1 53d72cd20b20bc2bd31236786f3facedbe972fb3
SHA512 6f083dcefe70dfeb572793d85f8acf569ea5445470027fb131d08e60e808c935f3fb53d2aeba6ada91291b6bc906801ba6bfffc13b7c317ef788be0390b42bc3
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeywqoig.exe

Path C:\Temp\i_olgeywqoig.exe
Size 230KB
SHA256 83aa2d3337db6d85182846756ddd17f6a51c6dc982433092a457851ca31cfb85
MD5 97ceff24042aba6abaf97a65f6f0ca4f
SHA1 990d930a53a65ce5c8b2de5427513e27b63c3b8c
SHA512 efb81386173e4161ec176450d827f4dc8081fc68b4cd8de5a56fd86d7ced1789139e9078b501c8cbba0de6159f3a06e5fecc520fb0404dd597d66efeaeadf73f
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T153344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqnifaxvpn.exe

Path C:\Temp\i_vqnifaxvpn.exe
Size 230KB
SHA256 a2ab9f485ddc618e9f7deebd0e41c2155c37c6bf39cfe520df0f78d5d524b01b
MD5 31fdcff9bba74bc8775a35844ddd388c
SHA1 9a15f9af00e00ab652c56b4e935190b0a835468d
SHA512 e9b1d9c1644122d4be039f8ea7a4985a605bcd6dc8b0e40c12de99f78a0184eb0a7c90053380b19f001e5a5ed794778a7d306705e1e6535e3ef5abd90c52f894
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T153344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrohbwrmhb.exe

Path C:\Temp\i_wrohbwrmhb.exe
Size 230KB
SHA256 2664a4d24b02bb3dfe9510dc053cfaf4f2fa5b3a18872c5cfd3ef9117339d034
MD5 0d31ec2bfb631b992de3def6b76b1aae
SHA1 7c18fac95e29c0544539cda020c55f377b01d341
SHA512 16ad1acc3b5abac26c4f74e26a8528a73dd12acd30553eb34c80692b8e6b9de53a6cefa275257a6bfa20b09be94f9ad63ca88fd5d035f75d74ac89e12b45ccae
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T164344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligdywqoig.sys

Path C:\Temp\ligdywqoig.sys
Size 141KB
SHA256 f8cda7ada9bece57234da73faf7300c0ea00b9065f692acc629b20b5103de046
MD5 fe2e48783a9b46d95483fedd57ce87ea
SHA1 08ebc9ef7168f867570fc61f862d32e871655762
SHA512 a3305f5c313c556d390fe5996f6269d0fc7c0200a3ea8113f12820e7022fd935c7bd345e1e49a94e50de3adfde6340ed8c6ed8a89061465389087e7ded0ca5ed
SSDEEP 3072:xsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:xsQmpcF8BzXfwV
TLSH
T162E38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigdywqoid.exe

Path C:\Temp\oigdywqoid.exe
Size 230KB
SHA256 d04e077a04d71721c1f4b3bac2ea226f05e08cfc81d8c116242bd8f66ce5dd46
MD5 3ad0f906c74f3e7551d8c3615358e67e
SHA1 82500092c1639c0a98da2230069c454fc957c5e6
SHA512 79a399a4b304cf6975674665e8b90ddada408ea27080dbf7a7d9fb00d8449665c94778cde07000173fd5aca6e257c8ddbfe7bb7a32b7749d4d41cbe2acc4a835
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.exe

Path C:\Temp\olgeywqoig.exe
Size 230KB
SHA256 3ede8c123be81099e7af2c0b165eb37787ae20abd4f9cd76fd281d2d0b341694
MD5 db40d6f096a95e46923929dc04540952
SHA1 13dc779dccb4bd21cc5f868962ce633e559c3de7
SHA512 81bd84c88814b17dc2f7612aae0ea063bfeafc785c7cfb58c625a46f2b58e67d0096fa46fcc4d3a3f4d16be8769d32ff621aedde61f82afa10953bf5212ac97e
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfdxusqk.sys

Path C:\Temp\pnhfdxusqk.sys
Size 141KB
SHA256 18cab13a60373ec0443ee5bba73c28e4a0edb7b57bff837f197b2f69809beb9f
MD5 86cec8d53d3d9fcefa16c419271935dd
SHA1 a3a358d8ddd9e5bb38d58d366b377e4c5b3faae1
SHA512 4747e73688f35e21c11a3d40232cf731ed1f71338c65ba62e4001c59ae7beca5d45693fc9229b7287fba6857139e5a27c6eb2561f8b1101292367dbeb38723e9
SSDEEP 3072:VsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:VsQmpcF8BzXfwV
TLSH
T11AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgeywqol.sys

Path C:\Temp\rojgeywqol.sys
Size 141KB
SHA256 498601dd4d89187cd203edfa535445613ca7d5c3909a6016da6a8b6f4fca510c
MD5 e7c9ebf7f96051eb747f9baa05397caf
SHA1 b1df7ef554e25aaed8b94b32418c5e4b837a0a87
SHA512 9f4a71c804de119e5c28352dd6139202b4382150a85fbb056ce56b1b2888e25c70beb188e05b6e9a2ed31b56152c7bc0ae8ca8753d9716b7be3dc453abc3be65
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T19FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifaxvpn.exe

Path C:\Temp\vqnifaxvpn.exe
Size 230KB
SHA256 77af88cae0beee0e9baf228897f55146bdb188bf94e16f30af5eafa1a32b2d3e
MD5 9a15d8b8f002ee8810b0a22a65a2b9ff
SHA1 e19cb66d83dfc0d169efef723045ce45c4fa2b72
SHA512 6818297ea4750eb4eabae93fa98d7948c00688746de55927788332dea55f884c174ab4d5092b3d1b7ae1a7cc70084bbe55248638a191422c549f799bbee90929
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrohbwrmhb.exe

Path C:\Temp\wrohbwrmhb.exe
Size 230KB
SHA256 c2eeab48ffa308a0b65284eff30e08333db12d1b1b85a10a6904e4568547d204
MD5 a24bcd69511ce389cf1b306059d1f1a1
SHA1 4637d79cb0de54ad1bc5af64778f168c5181fb35
SHA512 ff2b2e319b5a3bb445b253d5e1fa8da132fff8003a0e50e732e586b05eac08ef04fdb7590ef37a9fba8e85be214be3333998aecf0f545c4142b74056feffdf9f
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T136344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsnkhfaxs.exe

Path C:\Temp\xvsnkhfaxs.exe
Size 230KB
SHA256 205a25eff113a3d610956c076d84623054ded1ac901e2858ae92abdabd8f5298
MD5 9555989bf0d06cbb878dc80ebc5022d6
SHA1 6b66f480e549699ae2db8f3ba3c0ba771b775d74
SHA512 3f4effa1042b61e2d55d42c02297a7cb8e28f2bbce29573784924213777dd5f182c26ad086b408ebada8b958754dc107c2f6b2aba0fd70620bd90aed505c216c
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T17B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljgbztr.sys

Path C:\Temp\ytrljgbztr.sys
Size 141KB
SHA256 2bb3fdf008b89fdc215597bd5017d373b7a14ea123a9cba135fa382c6d7cb8ae
MD5 a3e429a291ab997ddda386123223d4f8
SHA1 6877deba7d3015027058717b770ec0d78beff588
SHA512 5bd27dbfe1050977950e9a5249a3309ec9ae004b0d2bfe5a5eff401daefd31b03df782ecf73045e3a9324a7c91732830695622336db1d6ff65eb63d4cb371255
SSDEEP 3072:JsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:JsQmpcF8BzXfwV
TLSH
T187E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 608c8b1343bb8a84e9ae5335aa9a1818d494c483cfb9db56ee4dd41fb34a1e1e
MD5 5c92c47c56095b34ebb57968d1d1f0b6
SHA1 c4857a45c55ebb0c498c435fb01fb33fa34ab268
SHA512 ff3c05ce67e4ba52ca30c3ecb6e22ed41f2a290c1955f3715a9137137d77c1f30489afe6b369c1a46a3b059ee2468ed0f1f4f9505ae09a62d9d0f08bc2ea257a
TLSH
T17F61F7A1436709C1EB34B776A0E01B5B3BF49875CD1BEEC62B836EB02806F0232D0427
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5992d0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5992d0.TMP
Size 3KB
SHA256 881232dddb81578a9af776b713d3ab9d556bfab52a8f5faa6212d5f2117d364b
MD5 4e0a18c0652ce1b159dad07d980baae7
SHA1 e7727786f4d6ad540112227f99e5f61bd47e1e53
SHA512 2b64d31d973114dd6759a43f6be0f13b14d62b08d79f2cb39b322e53004449d5052aafe21d9c75cf54895aee4890db1b14348809ab0f5fcd3fce4106abd4e47a
TLSH
T15061E7A1436749D1EB347776A0E05B5B3BF498B5CD1BEEC62B836EB06806F1232D0427
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de4d5834dc6359cc565dba409ca2b89df083a409c9375108a4bc6aacc9e5704a
MD5 b1e8467a35aa8edd1578bb5fec06fa52
SHA1 725f108c9a3e117db89757dd5bd1fdd950057b5a
SHA512 10e398e13b1b5f9ca1ffcfb3481ae54e1375942766c9b9e7151f8ded68885f7eaf74412ad674b8f71a8ece1b1007ba6695d1237addae646471b3fe56640f04de
TLSH
T18B41C0F3C3E4857E8A1156F0AB146E1BCE1D0A15432C7C5AC9E4AF2B93E3471D14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c447f1530be5b14d06c9e59fdcc66f28154104bfbfcd8f17aa46018838cf03c8
MD5 68b8ed23f7246c0f7f6f731b04f084ad
SHA1 cc036106be137f6404e1642c418259c381bd29b1
SHA512 2a4df8c128ba294da78e769276b1108d571c8c5215735e42dbf0dfde08d7b5b7f0594f9b87608ffd6faac7c0f921ce2a1b1470f66c9f18fe4c71f1bd8d58aa8e
SSDEEP 192:sxRzRdCq/fisx6FCMZajXSzoD8p9d/g6+WNCWFfY3N2bvGWIgVSPSzJ:sxRzCq/fisx6FCyajen/5pfSOoO
TLSH
T13A42C715AA28A93B8CCBD20DFA55BF53D2FD513260D16F58A7FC8A1C14E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 45a9383c7ae0bfb955c66347679a1f41fd9944ac8ae0e2160f6e4e147322662a
MD5 91f54616b14910442ef19626761b0589
SHA1 50f4c7ba3ef846c7e76b60993ae7efac1f86b2fb
SHA512 6e4eb92cd6fb720b41deb72225c6f115a433efbc7602713adb0a86f9f950c9accaa54c3999bf464ae93f5f56d569d15149b1166acfe860b9a38d8b9067528342
SSDEEP 192:sxRgRdCq/fis5TFCMZajXSzoD8p9d/g6+WNCWFfY3trvGWIgDhSPSzJ:sxRgCq/fis5TFCyajen/5pfuIO
TLSH
T16F42C819AA28693B8CCBE21DFA55BF53D2FD503260D11F58A7FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6cc56a224a6b96ba2a125eb306f4d849d8abfe436482e31ffdc57b8e594ef96e
MD5 b380f8a8c11f0773c74bd232dfb7c7f9
SHA1 1f040328089062404a038502897c10443387934f
SHA512 737d53082b2d3afe44ef0f92b7981d2261e6304a72241df0da2c9ecdd538297e2bda642d225a1ba148a8fc2e372e37b2625dc1e249463d6d3d0fcb9715dc786e
SSDEEP 192:sxRgRdCq/fis56FCMZajXSzoD8p9d/g6+WNCWFfY3N2bvGWIgDDSPSzJ:sxRgCq/fis56FCyajen/5pfSOiO
TLSH
T10542C715AA28693B8CCBD21DFA55BF53D2FD503260D12F58A7FC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 8ea2aaa5af69a65b2584b2ed665d005a9101e3a929d69806b2adadfb78b72b5b
MD5 5dc3d570be6794f4b2cffea955ad64f7
SHA1 e217314f060ce6abbc4c4d10d51c40a9336623d0
SHA512 4def105bd7e5483e3366ea6914776edd4c088974136f17298600c60448342f72bde82fb1441321c9030f4a5ab502c5a29e791baef4eaf38552c2167e5a6f9166
SSDEEP 768:GTEb2g7pLuLf3kWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhKgMWctroAFi9:GTEb2sEf3kWg0CfKsu1jayKgFcGAs9
TLSH
T133D2E97B740DCB7E4F804ADDAC19BA9B6D6802CB9A98CD4047FE941C02C6BFB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c9b0e5a4788e5c217b297a4702a1a87a73722dfd1c7876700a6760e7d83b4b32
MD5 d45252a1667484ca14ab7308c5d82f0f
SHA1 89546195dd5bbd8ceb675a30d92928315422b6d1
SHA512 8376f4f013e2f03f972050a29861b753c8d0db2e30b2011382c3c43b08db21f1e4dafea1140dc53d26482e2d4ec51bda41c20e50d2c1d976bd5d7676fa1d2a86
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHI5MYKWaAW+jTgAAK4VgiAjr6KE0GuL:C1i7PF/DWrwfX9mgpct1o7zsHI5MYKWn
TLSH
T153913F46347F42403D7E6A5C96ACD96AA6823463301DF52B3BE845B51F67E038CFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2df7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2df7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aff1b3fc98902fb74d8f6cfd951436c9e4a8ae7fc428700b9c877bcb690b4a0f
MD5 73b715f0002722d00488463af98b53b2
SHA1 c58e4df9d2ca29a880a773eedc74b82a0b1fe7a4
SHA512 c3cdd419d85373e8b9cf62ce99e659848004350323bdc17b912eb44d70ad07233971442c60efc9e23f3b9308dd9bb791f50cf8f96574c4f04be38b49baa847c3
SSDEEP 768:rv3Lu2Xc+wfZOpfo66+RfN0vShCQRshy6DqA:rv3Lhwfqf764fuvSATf
TLSH
T1EAF2BF70D87026739EEA9645B7063B03BED95123D5C85B88DADD5B0D01C37EE230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7dea30b85d043d0e91bac3556914417ae4d497bfdc90d8ceae4161e6725c0c64
MD5 232287d9725d64697dabe7101ca187fe
SHA1 148075064f688393a40f7dcb86b291191eb8c061
SHA512 d689acb78337ee64588afe4c07ecbda3aa4b575d6f14a3df853293d8110ee6ce2b717dddb74d7a86b98b8e022ecbe8b79e85c6d5452509f8d3db56465d047c04
SSDEEP 768:Zrv+4UNbd4312c+wfZOpfo66+RfNUvShCQRs2bwW2:ZbsbO3Swfqf764fyvSA0w5
TLSH
T1DE03BF71E87866739EE78648B6067F13BFB99263C4C94684DADD1A0D018369E331BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 bc74d2ae2827015becff45817ca0fad171446dda736a9eb70dc3a989edbe6ba8
MD5 7320ce32486b8baae13a54558a67c1cd
SHA1 19b588423f6a20c1a577f39a476263df84ae0a52
SHA512 06ffb7b66aea32c10892b9a15ca2b483c3041ad3d7db99719a9210e28717f440ff6e3b4d32e901eee93bbf60a49b507f25267cb54cc0b505335708b127831b7e
SSDEEP 768:dFQ531wgJI2fZtfZOpfo66+RfNfvShCQRshy6DqA:s539tfqf764ftvSATf
TLSH
T19D1328F598E39632D9AE4787A73D6E02ADFDC113B5889584BBD84D0CCC821BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf649527c58888f1fe909d6c060aa456510e845a0afaf8c7ff7e23f55ceb40bf
MD5 6c53281b94ab2cf460d938451ede2568
SHA1 4fe1ce3c168107d07966148c798ef52021a49d5b
SHA512 89c168fe5310efde91fb06465229c477bece365dfb667c39796f92fd88a853a23c5db51fdf7cb915c54021321e9477cac4dd4cc1e3f260e3748048aaf6a50ca3
SSDEEP 768:Rrv+4UNbd43Zhkc+wfZOpfo66+QFvShCQt12bwWV:RbsbO3ZIwfqf765FvSZ0wO
TLSH
T1D203D072E86859339DE782487646BB63BEB862B3C8C54784D6CD1B0D018369F370FC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d9f421cf098b70407aeaa86ad3cbd75cc3b856ce1d5e0e5683fdb3f087bb6f02
MD5 2c033971c35a7e39a49ab1617abf687c
SHA1 45afe840747947b927a009228d4ac4cfced7cfec
SHA512 74a1f8ef624611863363a3e890644880e94d333eaa90a720683ba322616e250fd584f8ef9e24ee824e849a8104f846f59dc614f93d628edeb0f7dd8a802cb72c
SSDEEP 768:5rv+4UNbd43Qu2Xc+wfZOpfo66+RfNcvShCQRshy6DqI:5bsbO3Qhwfqf764fCvSATD
TLSH
T11313BE31E87826739EF79644B2077E13BFE8512394C85A98DADD4B0D01C76EE331B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6f0eed1f8d5af7d43b1f3640ffb256c2e74c75586801fdc4766397f34ed5aef8
MD5 48443cc0c3668e2bc98837421e287f9a
SHA1 3471756d6332cdb4ab32eaf7422db36ee5514617
SHA512 a4736e08ed0603d1ffb05bc5e5a11c2691053e227fb530b0f4554751254caef466bb5fa7f4c4e9b49799f7441a8d5e5c052e101344481f815b349e1b2d25552d
SSDEEP 768:vv3Qu2Xc+wfZOpfo66+RfN0vShCQRshy6DqA:vv3Qhwfqf764fuvSATf
TLSH
T1F1F2BF70D87026739EEA9645B7067B03BEE99123D5C85B88DADD5B0D01C37EE230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d456b3b2afa31b0a6fe726886b6fa8d4441350ca25c5ef4a280fad2b5648848d
MD5 3954f854c5a4236f7a94fbcee1d1581a
SHA1 e103f335a354d2cc840bce5cd5ac1d13585b068a
SHA512 e6773875873391aaf22e76db949f8cea9fef7ded18e4062d3570464a90b1b27c92a3eea6d82add6cfc48990eb71faeb7024aef59baa1b35e685c38c0e33913de
SSDEEP 768:grv+4UNbd436Yc+wfZOpfo66+RfNUvShCQss2bwWV:gbsbO3vwfqf764fyvSv0wO
TLSH
T1CE03CF72E87866739EE78A447606BF13BFB99263C4C54684DADD1A0D018369E331BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6386341-f5c6-4afd-95e2-52e3b31361e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c6386341-f5c6-4afd-95e2-52e3b31361e7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

6cbe348f-03d8-46cb-afe2-bb6ec3588262.tmp

Path C:\Users\Admin\AppData\Local\Temp\6cbe348f-03d8-46cb-afe2-bb6ec3588262.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4744_1011809390\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-602-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/692-685-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/956-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/956-687-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1188-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2308-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3228-730-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3268-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4192-654-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4420-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-711-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4600-734-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5548-500-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-709-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-751-0x0000000000010000-0x0000000000083000-memory.dmp

Download