systex | 76f32206345d4990bcb87c61bdc791c79f9fc783aa16ef8fd816a27db02813b3

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 10:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260824-mmfdaa11a1
SHA256 76f32206345d4990bcb87c61bdc791c79f9fc783aa16ef8fd816a27db02813b3
MD5 613a05a9512c74a2c5917291d40e76dd
SHA1 c23e258f193dcb7bebb6bdd7e4b45be9cf25f33e
SHA512 a78d8da7dc77c27096b457bda68eb14ef4cac1a2a49d5e3d6f486fcb99ea71a751c2e7477e6c3c045ac0793eb0022f04b8838791b56214a23bf448c8205d9813
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:gghLQ0sQmpcF8BzXfwVfQI
TLSH
T192344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4216	CP.exe
2568	trmjetrlje.exe
1180	CP.exe
4164	CP.exe
2564	i_trmjetrlje.exe
3944	geywqojgby.sys
2808	CP.exe
2952	wtrljdbwto.exe
4908	CP.exe
2916	CP.exe
1716	i_wtrljdbwto.exe
5136	ljdbwtrljd.sys
2900	CP.exe
1336	ywtnljdbvt.exe
5308	CP.exe
1028	CP.exe
1956	i_ywtnljdbvt.exe
3456	bvtnljdbvt.sys
1872	CP.exe
3084	qnlgaysqli.exe
3944	CP.exe
4972	CP.exe
3984	i_qnlgaysqli.exe
1556	ifaysqkida.sys
4728	CP.exe
2008	davsnkifdx.exe
1708	CP.exe
1716	CP.exe
5136	i_davsnkifdx.exe
5360	faxvpnkfdx.sys
2592	CP.exe
248	ifaxspnica.exe
5356	CP.exe
2652	CP.exe
3456	i_ifaxspnica.exe
2192	sqkicausnk.sys
1904	CP.exe
3076	hcarpkhczu.exe
4344	CP.exe
4756	CP.exe
2124	i_hcarpkhczu.exe
2956	ecauspjhfz.sys
972	CP.exe
1444	xrpjhecwus.exe
4476	CP.exe
4588	CP.exe
2444	i_xrpjhecwus.exe
5252	hbzurmkecw.sys
3568	CP.exe
2880	urmkebwuom.exe
4540	CP.exe
2616	CP.exe
5048	i_urmkebwuom.exe
4496	rojgeywuom.sys
3280	CP.exe
5948	omjebztrom.exe
5036	CP.exe
4740	CP.exe
3064	i_omjebztrom.exe
5304	ytrljdbwtr.sys
5692	CP.exe
4952	rljdbvtnlj.exe
5252	CP.exe
1608	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_196710365\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_1235488744\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_2052027755\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_198531119\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_196710365\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_1235488744\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_372596667\_locales\si\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxspnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_keczurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcarpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjetrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkhcaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqgbvtnigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrojgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnkifdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxspnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtnljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcarpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhecwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebztrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkifaxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjetrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkhcaupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keczurpmhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdyvqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2968	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4568	ipconfig.exe
4964	ipconfig.exe
5744	ipconfig.exe
2124	ipconfig.exe
5036	ipconfig.exe
1744	ipconfig.exe
2956	ipconfig.exe
5516	ipconfig.exe
1148	ipconfig.exe
4528	ipconfig.exe
4944	ipconfig.exe
4088	ipconfig.exe
4136	ipconfig.exe
5580	ipconfig.exe
5972	ipconfig.exe
5448	ipconfig.exe
3256	ipconfig.exe
5400	ipconfig.exe
4720	ipconfig.exe
6140	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320412924632878"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{EBC38D11-9D04-4C0C-A818-6ED51E3B0BE7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe
2568	trmjetrlje.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	i_trmjetrlje.exe
Token: SeDebugPrivilege	1716	i_wtrljdbwto.exe
Token: SeDebugPrivilege	1956	i_ywtnljdbvt.exe
Token: SeDebugPrivilege	3984	i_qnlgaysqli.exe
Token: SeDebugPrivilege	5136	i_davsnkifdx.exe
Token: SeDebugPrivilege	3456	i_ifaxspnica.exe
Token: SeDebugPrivilege	2124	i_hcarpkhczu.exe
Token: SeDebugPrivilege	2444	i_xrpjhecwus.exe
Token: SeDebugPrivilege	5048	i_urmkebwuom.exe
Token: SeDebugPrivilege	3064	i_omjebztrom.exe
Token: SeDebugPrivilege	1212	i_rljdbvtnlj.exe
Token: SeDebugPrivilege	1436	i_lfdyvqoiga.exe
Token: SeDebugPrivilege	472	i_avtnlfdxvq.exe
Token: SeDebugPrivilege	4316	i_snkifaxvpn.exe
Token: SeDebugPrivilege	5932	i_smkhcaupnh.exe
Token: SeDebugPrivilege	5744	i_keczurpmhe.exe
Token: SeDebugPrivilege	1596	i_pjhbzurmke.exe
Token: SeDebugPrivilege	2000	i_ezwrojhbzt.exe
Token: SeDebugPrivilege	1564	i_ytrojgbytr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5552 wrote to memory of 4844	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5552 wrote to memory of 4572	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4844 wrote to memory of 3404	4844	iexplore.exe	91
PID 4572 wrote to memory of 2328	4572	iexplore.exe	92
PID 2328 wrote to memory of 5764	2328	msedge.exe	93
PID 2328 wrote to memory of 2968	2328	msedge.exe	94
PID 2328 wrote to memory of 3224	2328	msedge.exe	95
PID 2328 wrote to memory of 3224	2328	msedge.exe	95
PID 2328 wrote to memory of 3224	2328	msedge.exe	95
PID 2328 wrote to memory of 2840	2328	msedge.exe	96
PID 2328 wrote to memory of 2840	2328	msedge.exe	96
PID 2328 wrote to memory of 5628	2328	msedge.exe	98
PID 2328 wrote to memory of 5628	2328	msedge.exe	98
PID 2328 wrote to memory of 5628	2328	msedge.exe	98
PID 2328 wrote to memory of 3236	2328	msedge.exe	99
PID 2328 wrote to memory of 3236	2328	msedge.exe	99
PID 2328 wrote to memory of 3236	2328	msedge.exe	99
PID 2328 wrote to memory of 5536	2328	msedge.exe	100
PID 2328 wrote to memory of 5536	2328	msedge.exe	100
PID 2328 wrote to memory of 5536	2328	msedge.exe	100
PID 2328 wrote to memory of 5832	2328	msedge.exe	101
PID 2328 wrote to memory of 2672	2328	msedge.exe	102
PID 2328 wrote to memory of 5832	2328	msedge.exe	101
PID 2328 wrote to memory of 5832	2328	msedge.exe	101
PID 2328 wrote to memory of 2672	2328	msedge.exe	102
PID 2328 wrote to memory of 2672	2328	msedge.exe	102
PID 2328 wrote to memory of 3392	2328	msedge.exe	103
PID 2328 wrote to memory of 3392	2328	msedge.exe	103
PID 5552 wrote to memory of 4216	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2568 wrote to memory of 1180	2568	trmjetrlje.exe	108
PID 2328 wrote to memory of 4356	2328	msedge.exe	111
PID 2328 wrote to memory of 4356	2328	msedge.exe	111
PID 2328 wrote to memory of 2004	2328	msedge.exe	112
PID 2328 wrote to memory of 2004	2328	msedge.exe	112
PID 2328 wrote to memory of 1556	2328	msedge.exe	114
PID 2328 wrote to memory of 4804	2328	msedge.exe	115
PID 2328 wrote to memory of 4804	2328	msedge.exe	115
PID 2328 wrote to memory of 5212	2328	msedge.exe	116
PID 2328 wrote to memory of 5212	2328	msedge.exe	116
PID 2328 wrote to memory of 2200	2328	msedge.exe	119
PID 2328 wrote to memory of 2200	2328	msedge.exe	119
PID 2328 wrote to memory of 3908	2328	msedge.exe	120
PID 2328 wrote to memory of 3908	2328	msedge.exe	120
PID 5552 wrote to memory of 4164	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 5552 wrote to memory of 2808	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2952 wrote to memory of 4908	2952	wtrljdbwto.exe	127
PID 5552 wrote to memory of 2916	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 5552 wrote to memory of 2900	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 1336 wrote to memory of 5308	1336	ywtnljdbvt.exe	136
PID 5552 wrote to memory of 1028	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 5552 wrote to memory of 1872	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 3084 wrote to memory of 3944	3084	qnlgaysqli.exe	145
PID 5552 wrote to memory of 4972	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 2328 wrote to memory of 3164	2328	msedge.exe	151
PID 2328 wrote to memory of 1436	2328	msedge.exe	152
PID 2328 wrote to memory of 5640	2328	msedge.exe	153
PID 5552 wrote to memory of 4728	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2008 wrote to memory of 1708	2008	davsnkifdx.exe	158
PID 5552 wrote to memory of 1716	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 5552 wrote to memory of 2592	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 248 wrote to memory of 5356	248	ifaxspnica.exe	167
PID 5552 wrote to memory of 2652	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 5552 wrote to memory of 1904	5552	2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 3076 wrote to memory of 4344	3076	hcarpkhczu.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_613a05a9512c74a2c5917291d40e76dd_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:3404
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffba4dfc188,0x7ffba4dfc194,0x7ffba4dfc1a0
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,12694223809535275262,6342075391293073095,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:11
      4⤵
      System Time Discovery
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,3662011331650367106,5876168896961451525,262144 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,11317900724587816793,4801651339450956239,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:2840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,3236269976132707134,12064712835080658939,2097152 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,2305312645051550433,13930236645951682941,2097152 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,8449396083688962336,10199432458478507218,2097152 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,7519202754887218861,15711480120497168150,2097152 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4428,i,15283871906529708564,4924558304268117720,2097152 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:2672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14471047427010429453,17578154959226092339,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:3392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,1551054533426037235,11089216785722073440,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,10156426343571214797,11903623678392733706,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3710571268796186667,8013765733996422886,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,3710571268796186667,8013765733996422886,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,10777415596408641403,12667956907571902754,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,17585611006281785875,1343088366928136626,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,14897069504151779615,16456928066836752398,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,2791478822642202933,10325358212813444334,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:3908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,16697925576166906084,6566478326542935261,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,830119985310374930,16723736861644389940,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,17057864854462893771,14133039131903815420,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7989566426540504755,3241003051272168838,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11050087877065939806,2233054613894331550,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,7590082363853039882,4172661074400127942,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,16439269170517792607,7971127056438686596,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6912,i,8749449578787430803,12602734396655264361,262144 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:10
      4⤵
      PID:4228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,4731553512375670253,18284056106045630900,524288 --field-trial-handle=2388,i,11646876550301564765,12225200585748514706,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjetrlje.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4216
- - C:\Temp\trmjetrlje.exe
    C:\Temp\trmjetrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjetrlje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\i_trmjetrlje.exe
    C:\Temp\i_trmjetrlje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\wtrljdbwto.exe
    C:\Temp\wtrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\i_wtrljdbwto.exe
    C:\Temp\i_wtrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtnljdbvt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2900
- - C:\Temp\ywtnljdbvt.exe
    C:\Temp\ywtnljdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtnljdbvt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1028
- - C:\Temp\i_ywtnljdbvt.exe
    C:\Temp\i_ywtnljdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlgaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\qnlgaysqli.exe
    C:\Temp\qnlgaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlgaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4972
- - C:\Temp\i_qnlgaysqli.exe
    C:\Temp\i_qnlgaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnkifdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4728
- - C:\Temp\davsnkifdx.exe
    C:\Temp\davsnkifdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnkifdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1716
- - C:\Temp\i_davsnkifdx.exe
    C:\Temp\i_davsnkifdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxspnica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\ifaxspnica.exe
    C:\Temp\ifaxspnica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxspnica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2652
- - C:\Temp\i_ifaxspnica.exe
    C:\Temp\i_ifaxspnica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcarpkhczu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1904
- - C:\Temp\hcarpkhczu.exe
    C:\Temp\hcarpkhczu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcarpkhczu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4756
- - C:\Temp\i_hcarpkhczu.exe
    C:\Temp\i_hcarpkhczu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhecwus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:972
- - C:\Temp\xrpjhecwus.exe
    C:\Temp\xrpjhecwus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhecwus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_xrpjhecwus.exe
    C:\Temp\i_xrpjhecwus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkebwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3568
- - C:\Temp\urmkebwuom.exe
    C:\Temp\urmkebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkebwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2616
- - C:\Temp\i_urmkebwuom.exe
    C:\Temp\i_urmkebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omjebztrom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3280
- - C:\Temp\omjebztrom.exe
    C:\Temp\omjebztrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omjebztrom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\i_omjebztrom.exe
    C:\Temp\i_omjebztrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbvtnlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5692
- - C:\Temp\rljdbvtnlj.exe
    C:\Temp\rljdbvtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbvtnlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1608
- - C:\Temp\i_rljdbvtnlj.exe
    C:\Temp\i_rljdbvtnlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdyvqoiga.exe ups_run
  2⤵
  PID:2232
- - C:\Temp\lfdyvqoiga.exe
    C:\Temp\lfdyvqoiga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdyvqoiga.exe ups_ins
  2⤵
  PID:3508
- - C:\Temp\i_lfdyvqoiga.exe
    C:\Temp\i_lfdyvqoiga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  PID:5076
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  PID:4144
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkifaxvpn.exe ups_run
  2⤵
  PID:5048
- - C:\Temp\snkifaxvpn.exe
    C:\Temp\snkifaxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkifaxvpn.exe ups_ins
  2⤵
  PID:2288
- - C:\Temp\i_snkifaxvpn.exe
    C:\Temp\i_snkifaxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkhcaupnh.exe ups_run
  2⤵
  PID:3312
- - C:\Temp\smkhcaupnh.exe
    C:\Temp\smkhcaupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkhcaupnh.exe ups_ins
  2⤵
  PID:4120
- - C:\Temp\i_smkhcaupnh.exe
    C:\Temp\i_smkhcaupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\keczurpmhe.exe ups_run
  2⤵
  PID:3600
- - C:\Temp\keczurpmhe.exe
    C:\Temp\keczurpmhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_keczurpmhe.exe ups_ins
  2⤵
  PID:1276
- - C:\Temp\i_keczurpmhe.exe
    C:\Temp\i_keczurpmhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmke.exe ups_run
  2⤵
  PID:3132
- - C:\Temp\pjhbzurmke.exe
    C:\Temp\pjhbzurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmke.exe ups_ins
  2⤵
  PID:2884
- - C:\Temp\i_pjhbzurmke.exe
    C:\Temp\i_pjhbzurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrojhbzt.exe ups_run
  2⤵
  PID:5516
- - C:\Temp\ezwrojhbzt.exe
    C:\Temp\ezwrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrojhbzt.exe ups_ins
  2⤵
  PID:5972
- - C:\Temp\i_ezwrojhbzt.exe
    C:\Temp\i_ezwrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytrojgbytr.exe ups_run
  2⤵
  PID:4840
- - C:\Temp\ytrojgbytr.exe
    C:\Temp\ytrojgbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytrojgbytr.exe ups_ins
  2⤵
  PID:4212
- - C:\Temp\i_ytrojgbytr.exe
    C:\Temp\i_ytrojgbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqgbvtnigd.exe ups_run
  2⤵
  PID:5556
- - C:\Temp\wqgbvtnigd.exe
    C:\Temp\wqgbvtnigd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5516

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
- Executes dropped EXE
PID:3944

C:\Temp\ljdbwtrljd.sys
C:\Temp\ljdbwtrljd.sys
1⤵
- Executes dropped EXE
PID:5136

C:\Temp\bvtnljdbvt.sys
C:\Temp\bvtnljdbvt.sys
1⤵
- Executes dropped EXE
PID:3456

C:\Temp\ifaysqkida.sys
C:\Temp\ifaysqkida.sys
1⤵
- Executes dropped EXE
PID:1556

C:\Temp\faxvpnkfdx.sys
C:\Temp\faxvpnkfdx.sys
1⤵
- Executes dropped EXE
PID:5360

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:2192

C:\Temp\ecauspjhfz.sys
C:\Temp\ecauspjhfz.sys
1⤵
- Executes dropped EXE
PID:2956

C:\Temp\hbzurmkecw.sys
C:\Temp\hbzurmkecw.sys
1⤵
- Executes dropped EXE
PID:5252

C:\Temp\rojgeywuom.sys
C:\Temp\rojgeywuom.sys
1⤵
- Executes dropped EXE
PID:4496

C:\Temp\ytrljdbwtr.sys
C:\Temp\ytrljdbwtr.sys
1⤵
- Executes dropped EXE
PID:5304

C:\Temp\wqligdywqo.sys
C:\Temp\wqligdywqo.sys
1⤵
PID:3544

C:\Temp\ifdysqniga.sys
C:\Temp\ifdysqniga.sys
1⤵
PID:1476

C:\Temp\vpnkfdxusq.sys
C:\Temp\vpnkfdxusq.sys
1⤵
PID:3636

C:\Temp\fspnhfcxsp.sys
C:\Temp\fspnhfcxsp.sys
1⤵
PID:2608

C:\Temp\pnhfcxupmk.sys
C:\Temp\pnhfcxupmk.sys
1⤵
PID:848

C:\Temp\rmjebzurmj.sys
C:\Temp\rmjebzurmj.sys
1⤵
PID:3036

C:\Temp\ecwuomgebw.sys
C:\Temp\ecwuomgebw.sys
1⤵
PID:4880

C:\Temp\gebomgeywq.sys
C:\Temp\gebomgeywq.sys
1⤵
PID:4968

C:\Temp\ywqoidbytr.sys
C:\Temp\ywqoidbytr.sys
1⤵
PID:4100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnljdbvt.sys

Path C:\Temp\bvtnljdbvt.sys
Size 141KB
SHA256 e530267ddab989894ed1240f6f13590fbf3b4c8b33151422178b289f7d8bda89
MD5 3bb1e61b74d09d125a85ab4780ce45e1
SHA1 fa3a55a32359a4bfe95b70e0d3f216e21a5b7f4d
SHA512 89226d31493345470f79b1759eb7f3842b655f0e1dd3d242f3505e5195212d87d4ae85890b2e8831b51ffcba44011064236fe8ca198c5c7ee63df82b3eedb70b
SSDEEP 3072:RsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:RsQmpcF8BzXfwV
TLSH
T10DE38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

davsnkifdx.exe

Path C:\Temp\davsnkifdx.exe
Size 230KB
SHA256 2f9ffe5cbac568b75bdceec238b7e23ef5b149558f3f3a2efb57b9cc0bcba3ff
MD5 af762402a90a2e6049b22981ac62082a
SHA1 b795144dc4b7891600e08916caccad30212010ef
SHA512 7bde7ad1dbc583802236597c289eaef869723beacb6cc58e8cc1f5d213cb5f298911e94212c68198201bbf658776e060f0d2e708875f10e46af4d9a0fdb1c8f6
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:dghLQ0sQmpcF8BzXfwVfQI
TLSH
T130344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnkfdx.sys

Path C:\Temp\faxvpnkfdx.sys
Size 141KB
SHA256 e46224bf10321095b0d4a8b7deeee69b431bc34aa9b8c04c70886fa33543e4e3
MD5 6252f7fb0c403cd5b989a42622a6011d
SHA1 61973ba737814507c5c462de0ca0663cc8501cc1
SHA512 1dd1442b75df2cbca857c9769071fa25af5d5976e6ae0437e6b391d1b9053dc5e4c371852b20d12256882518a63cdfa86d5c2e7bc81c4eecc60e6515d28aacfc
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T1E4E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgby.sys

Path C:\Temp\geywqojgby.sys
Size 141KB
SHA256 0b7234331f9e721acea95da8512ae95e52fccd663a36d80247be0929b6a6a33c
MD5 5ded4bc136c4156be1b026a5346fae2f
SHA1 e6767dab48c4bc9ec495a8cb30d3e8c020f5c8c8
SHA512 762a2231388fc9b2bc603bf4e8a43e0e733043b2c6bca1c247778ae1bd16641bc7de64dc1a9097985525e7492580b5be55ad7449054cdf6d24cf457e1a02f6ea
SSDEEP 3072:bsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:bsQmpcF8BzXfwV
TLSH
T1B1E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_davsnkifdx.exe

Path C:\Temp\i_davsnkifdx.exe
Size 230KB
SHA256 5a6888f968e4f97c13dae760ed7a94d19f1806741b073c0774bfe6a0573af872
MD5 d3c13ff4be793e2391359e2e0fea385d
SHA1 3a0cfcd391041d1161942867dd4234a98f4fe0f0
SHA512 af90613ca561b23302e5218116898019d4900e7d05505910119dc4bcf67d8e296ee047b9f9b5fb98f1d6899b9625bdb3d0867998fc3ff06be2b5d33cd64ad5bf
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:KghLQ0sQmpcF8BzXfwVfQI
TLSH
T1B5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifaxspnica.exe

Path C:\Temp\i_ifaxspnica.exe
Size 230KB
SHA256 0efcff9b395e17c4ff8e0a0ece63bbc3e2623355586bca9798a23e6ccf79811e
MD5 229f267ca195c9f8683e442f955db0e4
SHA1 f965dfc26fee0dd2ed966c67a349d9256a31b561
SHA512 74802e9f12a1906daaf56d9084f80a5ff931310a3200f0982602a56a350e1f694cbfa15357bbca000ddca4ddd3b5c30dfe4d50bb877d073b82c5eaafef55c501
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:FghLQ0sQmpcF8BzXfwVfQI
TLSH
T1CE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlgaysqli.exe

Path C:\Temp\i_qnlgaysqli.exe
Size 230KB
SHA256 b2c1a0258287818d29d135925f1cf2ffa8ad00843b56f136db19c8b1b73c495d
MD5 bec5c99e89a9416948fd4da32cb5cfe9
SHA1 21fb3eeab66d5ad477c6f0926d7c3bc40fc3f1d0
SHA512 df7afa91044f7365745edc80814a7348f6bfed5e7859590444e0c29f89e35a59f21a96a1c54107870a14305da1aac7f7c3a72dc4dff130294a272140251599f3
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:RghLQ0sQmpcF8BzXfwVfQI
TLSH
T1D0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjetrlje.exe

Path C:\Temp\i_trmjetrlje.exe
Size 230KB
SHA256 f02d867b1d05edffd792637cfa5135be365a4e46da2fb1b211de7efae44d79ca
MD5 e0f6c05db0232939e928b82f02a8a972
SHA1 03e9f7a680548944541dc6b3f832a6052b4df5c6
SHA512 cf8e02e2be1a9bc43a6a8b4dd4a201a580727169bbf809e70793f3dee5fc14cafb756a811141fa91af706839c7e225a0f78608b41c21c9d0136bb0c9359b2287
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:YghLQ0sQmpcF8BzXfwVfQI
TLSH
T11E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljdbwto.exe

Path C:\Temp\i_wtrljdbwto.exe
Size 230KB
SHA256 cd500648bfd609bd6b1898bac2928db020e1978601e7a244318238a572f859f8
MD5 5a10f4c51879119df2e5a60ea5cc219b
SHA1 155badc0f941a1fa03ded9d47769fa8db29a7588
SHA512 6bf060a5ae259cfbf8a881a50ce7b834e565ea7b1136a4be9b7e7c688f2dc9120ae5cc31de2545575acb8806c70d1094aacf5d87196af3a308bcc1424d10b03f
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:MghLQ0sQmpcF8BzXfwVfQI
TLSH
T1D5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywtnljdbvt.exe

Path C:\Temp\i_ywtnljdbvt.exe
Size 230KB
SHA256 55b4a4218eebc162a398b61ad8ed7236eabf04bec940c78884e1547746a4cf76
MD5 4ac3f633a22d03cbaf88039c8a70c7e3
SHA1 9c8944a10939b6882bc21899225b38b0787b76ba
SHA512 f8b9b425c7ac6426863b4cd1cba63a589d55c17403f9fd8f9e9172655aa9a52c4911b4699db54b7ea50a29e6020f14d8743bcb7f606c190cee7ada5f1246a72e
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:kghLQ0sQmpcF8BzXfwVfQI
TLSH
T189344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaxspnica.exe

Path C:\Temp\ifaxspnica.exe
Size 230KB
SHA256 ec44e5a59bfa6646a4af8596dd6f873295f611cbe05c19379f02c9917343f0e4
MD5 f63e7bf18ce0d606cb22e5f5cbce04b8
SHA1 e6695d82ef981dbbdc12f10e84a86a4cf6661385
SHA512 422ce453dd3848dc75ef5be7ca53cca4a50cbc73becaebd847914e7ed20e19c39623ed11e1b9e436b6380bd1a2a8d648a7dc9e0210efba6e8bad483f7c668250
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:KghLQ0sQmpcF8BzXfwVfQI
TLSH
T1C8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifaysqkida.sys

Path C:\Temp\ifaysqkida.sys
Size 141KB
SHA256 f51d887c1aac27a1898fa409b5716adc8f90083519985775e47059d054f554b0
MD5 5432726e2911ab7e4e84390f03abb7a2
SHA1 ab59b5ae0458f3e21957b2250ac6511ef560486c
SHA512 f353e52c9bb89f05841bd659bff5ddbca0d4659f4b136bc20034d9a5646b111c2d36a07a4e91a1e807df7be36dd44c9d503a6a9bcfb11434c0260b7171e20266
SSDEEP 3072:bsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:bsQmpcF8BzXfwV
TLSH
T1C9E38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtrljd.sys

Path C:\Temp\ljdbwtrljd.sys
Size 141KB
SHA256 c22454a59ddec1275687cd1918be5a3ef39e6ad6cc25fd0786b8306fb0846262
MD5 fb6e1e6e7e4c0a05e1e037864a81a717
SHA1 98ed096ef495eba17c751bd36b7390150c66a4f1
SHA512 26caf328d258c037e463d33e21527e67d466c17cb17ef9e7c367352c51e374a117fe32b4ffee4b169d95cbca1cbfc27651c3e3f5c82df261014cac8c24c0f62b
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T1E6E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlgaysqli.exe

Path C:\Temp\qnlgaysqli.exe
Size 230KB
SHA256 6a22cd2b0a813e59e4480be072ba37831c407e2673c395587ba3b38b1d4eb29b
MD5 08b34c038b0004614293aeacf13e85dc
SHA1 13ae13f7fe664f2fdec40bf740e1169a6aeba55d
SHA512 f9f598d43af52f284b8c80f07644413bbb8fd5045a5b8108db61ba8bc263d8128f3bc2ab4ce4c616b617a899080f164c3f6897e7103268732d0db77b37fa4d0e
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:MghLQ0sQmpcF8BzXfwVfQI
TLSH
T11E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjetrlje.exe

Path C:\Temp\trmjetrlje.exe
Size 230KB
SHA256 879e09e490cce1fd547986463f81866f26fef3b3988aec974cd14276092c55e5
MD5 3c7b0baf9867d0bfb170cb55fdefdfb7
SHA1 d4ee5493e3e9d0993138adc7f8bbfa1a0b53d958
SHA512 624d0bc056fef8801cb2514b5f776156a150462894d9adf9bb0bfea566230d6cde469aad9446b429e6d3619e05cb14d6c7be3c2fa10ef07ce351a2741378edb2
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:2ghLQ0sQmpcF8BzXfwVfQI
TLSH
T14C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbwto.exe

Path C:\Temp\wtrljdbwto.exe
Size 230KB
SHA256 ebc6959f801dba7f4b65c83bca9896b5ffd0b37a031aae080ffa563be56d0000
MD5 971d5417c58bc804392c777c6a232e5a
SHA1 47b7918c2c6cf927be5ae550d225f138b543a619
SHA512 88e8a7d7589b641170f0a49583418a8f63b43665973e487648782ae9e77dc1d56cd731439a5f6783d04aee148a318d331619122cbc367492540f80360a2dbe1a
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:oghLQ0sQmpcF8BzXfwVfQI
TLSH
T1B5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtnljdbvt.exe

Path C:\Temp\ywtnljdbvt.exe
Size 230KB
SHA256 58022a81d3c502a014ee95affebf18902715b49c094518c839222bc9b4b4f7ae
MD5 fd1604a0037518b22b07193d749d2768
SHA1 859fd4cac3fde5cf56c1cac5bf2ad52be1caf0b0
SHA512 b9b199daf3370564124f8f9f57190555956c09e6b70be5257988ed52a0f42adfd86b906c3c9c87b1e7054252fcc2194897dc2340a7bd2adba1bdcce711336f10
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:cghLQ0sQmpcF8BzXfwVfQI
TLSH
T1AF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

2345e09b-65a6-4b3c-b1fb-17b9fa865101.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2345e09b-65a6-4b3c-b1fb-17b9fa865101.tmp
Size 29KB
SHA256 540ea376bbe59eeeb735cc3e4f3b76c984f6f15563403bd4283bb3f27efe97fa
MD5 44437e8f8e836af3521a5fe0ee6aad73
SHA1 5448e916de2bf34ef54f2365398471ff8518efd3
SHA512 8b9440125c60bfabc67cbfe91ff98480741f9e9a8018e7e6b472fb1120007019b58699a78eb67033aea6bf0aa6caa96af42bcf246e272c997cb8794208f3a005
SSDEEP 768:K80Ety7pLuLzrwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV59owLWProL2uh:K80EtKEzrwWgNhfVNu1jaW9ogWcL2uh
TLSH
T1DFD2C87B740DCA7E4F800A9DED197E9B6DA802CB96D8C94047FE845C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a1408a62320e1228e2393e7ba94c8dfd4c0e8d26ebc714dd7c429d11e3b92ce0
MD5 a78cf610377792fc1a4e2c02a6158a18
SHA1 948c77f178b10fd7ba763f9224b3e1af5e604127
SHA512 7139d0d115840e33b291762816d05783249bfb7cd726c0e33853874332401d8c7c68c490e9cb0f942e9725a57fb407343c14879826e804b7aba0ba2c69af955f
TLSH
T19D618268232219F1D33885B2D0FE639DF7F49B59C2C72E609590EE701886FD5AAD0573
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5991b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5991b7.TMP
Size 3KB
SHA256 2b1e8d0b4667a00d25294e9f28a6808696f604c31e9186e6d2f84b9661ba1c31
MD5 670833549c69f14c2864cb083f3c221b
SHA1 410027ca0537aeae9620e9a6ad74bd7b96ac568c
SHA512 c49eef2159d2e1433fb736bcd64815d3ba0b56d40af361944733a08c0bc43cf0553d0cf84c0e32db4df13460d08e36df84e1300ec22f78c7dc48e8c603389386
TLSH
T15B618258132219F1D33885B2D0FE639DF7F49B59C2C72E609590ED701886FD5AAD0573
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7ea3457dd24937b87dccbcce2615cad75d150adc27e0c3afebe6f0a66c2b9b1c
MD5 59f3a9473cdb7ee6e6f5354e4d2b5870
SHA1 e1a78dff0981a1cba82d1eaf0805e3aa88bf9cd0
SHA512 0c0737d7df4503c59ac7b7c244630f6ad666e0c6ade67cb71e16f9af9bc2c6ebd2438b1fb944222c7385fba570be09fcbaf5cac8606ccf95b2bd61bf30511744
TLSH
T16A41CFF7C3F8C56E8A0185F0AB14AE1BCE2D0915432C7C5A88E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b34584771496df05c9cb5b9de6538e443edf4355fb8700721ca28ab6bf92e6c4
MD5 fef2728a34f834bc14c1a3dd4daf1c97
SHA1 e4315452caee139c8e9c74447fae7d7b9bb38ffb
SHA512 02b855f411a5b7abb695b5f8e05846a34dd3bfb24f28dfd2370389fb2e2fa928093721351273d88262cb9b3b7e0c3279fa39379b0fdb256f71f5f65fac5d3bb7
SSDEEP 192:sxR6RyCM/fest1LaZQDxzoA8p9a/g6+WNC7ofYZFLxwvGQIgV/nQJ:sxR6jM/fest1LMQDss/5dfS6e
TLSH
T1F042B7166E28A93B8CC7D21DFB25BF53D6F95032A1911E48E6FC8A1C14E76DD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 058dededa6ab3dbe3a76a7eadf838b6d05add3a01dfa2d425ef5726a8f38cd2f
MD5 da87dae403e7cfaecf222116a8966c8d
SHA1 a81edb8c2f101ffe29c530d67c22c77091e33f44
SHA512 ebc8e5c6a73cc76108aa75ae80ea863c61eeb5fece784d3dc3aa85bbf06e6c37ab3f0dfc0f039e28306825214925e18af98eb6e091ce16eb04c2709d652334d4
SSDEEP 192:sxRFRyCM/fesN1PaZQDxzoA8p9a/g6+WNC7ofYZFLV7uvGQIgDY/nQJ:sxRFjM/fesN1PMQDss/5dfSVKv
TLSH
T1E242C7556E28A93B8CC7E20DFB55BF53E2F95032A1D11E08A7FC8A1C14E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 552dfae675063e48da6b8fefe6a972c4b88038188bbce8f7fd79ea4058cee5c9
MD5 26363a8f36725ab7dea0524bf4f75a3c
SHA1 820595d2d7e722f8c547372cc93e01be59bbe90f
SHA512 c2c40cc4585d87fe8dbbc6e7b732ca70adbb1527ff2eb682fa3f19ad40d9aca03d5c8b1a76330aa8e30aff87d3ab04912c8dd6d8bdc97f57a5ea8e4fd2b518e1
SSDEEP 192:sxRFRyCM/fesN1LaZQDxzoA8p9a/g6+WNC7ofYZFLxwvGQIgDC/nQJ:sxRFjM/fesN1LMQDss/5dfS6d
TLSH
T18142B6166E28A93B8CC7D21DFB55BF53E6F95032A1D11E48A6FC8A1C04E77CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2e83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2e83.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 310790cdfcb77184fe885539e4f01eff56bff3e810b7fb6304a01ee69e510a06
MD5 b1723f125fa0c4ea2e201723ac76235f
SHA1 9d2b74577bf90c37645c66059eca98e3848fb92d
SHA512 cf0cf4d9779d4b01c97dba02203db4256807e4f18f841b11f3fcae56bed3cd8478f8142b1409d82baffe86a9526a4a83cd000f93765a0e612a79a12239d86ee2
SSDEEP 768:I03NdsW+LeSFOUvNt1UmX4fouOToPvB2thtA9VAg7fQRM:I03Dssnnwthtt2fQRM
TLSH
T19DF2CF71A8A9CC63DCD9E398B30A76876FF0506358C45F849EEC4B1D0547A9E1B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 32b9267506eecd9401b2a098665f560c76d30b81cd5ca7a251e6ea43226e579b
MD5 733157a997e41dcaec4a562f1c6d780b
SHA1 ac4d12f1b554e84b923ef35da8e8f69eb18ce6ea
SHA512 5fad04bdd4a6429f67d6b7d90f14550a8986a8bce30587479997d60b846d89477816387fcdf4945b91699be1cf8733b0ef388c55dc8aeb43781d047fda946ea4
SSDEEP 768:uFQ23dwgzds3c1OUvNt1USX4fouOToPvB2thtA9VAg7fQRM:F23g4snnwthtt2fQRM
TLSH
T1251317F198DB8937E89D9387A33D6D469EBCC06374885984BBD84E1CCC865BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b46f83172a21f5c9eeb07cec5b35ee22a149cda7cb268e6073e32835c52d30f9
MD5 8f9c61754804e0d80521c9ac9128b33d
SHA1 472731a477a6aa4db314bdb7a11ce0c813c1111b
SHA512 f21f48c7ce1cbca530fe8210291f2771a6aef8c27b7d856fda569985ec6683f386a21640ae529b3c77ee4f9f3f3b3a9ead317fbff4bfbfdf6ab46d7400677cf7
SSDEEP 768:grv+4UNbdH3pk+LeSFOUvNthX4fouOToPvB2thtA9VAw+eVH1SlX:gbsbh3BsnnwthttbEH1Y
TLSH
T18203BF32A8A88A33DCE6D398720B72573FF4911396900FC49EDD1B4D069B9DE030BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 5225c9548f15e0d092b6692f8ae7184a0c09387cc98cb200578285479aafe48f
MD5 2c9922cca9935e78720bcfe85faef6eb
SHA1 57878bc5ac0b38ae6b19875be328e193154157c9
SHA512 e138ad12777a9c822c12dc126b5f2186848af0e1492bda6a8d64b771844f689640a306dd0c82ae932d16c9f5c38d1bf76e3ed6ed84a7679156c20cb9719e56e9
SSDEEP 768:s032dsW+LeSFOUvNt1UmX4fouOToPvB2thtA9VAg7fQRM:s03Assnnwthtt2fQRM
TLSH
T154F2CF71A8A9CC63DCD9D398B30A76876FF0506358C45F84AEDC5B2D0547A9F1B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 fedd1bcf6b370aaef89ceca9652afd8febd0e5900c1700d6c3df42b67d2515c5
MD5 e23279a7364d204fc3f9fb84b5443623
SHA1 43b05e4afb469c372a21b7283938972d220f1eb0
SHA512 6780839bfc8af48d02679335736d58ea2b84c26f679d24dd84ff909e5c1881ee04d0d3b4905a96373fed1e63e58d4d2f72542ee4d5eaeceb8b93e2ff048a671b
SSDEEP 768:Qrv+4UNbdH32dsW+LeSFOUvNt1UqX4fouOToPvB2thtA9VAg7fQv:Qbsbh3Awsnnwthtt2fQv
TLSH
T1D803BF31A8ACDD33DDE9D298B20A76973FF0106358C10F849ED95B5D054B99E2B0FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 277353924c53e2a0052a34becab6eba268f679d18ae69393be030a42a0a7a118
MD5 e2fa16fbd04435163c1da66cc3a93b51
SHA1 3b17df5c700d499f73f818ccbaed4ad4c774c408
SHA512 a18b5b24fba637205890909b9e7ecaa0ba75720512499671b6a5a0090cf00e6723c4392cf0bbd8d14ed3a7e20316de0ee2f10a1b9f1af2641a1a7a17cf6391de
SSDEEP 768:Drv+4UNbdH3Kr+LeSFOUvNt1UyX4fouOToPvB2thtA9VAB7eVH1SlX:Dbsbh3uYsnnwthttNEH1Y
TLSH
T1F703BE32A4AC8D33DDE6E298710B72973FF4516398800F84DED91B4D064BA9E1B0FD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fcf4accb77768db3c22a2eda121ffbd2d685652b998f4500f848d7e8a2875f5a
MD5 b82abfbfb8efb102ee841fe6e691eac9
SHA1 8498536cb01ec37c3a003a30d19cbdfb8d085540
SHA512 24955bcad91db30f17b92847a9bf0527c74e97bbfaa6898b94ec42610165a542edf6ac30515d2346c5f7dc61c1ff3d3aa4e6c20bb82d2a4e245f89d95d29cacf
SSDEEP 768:mrv+4UNbdH3jdx+LeSFOUvNt1UyX4fouOToPvB2thtA9VAg7eVH1Slo:mbsbh3JYsnnwthtt2EH1b
TLSH
T14303BE32A4AC8D33DDE6E298720B72972FF4516398800F84DED91B5D064B69E1B0FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

85f13e93-7903-4a87-8c47-ae4783de996e.tmp

Path C:\Users\Admin\AppData\Local\Temp\85f13e93-7903-4a87-8c47-ae4783de996e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2328_53519162\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1476-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1556-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2192-552-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2608-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2956-556-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3036-704-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3456-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-646-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-625-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3636-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3944-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4100-729-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4496-605-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4496-575-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4880-708-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4968-725-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5136-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5252-571-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5304-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5360-526-0x0000000000010000-0x0000000000083000-memory.dmp

Download