systex | 4d373ae955f4c900b6fec045bd23507da91bcd19bff77dfb31b77c73051e62b0

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260824-c2jzxasdkd
SHA256 4d373ae955f4c900b6fec045bd23507da91bcd19bff77dfb31b77c73051e62b0
MD5 a63dfd22c92bce4f0ad8254218466f1b
SHA1 9dd63f2fdeb03231a19a4c4a08e546b9cc9d30e5
SHA512 44dd0867a9e5c90d3c6971403745277836f2e0432d5c2dd3ed158a45180339437e18629f33146a526143a6b6496907b71526e287c455586d4d095993ea314557
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2496	CP.exe
5852	wtolgeztrl.exe
4972	CP.exe
200	CP.exe
432	i_wtolgeztrl.exe
1768	dbvtqljdbv.sys
1744	CP.exe
2812	vqoigaytnl.exe
256	CP.exe
5836	CP.exe
5800	i_vqoigaytnl.exe
4352	icavsnlida.sys
4668	CP.exe
5044	idavtnlfda.exe
2304	CP.exe
2980	CP.exe
1484	i_idavtnlfda.exe
1084	kicausnkfc.sys
1964	CP.exe
5972	hfdavsmkic.exe
432	CP.exe
4084	CP.exe
3152	i_hfdavsmkic.exe
4620	usqkhfzxus.sys
3936	CP.exe
5028	kecausmkec.exe
2872	CP.exe
3836	CP.exe
4316	i_kecausmkec.exe
2412	uspkhcausm.sys
2748	CP.exe
3408	xrpkhcausm.exe
2784	CP.exe
4476	CP.exe
1748	i_xrpkhcausm.exe
4532	urpjhbzwrp.sys
636	CP.exe
1108	rpmgezwrpj.exe
5104	CP.exe
2680	CP.exe
4224	i_rpmgezwrpj.exe
5940	hezwtjhbyw.sys
3152	CP.exe
5220	eywtrljebw.exe
2240	CP.exe
2780	CP.exe
2788	i_eywtrljebw.exe
3908	romgeytroj.sys
3844	CP.exe
5004	ojgezwrojy.exe
2876	CP.exe
1968	CP.exe
1168	i_ojgezwrojy.exe
4152	jgbytqliga.sys
2520	CP.exe
2776	dyvqoigayt.exe
1256	CP.exe
2700	CP.exe
1936	i_dyvqoigayt.exe
2060	fdxvqnlfdy.sys
2896	CP.exe
2956	aysqlidavt.exe
5584	CP.exe
2344	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_869472521\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_2007005218\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_885155483\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_2007005218\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_885155483\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_869472521\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5408_189206221\dasherSettingSchema.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicavsqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqoigaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdavsmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgezwrojy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeytrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicavsqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpkhcausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgezwrojy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxusmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhezxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhezxrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqoigaytnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdavsmkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwrpjgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwrpjgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeytrligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdaysqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecausmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdaysqoig.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6004	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2672	ipconfig.exe
2364	ipconfig.exe
5712	ipconfig.exe
3956	ipconfig.exe
4608	ipconfig.exe
5828	ipconfig.exe
4744	ipconfig.exe
5244	ipconfig.exe
3156	ipconfig.exe
4056	ipconfig.exe
4632	ipconfig.exe
5600	ipconfig.exe
3472	ipconfig.exe
2504	ipconfig.exe
4980	ipconfig.exe
2000	ipconfig.exe
3320	ipconfig.exe
1224	ipconfig.exe
5228	ipconfig.exe
120	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320124640197549"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{73C294E8-5B8E-4E5A-A4B7-1CE93CD05A6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe
5852	wtolgeztrl.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe
5408	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	432	i_wtolgeztrl.exe
Token: SeDebugPrivilege	5800	i_vqoigaytnl.exe
Token: SeDebugPrivilege	1484	i_idavtnlfda.exe
Token: SeDebugPrivilege	3152	i_hfdavsmkic.exe
Token: SeDebugPrivilege	4316	i_kecausmkec.exe
Token: SeDebugPrivilege	1748	i_xrpkhcausm.exe
Token: SeDebugPrivilege	4224	i_rpmgezwrpj.exe
Token: SeDebugPrivilege	2788	i_eywtrljebw.exe
Token: SeDebugPrivilege	1168	i_ojgezwrojy.exe
Token: SeDebugPrivilege	1936	i_dyvqoigayt.exe
Token: SeDebugPrivilege	4480	i_aysqlidavt.exe
Token: SeDebugPrivilege	3320	i_xvpnkifays.exe
Token: SeDebugPrivilege	3680	i_ausnkicaus.exe
Token: SeDebugPrivilege	3048	i_pnhfzxusmh.exe
Token: SeDebugPrivilege	4536	i_upmhezxrom.exe
Token: SeDebugPrivilege	720	i_cwrpjgezwr.exe
Token: SeDebugPrivilege	1304	i_jdbwtromge.exe
Token: SeDebugPrivilege	4980	i_jgeytrligb.exe
Token: SeDebugPrivilege	5532	i_ljdaysqoig.exe
Token: SeDebugPrivilege	1844	i_kicavsqnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4564	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4680 wrote to memory of 5556	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5556 wrote to memory of 5408	5556	iexplore.exe	91
PID 5408 wrote to memory of 3424	5408	msedge.exe	92
PID 4564 wrote to memory of 2444	4564	iexplore.exe	93
PID 5408 wrote to memory of 480	5408	msedge.exe	94
PID 5408 wrote to memory of 6004	5408	msedge.exe	95
PID 5408 wrote to memory of 480	5408	msedge.exe	94
PID 5408 wrote to memory of 480	5408	msedge.exe	94
PID 5408 wrote to memory of 4160	5408	msedge.exe	96
PID 5408 wrote to memory of 4160	5408	msedge.exe	96
PID 5408 wrote to memory of 1732	5408	msedge.exe	98
PID 5408 wrote to memory of 1732	5408	msedge.exe	98
PID 5408 wrote to memory of 1732	5408	msedge.exe	98
PID 5408 wrote to memory of 2996	5408	msedge.exe	99
PID 5408 wrote to memory of 2996	5408	msedge.exe	99
PID 5408 wrote to memory of 2996	5408	msedge.exe	99
PID 5408 wrote to memory of 3116	5408	msedge.exe	100
PID 5408 wrote to memory of 5684	5408	msedge.exe	101
PID 5408 wrote to memory of 3116	5408	msedge.exe	100
PID 5408 wrote to memory of 4468	5408	msedge.exe	102
PID 5408 wrote to memory of 3116	5408	msedge.exe	100
PID 5408 wrote to memory of 5684	5408	msedge.exe	101
PID 5408 wrote to memory of 5684	5408	msedge.exe	101
PID 5408 wrote to memory of 4468	5408	msedge.exe	102
PID 5408 wrote to memory of 4468	5408	msedge.exe	102
PID 5408 wrote to memory of 5092	5408	msedge.exe	104
PID 5408 wrote to memory of 5092	5408	msedge.exe	104
PID 5408 wrote to memory of 2892	5408	msedge.exe	106
PID 5408 wrote to memory of 3716	5408	msedge.exe	105
PID 5408 wrote to memory of 2892	5408	msedge.exe	106
PID 5408 wrote to memory of 3716	5408	msedge.exe	105
PID 5408 wrote to memory of 4376	5408	msedge.exe	108
PID 4680 wrote to memory of 2496	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 5852 wrote to memory of 4972	5852	wtolgeztrl.exe	114
PID 5408 wrote to memory of 4344	5408	msedge.exe	117
PID 5408 wrote to memory of 4344	5408	msedge.exe	117
PID 5408 wrote to memory of 1608	5408	msedge.exe	123
PID 5408 wrote to memory of 1608	5408	msedge.exe	123
PID 5408 wrote to memory of 5940	5408	msedge.exe	119
PID 5408 wrote to memory of 5940	5408	msedge.exe	119
PID 5408 wrote to memory of 5056	5408	msedge.exe	120
PID 5408 wrote to memory of 5056	5408	msedge.exe	120
PID 4680 wrote to memory of 200	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4680 wrote to memory of 1744	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2812 wrote to memory of 256	2812	vqoigaytnl.exe	127
PID 4680 wrote to memory of 5836	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 4680 wrote to memory of 4668	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 5044 wrote to memory of 2304	5044	idavtnlfda.exe	136
PID 4680 wrote to memory of 2980	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4680 wrote to memory of 1964	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5972 wrote to memory of 432	5972	hfdavsmkic.exe	145
PID 4680 wrote to memory of 4084	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 5408 wrote to memory of 1252	5408	msedge.exe	151
PID 5408 wrote to memory of 4464	5408	msedge.exe	152
PID 5408 wrote to memory of 5220	5408	msedge.exe	153
PID 4680 wrote to memory of 3936	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 5028 wrote to memory of 2872	5028	kecausmkec.exe	158
PID 4680 wrote to memory of 3836	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4680 wrote to memory of 2748	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 3408 wrote to memory of 2784	3408	xrpkhcausm.exe	167
PID 4680 wrote to memory of 4476	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4680 wrote to memory of 636	4680	2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 1108 wrote to memory of 5104	1108	rpmgezwrpj.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_a63dfd22c92bce4f0ad8254218466f1b_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:2444
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ffcedffc188,0x7ffcedffc194,0x7ffcedffc1a0
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,15552591752416048075,8264266242585970673,262144 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,15579699353629797754,3012285328758787105,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
      4⤵
      System Time Discovery
      PID:6004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17632294875458556363,2145546146176754332,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:13
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,12067964834762866866,13676463917836428766,2097152 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:1732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,11632938334709309308,1575938755335954663,2097152 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:2996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4244835287611424413,1490492710860056614,2097152 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,13773970599392191692,5535944668003315935,2097152 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:5684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4484,i,15398522767131753728,529491695385497018,2097152 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,15224919113297148971,9345538431533093650,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,9607701837973460554,10632261214872552414,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,13456213018611804726,8291987137052967062,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6682332379385984460,13497573762476607280,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6682332379385984460,13497573762476607280,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:4376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,9364475116755012862,7858941905390284258,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,16656140714562727756,1045187021535471021,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,14481028444901667977,11850118446842188429,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13923117475174189527,17729513935286827589,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
      4⤵
      PID:5056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,10345205540608836412,1197631378426732436,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:1252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,5708195420690229931,9976699455518392095,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,1694112705899728511,5127359564864070383,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:5220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,13887580148963165776,12053554672601139332,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,6375918112424458191,17182950441926738388,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:5560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,8173275741032679542,12388825473385064802,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,2154917575280740946,9540424767132651137,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6260,i,1780288402070487761,13974855125581233643,262144 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:10
      4⤵
      PID:2252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,15506784114608421455,1087614769247003252,524288 --field-trial-handle=2200,i,13883918036089552608,9484765502775687844,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:1376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeztrl.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2496
- - C:\Temp\wtolgeztrl.exe
    C:\Temp\wtolgeztrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeztrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_wtolgeztrl.exe
    C:\Temp\i_wtolgeztrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqoigaytnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1744
- - C:\Temp\vqoigaytnl.exe
    C:\Temp\vqoigaytnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2812
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqoigaytnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5836
- - C:\Temp\i_vqoigaytnl.exe
    C:\Temp\i_vqoigaytnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfda.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4668
- - C:\Temp\idavtnlfda.exe
    C:\Temp\idavtnlfda.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfda.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2980
- - C:\Temp\i_idavtnlfda.exe
    C:\Temp\i_idavtnlfda.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdavsmkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1964
- - C:\Temp\hfdavsmkic.exe
    C:\Temp\hfdavsmkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdavsmkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4084
- - C:\Temp\i_hfdavsmkic.exe
    C:\Temp\i_hfdavsmkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecausmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3936
- - C:\Temp\kecausmkec.exe
    C:\Temp\kecausmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecausmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3836
- - C:\Temp\i_kecausmkec.exe
    C:\Temp\i_kecausmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpkhcausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\xrpkhcausm.exe
    C:\Temp\xrpkhcausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpkhcausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4476
- - C:\Temp\i_xrpkhcausm.exe
    C:\Temp\i_xrpkhcausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmgezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:636
- - C:\Temp\rpmgezwrpj.exe
    C:\Temp\rpmgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmgezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2680
- - C:\Temp\i_rpmgezwrpj.exe
    C:\Temp\i_rpmgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtrljebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3152
- - C:\Temp\eywtrljebw.exe
    C:\Temp\eywtrljebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtrljebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2780
- - C:\Temp\i_eywtrljebw.exe
    C:\Temp\i_eywtrljebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgezwrojy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Temp\ojgezwrojy.exe
    C:\Temp\ojgezwrojy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgezwrojy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\i_ojgezwrojy.exe
    C:\Temp\i_ojgezwrojy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2520
- - C:\Temp\dyvqoigayt.exe
    C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2700
- - C:\Temp\i_dyvqoigayt.exe
    C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2896
- - C:\Temp\aysqlidavt.exe
    C:\Temp\aysqlidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\i_aysqlidavt.exe
    C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnkifays.exe ups_run
  2⤵
  PID:4700
- - C:\Temp\xvpnkifays.exe
    C:\Temp\xvpnkifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnkifays.exe ups_ins
  2⤵
  PID:2800
- - C:\Temp\i_xvpnkifays.exe
    C:\Temp\i_xvpnkifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausnkicaus.exe ups_run
  2⤵
  PID:4336
- - C:\Temp\ausnkicaus.exe
    C:\Temp\ausnkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausnkicaus.exe ups_ins
  2⤵
  PID:1352
- - C:\Temp\i_ausnkicaus.exe
    C:\Temp\i_ausnkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxusmh.exe ups_run
  2⤵
  PID:3448
- - C:\Temp\pnhfzxusmh.exe
    C:\Temp\pnhfzxusmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxusmh.exe ups_ins
  2⤵
  PID:5980
- - C:\Temp\i_pnhfzxusmh.exe
    C:\Temp\i_pnhfzxusmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhezxrom.exe ups_run
  2⤵
  PID:3096
- - C:\Temp\upmhezxrom.exe
    C:\Temp\upmhezxrom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhezxrom.exe ups_ins
  2⤵
  PID:5792
- - C:\Temp\i_upmhezxrom.exe
    C:\Temp\i_upmhezxrom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwrpjgezwr.exe ups_run
  2⤵
  PID:760
- - C:\Temp\cwrpjgezwr.exe
    C:\Temp\cwrpjgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4580
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwrpjgezwr.exe ups_ins
  2⤵
  PID:6032
- - C:\Temp\i_cwrpjgezwr.exe
    C:\Temp\i_cwrpjgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtromge.exe ups_run
  2⤵
  PID:4792
- - C:\Temp\jdbwtromge.exe
    C:\Temp\jdbwtromge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtromge.exe ups_ins
  2⤵
  PID:2464
- - C:\Temp\i_jdbwtromge.exe
    C:\Temp\i_jdbwtromge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeytrligb.exe ups_run
  2⤵
  PID:5436
- - C:\Temp\jgeytrligb.exe
    C:\Temp\jgeytrligb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeytrligb.exe ups_ins
  2⤵
  PID:4480
- - C:\Temp\i_jgeytrligb.exe
    C:\Temp\i_jgeytrligb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdaysqoig.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\ljdaysqoig.exe
    C:\Temp\ljdaysqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdaysqoig.exe ups_ins
  2⤵
  PID:2236
- - C:\Temp\i_ljdaysqoig.exe
    C:\Temp\i_ljdaysqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicavsqnlf.exe ups_run
  2⤵
  PID:4236
- - C:\Temp\kicavsqnlf.exe
    C:\Temp\kicavsqnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicavsqnlf.exe ups_ins
  2⤵
  PID:6080
- - C:\Temp\i_kicavsqnlf.exe
    C:\Temp\i_kicavsqnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2564

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1608

C:\Temp\dbvtqljdbv.sys
C:\Temp\dbvtqljdbv.sys
1⤵
- Executes dropped EXE
PID:1768

C:\Temp\icavsnlida.sys
C:\Temp\icavsnlida.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\usqkhfzxus.sys
C:\Temp\usqkhfzxus.sys
1⤵
- Executes dropped EXE
PID:4620

C:\Temp\uspkhcausm.sys
C:\Temp\uspkhcausm.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\urpjhbzwrp.sys
C:\Temp\urpjhbzwrp.sys
1⤵
- Executes dropped EXE
PID:4532

C:\Temp\hezwtjhbyw.sys
C:\Temp\hezwtjhbyw.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\romgeytroj.sys
C:\Temp\romgeytroj.sys
1⤵
- Executes dropped EXE
PID:3908

C:\Temp\jgbytqliga.sys
C:\Temp\jgbytqliga.sys
1⤵
- Executes dropped EXE
PID:4152

C:\Temp\fdxvqnlfdy.sys
C:\Temp\fdxvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:2060

C:\Temp\fdavtnlfda.sys
C:\Temp\fdavtnlfda.sys
1⤵
PID:2704

C:\Temp\axsqkicaus.sys
C:\Temp\axsqkicaus.sys
1⤵
PID:3860

C:\Temp\vpnhfzxrpn.sys
C:\Temp\vpnhfzxrpn.sys
1⤵
PID:3356

C:\Temp\mjhfzwuspj.sys
C:\Temp\mjhfzwuspj.sys
1⤵
PID:1068

C:\Temp\kecwuomgec.sys
C:\Temp\kecwuomgec.sys
1⤵
PID:3920

C:\Temp\jebwtrljhe.sys
C:\Temp\jebwtrljhe.sys
1⤵
PID:5712

C:\Temp\lgdbvtromg.sys
C:\Temp\lgdbvtromg.sys
1⤵
PID:2976

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:3412

C:\Temp\sqkidavtnl.sys
C:\Temp\sqkidavtnl.sys
1⤵
PID:3664

C:\Temp\dxsqnifays.sys
C:\Temp\dxsqnifays.sys
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtqljdbv.sys

Path C:\Temp\dbvtqljdbv.sys
Size 141KB
SHA256 c6799fce33780213b170e555815f66dc722bf6c103e4f2651260a58ed2a55364
MD5 0231775c88edb8fc78d6126766c8b97e
SHA1 be719458089cf833517bb8edd1324c4b8df791a2
SHA512 5947e2ab6b3a1d6d01569acef5e788dc331c323dcaa8c0d83af7e588e3769bd38b62091e17965d771c1491748ee20d80c3a88ce8f90aa9e6a32f63c80d50e522
SSDEEP 3072:EsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:EsQmpcF8BzXfwV
TLSH
T1EDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfdavsmkic.exe

Path C:\Temp\hfdavsmkic.exe
Size 230KB
SHA256 af7990c0fe2ee3e387b7411c60659f34ceb25121027dd2e4bab2a3b6e0dbf351
MD5 3ba53a920396ebfa3f8636561cb617b6
SHA1 29c34749691d8f36880add4920edccedfd051000
SHA512 844a3d61fb52c1236a015fb3250e506a5194289650056bf10c98d1897884aed115d608d02408395c06a34cd58a04911d21e107d12e40cebc5d918732fc2d6e1a
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:oghLQ0sQmpcF8BzXfwVfAI
TLSH
T142344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfdavsmkic.exe

Path C:\Temp\i_hfdavsmkic.exe
Size 230KB
SHA256 14db690b15244fea8abeb47071b2034a248bc8622f5bec9982250eaf628a0e7e
MD5 8a8d4ce45f8a7804f1e6d91a7882b718
SHA1 3cd87678d63e41d91519cdae990422edcb4da031
SHA512 809cfc7ea5fa1cacec80d5665840dd018b97bd5cb4fe07acd515d748b328c7605d601ed1a8ab5af7158fae61f42325a6a2cf7eb167bc35a8fd972422ccf3fcbf
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_idavtnlfda.exe

Path C:\Temp\i_idavtnlfda.exe
Size 230KB
SHA256 bd75c2bc8d9af7985790a71a5123e2df89ad2e70a129ab198ed77f0f6fac6206
MD5 9d6c81276d1af465ac63eae025752c49
SHA1 3ea3e6d81f12fe861692529952c1de26148bfed2
SHA512 139f973f162db1bb46f5e54f49ab8db503e38f4f12e7b812c3aab554fa885798395e21c32cb74ffaccff36cc5ff7f792abdcfbca282235c7b78d9c685d0c15e0
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecausmkec.exe

Path C:\Temp\i_kecausmkec.exe
Size 230KB
SHA256 901fa66ba4b78bf5afeb36b30c0455cda4d1f4528ff1db033431e84d946a8dbb
MD5 a3c6999fc034cbb7e9bcb8da51868dd6
SHA1 8dde2809bc4870e898312cd90ca2178f99ddcaad
SHA512 555d5cec3595b5de49c893cd9eb953797c57fbcf459120342af87db225b874004f8505868fb7d1e5e054fcab032a5bcd1d5d570cca78347fbc60d5cc3a02dfc8
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:SghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqoigaytnl.exe

Path C:\Temp\i_vqoigaytnl.exe
Size 230KB
SHA256 fbcc6856461cdd5aba27e71197fe945bcdf2458a34194f60cb21c833be5b489d
MD5 20d85050182e36485fa97b32c28cbdb2
SHA1 3b4fecdee2f90d8382e6b983542ffa9a98a1d277
SHA512 0c8735d8b89b0caea44d9bda218c1bad6420b13b2d79d96b2c2602876adca5084d0f868821ee5e8fe64bbc3eb02c4e913e0217dcc16335d4de9ca6a164aec282
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T19B344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtolgeztrl.exe

Path C:\Temp\i_wtolgeztrl.exe
Size 230KB
SHA256 ca8319cca0e9d765a38533cd21e0947d3b6342f548c3b329cfa33b413c808151
MD5 673df6ead2706e357ded2568c24cefe6
SHA1 9706e6ed58b5ccd422cba676e4af31ac79de8df5
SHA512 d031d108ef8c3178cda4b2c9bb4a3c2428971d0ab361c1e22e97ba6b283a77b062b7c369cf8ea4fa06603ab279c9323989c3e88652ad78fee9f3639b4c7ef7f7
SSDEEP 3072:eLJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9a:eLghLQ0sQmpcF8BzXfwVfAI8
TLSH
T1F2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlida.sys

Path C:\Temp\icavsnlida.sys
Size 141KB
SHA256 c320eeacee40ed4a9088f0de94dd650261b461d8562affa0b14331192626c76f
MD5 69e27b7a0d633b7b8fb1b0d1a3b11a7d
SHA1 4b194b289d0be2aec125e430fb6c44a84db68a06
SHA512 2e4489fe17fc49c6ac2304d785e7490370203ccef8829fbb156e54a6fc0e5c2a95ab4c4767f89efd0a659c3d66f95b1add9f70e0bb72ba979b8c3726e95bca06
SSDEEP 3072:OsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:OsQmpcF8BzXfwV
TLSH
T10CE38D12B2D19172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfda.exe

Path C:\Temp\idavtnlfda.exe
Size 230KB
SHA256 8f88ea5ff998e2860b8355f4d01c4211cdb4356f803b07aa2cc8c2a0cfc6e4c2
MD5 e6f88a2ba809469f79e3a82c50a1a0fa
SHA1 ed79a791ad32a605231e9fd3f075b531a6701699
SHA512 74afb6b388ba5d287225b55a9cd1a0a7a7ff68c93af4c3a07bbd7506b0a562483f3c26a88305eb606e4a067cf2938c7ea2d1b9f9a1b7baee4cbd44673f6ef161
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T14B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecausmkec.exe

Path C:\Temp\kecausmkec.exe
Size 230KB
SHA256 b272423fabac06ad7671ac56a80129fd9e2c2c0249a48fad339d49f0a73fd057
MD5 827e394ad1451389a4a631e3c01b7757
SHA1 0841ca354db5b2d9e00d7499909b28250d3d87a4
SHA512 613cb51fcc59d7877af36c3ffa4fa7bebe83cbe57896e23d842671a06449d9965d0c6736bcc478fcc279a1853aad07481e843bc5df4b7882c0176f3c01342106
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T133344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicausnkfc.sys

Path C:\Temp\kicausnkfc.sys
Size 141KB
SHA256 b144f46d54ea956e3a3da5416bff7b9a6ee6f99c8e237781d9300b399d56bd7a
MD5 47e2736a902fc375c2f1d444f2c29b01
SHA1 9a8fc9b696b8fdcb307e75bb3573c41097fc443f
SHA512 83d4fba7c4660494c6e5c537bd7bf66aff5613bee26c10c8fec4992e644f64d455fdfa7a0b0b94723b104c9178a71655c83903b3ad17a1a64953649de0950a15
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T16EE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkhcausm.sys

Path C:\Temp\uspkhcausm.sys
Size 141KB
SHA256 9ff592c297fe992312694ec6c125011423567de687b61063fc228fdd5eec71bd
MD5 a0786d3ba7eb5e6f373f347f797ee179
SHA1 cfdf57478392048edac101a0f9c1ee4fabe9ae68
SHA512 d513ca6e8c49c9144f5a4fb6414f61af41d61b7708fe4684c51d63f6f1284b0b43fdbbd28c8f00f061758f2a12e5e3708e2dfc33df02da90c09af0d26d1ad02d
SSDEEP 3072:HsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:HsQmpcF8BzXfwV
TLSH
T109E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkhfzxus.sys

Path C:\Temp\usqkhfzxus.sys
Size 141KB
SHA256 b87f0ba20ac359489c25cafc2349783f2450393e9c58f3817ee2ee83beeb1de4
MD5 0af41d3706cd0e19b4bafd717df4b5db
SHA1 e395fb6b56ea213324dd2f1815ff95c16f879188
SHA512 df87a31f6af5a0f5fef77d361d879362659e018a1dc5e4006d4e6f76c9d460eb71d99779563f95bae623874ffb099e0be8968e7443bb4a72aff421c73dd28664
SSDEEP 3072:UsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:UsQmpcF8BzXfwV
TLSH
T125E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaytnl.exe

Path C:\Temp\vqoigaytnl.exe
Size 230KB
SHA256 a40dbb49c63dffa6de1fc9b3e8cf09d7de4879ea7d3c7ee089b81185a7f24d4f
MD5 d0a3e37aab9ebc83edc6b8239586443b
SHA1 a883f15651dfa05d9d2126eb7321438625f60b48
SHA512 b6a4c486428a4debc5a660e87f46c700ecb3761218ad644905e36628b7fa39fe8aded794d17ee564ecf0fd5d735d02fa3f972afe5b1e10f85f8c43e7fab08ac4
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeztrl.exe

Path C:\Temp\wtolgeztrl.exe
Size 230KB
SHA256 d05982da8c33f51b2b4b57eea4f57d3cddbe14fd0b65c4dda1e3af6e02c9c5eb
MD5 7ff11bf8eefac8650414493106188e8f
SHA1 ae35c7539b0eacdd0457510dd094197fd355810c
SHA512 94f0292cb2e32d6efe00dc42c0ed884983e52692e6307d580f89b6aaafbff743ff6f551a143f45bed0fd03a497cc16ca164ef25f815d188a4c7add7124258878
SSDEEP 3072:+JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:+ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausm.exe

Path C:\Temp\xrpkhcausm.exe
Size 230KB
SHA256 b065d8d3de5c36854fd0845a03aeb2f836d3c0b815fada1fed621fdcf64cfbf0
MD5 b3da9fd3d67e954470b2fdc0f9372a67
SHA1 b469f4cf0ddd45c0825899dcc8da5c1f385f87dc
SHA512 bb03a038d7d3733dd25fb4605e76574d54e7c87f1ec0da1fe4e6b8f51903fbe56b760fb7a01dd13b86020ec9ae8dc1cf086905ada9570050d0fac0ee9e5f649b
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

8968d51b-d671-4b5f-9fc5-3dac4151e128.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8968d51b-d671-4b5f-9fc5-3dac4151e128.tmp
Size 12KB
SHA256 38e5ab586a5aa2aee9297e0f2989980158cb18b38a6924dd943ac3725aa6b3a0
MD5 3bacc05dab24f4fd9c33bfe90c616abe
SHA1 c444f78ad352996be84304e1b9730878c605af44
SHA512 9fcd61c6e54bb8f65b37c0845bab7c5273cca7f7a0c09f234006d8309f8fb84ea4051671e323e4a3007d498029b8276142e4a1c0805ba484a366b2c20f38e7dc
SSDEEP 192:sxRuR/CM/fzsGQyzZRYbQzoD8p9t/g6+WNCIXfYCd1uOmGTIgDRgcCJ:sxRu8M/fzsG19qkL/55fbp4
TLSH
T10A42B71A6A28A93B8CC7D61DFA56BF53D6F95032A0941E58E6FC8B1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 455503f5078a41e4798356f1521777eb815d6db2799d64ea8e6b5b9f1b4af2b6
MD5 940eee1a1e35a5623c74a36bfec86aef
SHA1 a11de3fa513985d884c490ee13ccca1c9403c110
SHA512 9b7da13ea246184f43689a416a2cd52fa6217e0ce20b0b2b72303f5951d3dbc9723d293aef71285e4145d7af52e515e34c1d9e28fbf72952566fdbae1328c680
TLSH
T12621DC546B3F5AC1F7AD69B155DBD59A7239A75DCB036FF100D0747CCC077051011650
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1b4f14dba77145144146914fa92d55fc59d4caf51b722f3356930289cb60fb97
MD5 f30ed947d17bb2f061992beb4e5da9a3
SHA1 7a8f4706dfef2d4bb75dd6a1102ed6371e72e768
SHA512 2748057b82b8e425c83d1de4a1c7a19b88be5a1226afbc967d36e0e4f46f25f6e7844ee7fca577df043cf4025d8e5a775ac1f6a1dba0f86f75b7f9a30ad45350
TLSH
T19341CFF7C3F8853E8A0156F0AB146E2BCE2D0914432C7D5A85E4AF2BA3E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 74d7933c37d4cfd026cbfa0bbb336183edb003901f99e4587a449f9dc58ac523
MD5 0cc7e3291c0a9158b0d7733a0371705f
SHA1 ace7ab28e711ba816c12d8ff1c33d0e435440e20
SHA512 822a9c65d15ec18ddb041eaa2ab84887b7fef9d637471e824f1da6fc43d339f596b2f40ecd0673d7d511d9b9c973e8f7e433a4099db6143ae533711e833ae0d1
SSDEEP 192:sxRZR/CM/fzs/QyzZRYbQzoD8p9t/g6+WNCIXfYCd1uOmGTIgVgcCJ:sxRZ8M/fzs/19qkL/55fbpo
TLSH
T19942B81A6E28A93B8CC7D61DFA56BF53D6F95032A0D41E58E7FC8B1C04E66DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 19a16c59f69d30a72f317606f4bd4c4928167f340109584c05358d9cdfd0f53f
MD5 a9e62469a15e04e1b9fb1f3ce10b96c9
SHA1 8b2bbdca53c69c356d46207360e8c8796735f5ce
SHA512 d3bfbda17691e63e8fc1f3f125f5decf8d345ed4819a5c197e3df2b8630081e3256ae1b58daf0a30ceb2ca277681ca2a78205a8fd1f72e81a149ef3f311cc139
SSDEEP 192:sxRuR/CM/fzsGQ+zZRYbQzoD8p9t/g6+WNCIXfYCAXuOmGTIgD7gcCJ:sxRu8M/fzsGN9qkL/55fape
TLSH
T13042B75AAA28693B8CC7D619FA56BF53D3F9503250941F48E7FC8B1C04E66DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7af5c45f286c43c213bcec4a8af928f4c88bde0d4ee8f36bf2dcaeb08f550811
MD5 54d27b59ae6536811624ed2dd8d8134d
SHA1 643e0a4866d13da51466dd4f06b8b63ffcb8e262
SHA512 be5ca56725d8b7be6631eda4041144afebca273cceab9742e16d05ac46e8e79908bf3b3af5491a605c7839e22880dd6333d488a8296766a57ad8e88f9fd0b5fd
SSDEEP 768:jC+vA77pLuLzDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVi50QqcTroZgF:jC+vANEzDQWgQ+f4+u1jaJ50VcgCF
TLSH
T1B9D2EB7B640DCB7F4F804ADDEC197E9B6DA802CB9698CD5047FA841C02C6BEB52194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b91407d46651fc3ffd7d806df22cfb07e20ba5b83d19fc8e1bbeba24f190960c
MD5 30a2904b2fe5251dd9fbfe522a291998
SHA1 4eaaffec12e3e819b5cb8e9a90aeb1814b0720b2
SHA512 0f41301a908050b89dbe2e28a13e331ae34fbcaa5bde79415a3af7e739e0067aea4ba0717160a70daa7aee7c63bd2c2c6771ea5f083640d29fe686b95c61bf91
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHmGmbmqmGmAmomomuWmYmNm1gmmmuK4mbS:CbEBVj5JAdSp9/EgTK7j6dJOHZ2HDxTF
TLSH
T15D910201317B02C17C3EA54C8479C86E86C2B066341AB76B3FA946964F66E479DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cad5706f-5213-430b-a5cf-73018d00e127.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cad5706f-5213-430b-a5cf-73018d00e127.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 785ce5dd90b35c67cbc4a44108402f2ce150d2702ac6f595ee3471685c84acbc
MD5 ba55f791fdc0c87711118a9bf8f13f25
SHA1 bfde0e8f3d0aafd0af5b9c185f369203547841d3
SHA512 e942aa0a8263e6d6a3cb1c162295c576ad6a2e89f98aee9e54590f439cd12a651437d9db65bd210c280e1a8a48b0164c6bafe87c25a1c5c9485e54bc92affb5d
SSDEEP 768:S3IzhL3ZhgDt/Idp8+p3bd66j+4BRv86aLIW4/JRYAd:S3I93nb8+p3Z6n4ykJOAd
TLSH
T15CF29EB2E8A5DD73CCE9D650B2473783BFB410A395C05ED4D4ED6F1E158229E1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 455dde2dc36e0b9a8d2603e2a6eff0ec16f73605a2ebd5c107d3d969cc1da2ff
MD5 1b2b06b875ba6a0d13b21ece7c33f9c9
SHA1 7fb2feafa8ecc8757da581f20672e7dc2684f28d
SHA512 cc9d46eff3e82d653167f106a9715264663ca1f67954a4a04a7f6118a047f79c3deb49e17ef8c022e6cb8796888c74cedbfcd4801617804582c0882826834b21
SSDEEP 768:BFZ3Izhg3Twgph3At/Zp8+p3bd66j+4BRv86aLIW4/JRYAd:Z3Iq3S8+p3Z6n4ykJOAd
TLSH
T1CC1318F294D79977D8AD8783A33D2E429EBCC0A3B4845994B7D95E0CDC821BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 05a9970678bb317e93062ae034d8b5af36ffffa7aef97f750cf043c78f36b66e
MD5 8e0b0deac571299fd381e9e3b3ae35b6
SHA1 0dd1598157b36368b6e88057e5066032ba0fe321
SHA512 85f1192720586ea95ccf16e46e9c977fb18f281defb35a19e8844531cc5789098d8c2b8d0051c2c7cb46ade644d02c46977caea430554f0e97712a5c8db45ff4
SSDEEP 768:/rv+4UNbdD3bGDt/INp8+p3bd66j+4BRv86aLIW4/2bwClW:/bsbp3xL8+p3Z6n4yk0wT
TLSH
T13A03BE72E868ED739CFAC644B1467B837FB811A399C10EC4E4D96B4E005619E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b671b86fdf581809981dbb040d0ef270a11bafd92350533404038f6e5ead4a06
MD5 b68f859eaa7c5f06297fb5ae87d97cb7
SHA1 fae7080dd567b13f2d4591ca7a37f826dad5c043
SHA512 45810a491f54f2384ebc75c4b065385f91e67eddbbca35ede3c24971c424f5c702d47594215d728920d78261bb205f192c67de21de128493c9b3849c887a2023
SSDEEP 768:Irv+4UNbdD3bcDtFNp8+p3bd66j+4BRv86aLIiK2bwCl1:Ibsbp3qL8+p3Z6n4yE0ww
TLSH
T14403CE73F96899339CF6C644B2467A437FF851A396C10EC4E5DD2B4E015A19E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c6fc15439d9bebece6278f390559aa542bdd647a5a1a1fd2a679f49977c5af9
MD5 ef7093eb2577bbff366e7d9f95552656
SHA1 10779ae25283963b80b65d57c31277398f48ba01
SHA512 36c5313e5d1dc87898e9344d0e1c67f1117b0ece853427907dec848e78c2ec33b39c899aa355699660303e0365307a16e3295e70c924c61f0ce3910a53b882b4
SSDEEP 768:Hrv+4UNbdD3ihgDt/ITp8+p3bd66j+4BRv86aLIW4/Px:Hbsbp3yl8+p3Z6n4ykp
TLSH
T136039E72F869ED739CF6D644B1877B837FB820A395C00E94E4E96B4E015619E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dceb8f21263174d31a0cded7c26a8295ec0f9703dc9a4d0d21f015cd83dbb14c
MD5 84f7bd59b7b515a1426234f9ec24e6cb
SHA1 7cc33db96978a49c8f490d0d4ba073e60ee2b1dc
SHA512 0889842cd7d68a7695d78ac2b496a2f2035b787e763fbae12a02dc3660b7de346ec84e096b289e3d77b2c78bc3be42d8954d1896720d537f2dc0b5b2b95921dc
SSDEEP 768:A3IzhL3ehgDt/Idp8+p3bd66j+4BRv86aLIW4/JRYAd:A3I93Gb8+p3Z6n4ykJOAd
TLSH
T1C1F29EB2E8A5DD73CCE9D650B2473783BFB410A395C05ED4D4ED6F1E158229E1B0B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6a6f24bd4f3302879e1ceedad37fbc568191a26d549ee7d2c82a0db19b9b7bc9
MD5 cfcd28c7cd6861a52a10852c465a67cb
SHA1 12f7d88f667e23d9a97463d8018d4735bf0c6c0d
SHA512 ca0dd18b63821fa7605f839222a70d136a2b69fcccee01803e567ee404798b2767068bf5e21141800903ca0d51f8537728ae5c876f6b9bf3b0d58bfb4822ffc7
SSDEEP 768:trv+4UNbdD3kUDt/INp8+p3bd66j+4BRv86aLIT4/2bwCl1:tbsbp3iL8+p3Z6n4yL0ww
TLSH
T13B03BF72E969ED339CF6C644B1467B837FB821A399C10ED4E4D96B4E005619E270F837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

a1af061b-1856-47ce-914f-f69232829d19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a1af061b-1856-47ce-914f-f69232829d19.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe59a02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe59a02e.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4608b91f-284f-474f-9f7e-ac07b1cae102.tmp

Path C:\Users\Admin\AppData\Local\Temp\4608b91f-284f-474f-9f7e-ac07b1cae102.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5408_431385264\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1068-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1068-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1084-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1768-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-621-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2412-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2412-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2976-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3356-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3412-706-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3664-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3860-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3908-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3920-668-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4152-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4152-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4620-505-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5940-555-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5940-549-0x0000000000010000-0x0000000000083000-memory.dmp

Download