systex | 092fa1de380506afd5b6503a4b3c94a6db5c3c251b111513da8955f056f24927

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260507-c1fabsas2k
SHA256 092fa1de380506afd5b6503a4b3c94a6db5c3c251b111513da8955f056f24927
MD5 ec291dd55e45043bad43569284ce0c39
SHA1 e451f2fb4565e7afde6793293b5ed2c0a6a5f843
SHA512 3771f402e442ba0b2c06a9295727f96a14c89ca3ccc79b871da97e0757d1d5b3a4ed437e71d7b348936c436d1cf26f9ef5e103043efc2d2492434d12b59fb048
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T19C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5924	CP.exe
136	pkicxvpnia.exe
3724	CP.exe
5928	CP.exe
2176	i_pkicxvpnia.exe
2576	kfdxvpnica.sys
2628	CP.exe
4384	usqkicausm.exe
5824	CP.exe
4484	CP.exe
5280	i_usqkicausm.exe
4100	khfzxspkec.sys
6128	CP.exe
5148	zxrpkhczus.exe
2844	CP.exe
5416	CP.exe
4900	i_zxrpkhczus.exe
2904	xrmkecwuom.sys
3728	CP.exe
3964	jeczurmkez.exe
5408	CP.exe
3056	CP.exe
2044	i_jeczurmkez.exe
3876	jhbwurmjhb.sys
3820	CP.exe
4872	omhbzwrpjh.exe
1100	CP.exe
5000	CP.exe
5168	i_omhbzwrpjh.exe
4300	rojhbztrlj.sys
1472	CP.exe
5116	geywrobwro.exe
4016	CP.exe
3180	CP.exe
4572	i_geywrobwro.exe
3864	trljdbvtol.sys
5048	CP.exe
792	igbytoljeb.exe
1048	CP.exe
692	CP.exe
5056	i_igbytoljeb.exe
5208	gaysqlidav.sys
1060	CP.exe
5916	tqlidavtnl.exe
1088	CP.exe
1080	CP.exe
1104	i_tqlidavtnl.exe
5680	ysidxvqnif.sys
2968	CP.exe
2332	xvpnifdxvq.exe
468	CP.exe
3060	CP.exe
1316	i_xvpnifdxvq.exe
5972	vsnlfdxvpn.sys
2712	CP.exe
5456	avpnhfzxsp.exe
2660	CP.exe
1712	CP.exe
1008	i_avpnhfzxsp.exe
3096	xupnhfzusm.sys
980	CP.exe
3192	kecxrpkhca.exe
4300	CP.exe
2324	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_93192074\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_438715605\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_93192074\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\kn\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_438715605\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_438715605\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_93192074\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_566080694\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_988293687\page_embed_script.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxsmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicxvpnia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeczurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljgbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytoljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljgbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrobwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicxvpnia.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrobwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeczurmkez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytoljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhbzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhbzwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecxrpkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaxs.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5052	ipconfig.exe
3912	ipconfig.exe
4596	ipconfig.exe
4404	ipconfig.exe
5424	ipconfig.exe
4848	ipconfig.exe
2100	ipconfig.exe
4224	ipconfig.exe
4088	ipconfig.exe
3864	ipconfig.exe
1640	ipconfig.exe
6032	ipconfig.exe
3224	ipconfig.exe
2496	ipconfig.exe
5628	ipconfig.exe
2940	ipconfig.exe
5540	ipconfig.exe
4480	ipconfig.exe
3664	ipconfig.exe
652	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "697662374"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31251922"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134225947478763615"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{33B36D3C-979E-442D-B702-3DD6EBDE833F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe
136	pkicxvpnia.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe
4912	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2176	i_pkicxvpnia.exe
Token: SeDebugPrivilege	5280	i_usqkicausm.exe
Token: SeDebugPrivilege	4900	i_zxrpkhczus.exe
Token: SeDebugPrivilege	2044	i_jeczurmkez.exe
Token: SeDebugPrivilege	5168	i_omhbzwrpjh.exe
Token: SeDebugPrivilege	4572	i_geywrobwro.exe
Token: SeDebugPrivilege	5056	i_igbytoljeb.exe
Token: SeDebugPrivilege	1104	i_tqlidavtnl.exe
Token: SeDebugPrivilege	1316	i_xvpnifdxvq.exe
Token: SeDebugPrivilege	1008	i_avpnhfzxsp.exe
Token: SeDebugPrivilege	4900	i_kecxrpkhca.exe
Token: SeDebugPrivilege	6036	i_rpjhbzurmk.exe
Token: SeDebugPrivilege	3460	i_hcwuomgecw.exe
Token: SeDebugPrivilege	5512	i_qljgbwuomg.exe
Token: SeDebugPrivilege	3344	i_dbvtrljdbv.exe
Token: SeDebugPrivilege	3816	i_igaytqlfdb.exe
Token: SeDebugPrivilege	2684	i_qnigaysqki.exe
Token: SeDebugPrivilege	2808	i_axspkicaxs.exe
Token: SeDebugPrivilege	5876	i_snhfzxspki.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4764	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 4720 wrote to memory of 4220	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 4764 wrote to memory of 4912	4764	iexplore.exe	81
PID 4220 wrote to memory of 4924	4220	iexplore.exe	82
PID 4912 wrote to memory of 2268	4912	msedge.exe	83
PID 4912 wrote to memory of 6020	4912	msedge.exe	84
PID 4912 wrote to memory of 2024	4912	msedge.exe	85
PID 4912 wrote to memory of 6020	4912	msedge.exe	84
PID 4912 wrote to memory of 6020	4912	msedge.exe	84
PID 4912 wrote to memory of 5492	4912	msedge.exe	87
PID 4912 wrote to memory of 5492	4912	msedge.exe	87
PID 4912 wrote to memory of 2120	4912	msedge.exe	88
PID 4912 wrote to memory of 3436	4912	msedge.exe	89
PID 4912 wrote to memory of 2120	4912	msedge.exe	88
PID 4912 wrote to memory of 2120	4912	msedge.exe	88
PID 4912 wrote to memory of 3436	4912	msedge.exe	89
PID 4912 wrote to memory of 3436	4912	msedge.exe	89
PID 4912 wrote to memory of 3480	4912	msedge.exe	90
PID 4912 wrote to memory of 3480	4912	msedge.exe	90
PID 4912 wrote to memory of 3480	4912	msedge.exe	90
PID 4912 wrote to memory of 4036	4912	msedge.exe	92
PID 4912 wrote to memory of 4036	4912	msedge.exe	92
PID 4912 wrote to memory of 4036	4912	msedge.exe	92
PID 4912 wrote to memory of 1492	4912	msedge.exe	93
PID 4912 wrote to memory of 1492	4912	msedge.exe	93
PID 4912 wrote to memory of 1492	4912	msedge.exe	93
PID 4720 wrote to memory of 5924	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	94
PID 136 wrote to memory of 3724	136	pkicxvpnia.exe	97
PID 4720 wrote to memory of 5928	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 4912 wrote to memory of 2012	4912	msedge.exe	102
PID 4912 wrote to memory of 2012	4912	msedge.exe	102
PID 4912 wrote to memory of 3068	4912	msedge.exe	103
PID 4912 wrote to memory of 3068	4912	msedge.exe	103
PID 4912 wrote to memory of 6040	4912	msedge.exe	104
PID 4912 wrote to memory of 2180	4912	msedge.exe	106
PID 6040 wrote to memory of 1584	6040	msedge.exe	107
PID 4720 wrote to memory of 2628	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 4384 wrote to memory of 5824	4384	usqkicausm.exe	114
PID 4720 wrote to memory of 4484	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 4720 wrote to memory of 6128	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 5148 wrote to memory of 2844	5148	zxrpkhczus.exe	123
PID 4720 wrote to memory of 5416	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 4720 wrote to memory of 3728	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 3964 wrote to memory of 5408	3964	jeczurmkez.exe	132
PID 4720 wrote to memory of 3056	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4912 wrote to memory of 5976	4912	msedge.exe	137
PID 4912 wrote to memory of 3144	4912	msedge.exe	138
PID 4912 wrote to memory of 1048	4912	msedge.exe	139
PID 4912 wrote to memory of 5616	4912	msedge.exe	140
PID 4912 wrote to memory of 5616	4912	msedge.exe	140
PID 4912 wrote to memory of 1624	4912	msedge.exe	143
PID 4912 wrote to memory of 1624	4912	msedge.exe	143
PID 4720 wrote to memory of 3820	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 4872 wrote to memory of 1100	4872	omhbzwrpjh.exe	146
PID 4720 wrote to memory of 5000	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 4720 wrote to memory of 1472	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 5116 wrote to memory of 4016	5116	geywrobwro.exe	155
PID 4720 wrote to memory of 3180	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4720 wrote to memory of 5048	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 792 wrote to memory of 1048	792	igbytoljeb.exe	164
PID 4720 wrote to memory of 692	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4720 wrote to memory of 1060	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 5916 wrote to memory of 1088	5916	tqlidavtnl.exe	173
PID 4720 wrote to memory of 1080	4720	2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_ec291dd55e45043bad43569284ce0c39_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ff9bae4c188,0x7ff9bae4c194,0x7ff9bae4c1a0
      4⤵
      PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,9597692205176565445,16050591643355015513,262144 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,7092497101196269995,12859174724306855253,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      System Time Discovery
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,12615381937302620109,9354006699277654586,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:13
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,14957297790410562384,11344000370119439652,2097152 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17937059669998095637,1640785376031144203,2097152 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,4441206788346370980,6919565263499689453,2097152 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:3480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5008,i,6622015054443359616,2037821796747760839,2097152 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,9115476229999774856,559479628909768510,2097152 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:1492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,18421895967326741281,4437243967176400435,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16263842538172107058,8979929838932613147,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,14954813979721147284,12837806617097628505,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7427509826460302880,10592340827323339031,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,7427509826460302880,10592340827323339031,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,16122422948718544448,17539194950633443226,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,2982497811006960041,8689012832922761071,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:3144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,9756605124224175118,8392639023037544816,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,8245240341511527297,1764177333676238133,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:5616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,17540400654325144864,5410525845544829473,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:1624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,998122640914193755,7094400705282824529,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,8109504582771639919,10266918471442320820,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,2905957823702785092,9672739505908275512,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5424,i,14586663943422326544,11092703800538616923,262144 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:10
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,6039579147128868602,17146162260664692288,524288 --field-trial-handle=2132,i,12113183792456674019,5673309343041739433,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:5572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicxvpnia.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5924
- - C:\Temp\pkicxvpnia.exe
    C:\Temp\pkicxvpnia.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicxvpnia.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5928
- - C:\Temp\i_pkicxvpnia.exe
    C:\Temp\i_pkicxvpnia.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkicausm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2628
- - C:\Temp\usqkicausm.exe
    C:\Temp\usqkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkicausm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4484
- - C:\Temp\i_usqkicausm.exe
    C:\Temp\i_usqkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6128
- - C:\Temp\zxrpkhczus.exe
    C:\Temp\zxrpkhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5416
- - C:\Temp\i_zxrpkhczus.exe
    C:\Temp\i_zxrpkhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeczurmkez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3728
- - C:\Temp\jeczurmkez.exe
    C:\Temp\jeczurmkez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeczurmkez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\i_jeczurmkez.exe
    C:\Temp\i_jeczurmkez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhbzwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3820
- - C:\Temp\omhbzwrpjh.exe
    C:\Temp\omhbzwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhbzwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Temp\i_omhbzwrpjh.exe
    C:\Temp\i_omhbzwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrobwro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1472
- - C:\Temp\geywrobwro.exe
    C:\Temp\geywrobwro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrobwro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3180
- - C:\Temp\i_geywrobwro.exe
    C:\Temp\i_geywrobwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytoljeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5048
- - C:\Temp\igbytoljeb.exe
    C:\Temp\igbytoljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytoljeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:692
- - C:\Temp\i_igbytoljeb.exe
    C:\Temp\i_igbytoljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqlidavtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1060
- - C:\Temp\tqlidavtnl.exe
    C:\Temp\tqlidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqlidavtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1080
- - C:\Temp\i_tqlidavtnl.exe
    C:\Temp\i_tqlidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnifdxvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\xvpnifdxvq.exe
    C:\Temp\xvpnifdxvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnifdxvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3060
- - C:\Temp\i_xvpnifdxvq.exe
    C:\Temp\i_xvpnifdxvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2712
- - C:\Temp\avpnhfzxsp.exe
    C:\Temp\avpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\i_avpnhfzxsp.exe
    C:\Temp\i_avpnhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecxrpkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:980
- - C:\Temp\kecxrpkhca.exe
    C:\Temp\kecxrpkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecxrpkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Temp\i_kecxrpkhca.exe
    C:\Temp\i_kecxrpkhca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhbzurmk.exe ups_run
  2⤵
  PID:4112
- - C:\Temp\rpjhbzurmk.exe
    C:\Temp\rpjhbzurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhbzurmk.exe ups_ins
  2⤵
  PID:5072
- - C:\Temp\i_rpjhbzurmk.exe
    C:\Temp\i_rpjhbzurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcwuomgecw.exe ups_run
  2⤵
  PID:2800
- - C:\Temp\hcwuomgecw.exe
    C:\Temp\hcwuomgecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcwuomgecw.exe ups_ins
  2⤵
  PID:2224
- - C:\Temp\i_hcwuomgecw.exe
    C:\Temp\i_hcwuomgecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljgbwuomg.exe ups_run
  2⤵
  PID:5680
- - C:\Temp\qljgbwuomg.exe
    C:\Temp\qljgbwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljgbwuomg.exe ups_ins
  2⤵
  PID:3540
- - C:\Temp\i_qljgbwuomg.exe
    C:\Temp\i_qljgbwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtrljdbv.exe ups_run
  2⤵
  PID:5412
- - C:\Temp\dbvtrljdbv.exe
    C:\Temp\dbvtrljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtrljdbv.exe ups_ins
  2⤵
  PID:5112
- - C:\Temp\i_dbvtrljdbv.exe
    C:\Temp\i_dbvtrljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaytqlfdb.exe ups_run
  2⤵
  PID:4812
- - C:\Temp\igaytqlfdb.exe
    C:\Temp\igaytqlfdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaytqlfdb.exe ups_ins
  2⤵
  PID:2656
- - C:\Temp\i_igaytqlfdb.exe
    C:\Temp\i_igaytqlfdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  PID:6004
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  PID:2936
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicaxs.exe ups_run
  2⤵
  PID:3908
- - C:\Temp\axspkicaxs.exe
    C:\Temp\axspkicaxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicaxs.exe ups_ins
  2⤵
  PID:5660
- - C:\Temp\i_axspkicaxs.exe
    C:\Temp\i_axspkicaxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snhfzxspki.exe ups_run
  2⤵
  PID:2060
- - C:\Temp\snhfzxspki.exe
    C:\Temp\snhfzxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snhfzxspki.exe ups_ins
  2⤵
  PID:1944
- - C:\Temp\i_snhfzxspki.exe
    C:\Temp\i_snhfzxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxsmkecwup.exe ups_run
  2⤵
  PID:2580
- - C:\Temp\cxsmkecwup.exe
    C:\Temp\cxsmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:424

C:\Temp\kfdxvpnica.sys
C:\Temp\kfdxvpnica.sys
1⤵
- Executes dropped EXE
PID:2576

C:\Temp\khfzxspkec.sys
C:\Temp\khfzxspkec.sys
1⤵
- Executes dropped EXE
PID:4100

C:\Temp\xrmkecwuom.sys
C:\Temp\xrmkecwuom.sys
1⤵
- Executes dropped EXE
PID:2904

C:\Temp\jhbwurmjhb.sys
C:\Temp\jhbwurmjhb.sys
1⤵
- Executes dropped EXE
PID:3876

C:\Temp\rojhbztrlj.sys
C:\Temp\rojhbztrlj.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:3864

C:\Temp\gaysqlidav.sys
C:\Temp\gaysqlidav.sys
1⤵
- Executes dropped EXE
PID:5208

C:\Temp\ysidxvqnif.sys
C:\Temp\ysidxvqnif.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\vsnlfdxvpn.sys
C:\Temp\vsnlfdxvpn.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\xupnhfzusm.sys
C:\Temp\xupnhfzusm.sys
1⤵
- Executes dropped EXE
PID:3096

C:\Temp\cwusmhfzxr.sys
C:\Temp\cwusmhfzxr.sys
1⤵
PID:1436

C:\Temp\rmjecwuomh.sys
C:\Temp\rmjecwuomh.sys
1⤵
PID:4292

C:\Temp\jebztrmjec.sys
C:\Temp\jebztrmjec.sys
1⤵
PID:3316

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
PID:1316

C:\Temp\vtnigaytql.sys
C:\Temp\vtnigaytql.sys
1⤵
PID:3752

C:\Temp\dyvqnigays.sys
C:\Temp\dyvqnigays.sys
1⤵
PID:5688

C:\Temp\ysqkidavpn.sys
C:\Temp\ysqkidavpn.sys
1⤵
PID:1676

C:\Temp\caupnhfzxs.sys
C:\Temp\caupnhfzxs.sys
1⤵
PID:2748

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
PID:2940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrobwro.exe

Path C:\Temp\geywrobwro.exe
Size 230KB
SHA256 b1761bc6fb2e131b64edeab6730f6bd4bd4c58c7dcaa106d8127e649b4168dec
MD5 1b96592e795640d90e99c401df4c703e
SHA1 5b761261d994019a27a3960aa68993a3bb7e7f3c
SHA512 e33cef44cfd95f5e6680df373a698c65e8db309e884be33f018b845f0d423149974e66bcd2387919430d361c74846aa60c4ae84100a494cfc8b6ee56fea773ed
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrobwro.exe

Path C:\Temp\i_geywrobwro.exe
Size 230KB
SHA256 30be8a8cc5c716f1ec22c23692a2624957723969b3acd034a09529c74f877f26
MD5 ed25701e3bd6a9d0cddc9ed3e1955cf6
SHA1 be0e0ed65b5667ff740d7c247974ceaeac87eb38
SHA512 dde317ee8740af26b33845b8b3c93cd92014b427644f1511e54a801033b5a1193519477c285882a7e415ac8c35c6e5f30aff25c1c781488ca2ad311795d2fc62
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T152344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jeczurmkez.exe

Path C:\Temp\i_jeczurmkez.exe
Size 230KB
SHA256 2fa7cf2543fa0c8b1c4e11da5898e888c20ce89f54ff28c6d2a1eff5ea13dd79
MD5 1555428337e37a07c72e5c35a3c4b78b
SHA1 e1bba26deec7625bfd8227fd94e7d809dde580c6
SHA512 20203b18597a6073159d7751f3d4e7a1c25bd38090f13b564989fc8d8f0051bb95c674035b90e09ab58944dddd71d9f9b0aeb589561187c550f541ef5c253544
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omhbzwrpjh.exe

Path C:\Temp\i_omhbzwrpjh.exe
Size 230KB
SHA256 0519d9eec810436e14951aa45cbcb59a34f625ad819e55d7fc5b7f242316e7e2
MD5 7212591e5b8688ad6734ff26fa1ce97f
SHA1 122bbfcde939c99149d13bb476a9a2f7b0d70b24
SHA512 a7a72490cfd6f159c4c5545a4871912c818ceb9e4161607bc08513aa21aeebf508719d17cd0fe7c357485954da560bdae336e21299558615bebeb3329a06044d
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T18A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicxvpnia.exe

Path C:\Temp\i_pkicxvpnia.exe
Size 230KB
SHA256 49dcaec090e96a17c9092a3f58c064048bf6875f6390f40fd81215632b750057
MD5 54a4d2165daae7901bd87de9999edef4
SHA1 298b7e39e45b1ab4038a8d6c9848d03194e2e576
SHA512 7164a94616fd4d81bd42102f1f9844838df5b687c43c87a240d2cd22b4c43608efafcac4c162cbfa403fddad0699e8097fe6e74cdd055df8816916a1d8ea5520
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T114344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usqkicausm.exe

Path C:\Temp\i_usqkicausm.exe
Size 230KB
SHA256 5806bc2f5779c28890a02cbd767546cde70067354c4a30cce0d187b2e8e11438
MD5 fda125842160eab77b6a5348f2f81fa3
SHA1 fc520a76aa20ed7d7b664612e7b0d603348da1e7
SHA512 7dac501bc2e636f6d060ce282b6a506863958f21f7fb9d074887f0ce7b803c0f80a42e9a55628d3000cb3bfdbd6ff3c07809c89b407ce07519abb282133d0ae3
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpkhczus.exe

Path C:\Temp\i_zxrpkhczus.exe
Size 230KB
SHA256 94c8427cf970d279ea0583a13880f6ae65e95325d666a70fafa867ac8548ddd3
MD5 bedf1b41c1e537af5b596ae5d4b10b18
SHA1 4bbdaf0a6ffb3fb302ab833608bb26c6ea4b1ad0
SHA512 9419c75ea5d01729aad897928b4370df501cb5b15f3b443dc2aabf0d28bb869a8899e849170fd6790447add570eb0283771732fb5960675e6517f0e0243e8ced
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T103344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jeczurmkez.exe

Path C:\Temp\jeczurmkez.exe
Size 230KB
SHA256 86b71b96b9efdab39f00989012af2be4609a77d45bf33fd52b885d487df80bfd
MD5 1eb29c91eb50f652a957e606f16bac7b
SHA1 d8a6637cb3a9af394baba814f0295c369d51ab64
SHA512 b5b8706df34084aa6ca0fbbdc51f6f98724dc007d9c42e5a65efdbfa89f930ffba6e37a73fa00f1fc518d91407899397b0302588a9092e565608abd5b8ee144c
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T12F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbwurmjhb.sys

Path C:\Temp\jhbwurmjhb.sys
Size 141KB
SHA256 b892d66b7c192bf644277875e2083904c0c66d863da2076f684d50fc196d961a
MD5 6fe4b93fea5a8bcd067f38658155e38a
SHA1 69d3a338808edcef4ffab7e4c5311ed7719d1b77
SHA512 711c82b50e4bcd040d6be3141b27c18688dc771734991cf588e04359ab7509ac92aea660d9d1ce12a67ac4c55fac7cbed2879c37ee0ec5e64954ac26817e566e
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T106E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxvpnica.sys

Path C:\Temp\kfdxvpnica.sys
Size 141KB
SHA256 048a4b0bee644dcb79cbf74f597daf9e5464dbd301b70c2af1b3054dbf21c182
MD5 666fb86ff068cf898764295a080adbc1
SHA1 36b97b5983bebeced3816e6853285f0bf5e614b6
SHA512 710721bf2012e3c4f951098ab8952f3ff0756c00c2f8b117aebd3a2c86833ff848062bf0745b91bcc24d5f575009ba97bcf67453d4cb76dad737637b0d3da208
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T112E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khfzxspkec.sys

Path C:\Temp\khfzxspkec.sys
Size 141KB
SHA256 834321cc7953e4eb2fcb9dd3fae808a49b6ed68725e4760c5e63ee5ccfdc9b39
MD5 269726ea2667cb8dfed3f2ce4ac37c36
SHA1 19d67bbeae23ef02798b6b1fa275b7f25f9c7970
SHA512 05e0b23a71b4487d4a0f30c614886d144f39078dceff985dd417a21ad55cbd9ff64c06838fb86ca25778184de58a60a953708d50d5d60b7aa38e56208b82c135
SSDEEP 3072:QsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:QsQmpcF8BzXfwV
TLSH
T165E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhbzwrpjh.exe

Path C:\Temp\omhbzwrpjh.exe
Size 230KB
SHA256 9ee55c3bda3fb0022b989521e67af8864b393c08b4ae9322901522ef1c5fec0b
MD5 a5b085dad12db5ae134ee15cf56ae8dc
SHA1 3fcae1fd22ef66683c43cff1b1b64f9fc78201b2
SHA512 035ffe114afea51b3a7b6ffbc130c792e55cabe6ec4e0f202bdd4d97d2be49eabeebaf868fe8374973a53668bea636df02dbda241070544514b1a895a69a155e
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicxvpnia.exe

Path C:\Temp\pkicxvpnia.exe
Size 230KB
SHA256 ff668ec14096617c24a42eaccd14448a860713d6b1c5ab02f2cee872ec5a296b
MD5 892bdfe9acbe81ba8ce7f4230ce6e7b8
SHA1 932f4cfc538b1a31060898eeda21af88f76bae18
SHA512 47118889bb39a0b2318d82a4af7e9765dc81ff70899f448284bf4a40d7bb4bed1855c4611c6690478bb294d8cc174efacbe702c3d3f2ed571d6b4d6dc75e61e1
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T13C344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.sys

Path C:\Temp\rojhbztrlj.sys
Size 141KB
SHA256 baf1d92d7a5a2a771411c6b5840854ad4dcff760576cf61a716cd8eb910898a3
MD5 a781c746e7aae73b5f917de835a982f9
SHA1 0babcb23b378104a658e0e350eddd6707085e3f7
SHA512 c6ee5094e7058c50c9beff049f8d7764e12c2358cff44758256a47b0a15775a1f7f09928726e65d292008e3c132e341bc377075272ab1948770d46bf66195bb1
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T1D4E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usqkicausm.exe

Path C:\Temp\usqkicausm.exe
Size 230KB
SHA256 29dac4da3840a362b230dff816aac593eb095523002d3af8a6405c2afcf7c4ee
MD5 c5822860d4f329cd4a9ed67bb567f1d5
SHA1 787985081fdb7df2992fac239ab0bc892d693074
SHA512 790f021c3aed76629ba2f81a25a7df34bf0fc896c643a4d972c52b947be096f9bb54eaa4308607f4bdccdf3e659a0d9f0edf638fc858e93de3cee57dc61508c2
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T10C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrmkecwuom.sys

Path C:\Temp\xrmkecwuom.sys
Size 141KB
SHA256 5ecd19a8716831cb0200de4cf0c017da8cb92f3db7e2d89db4649f21b80269d5
MD5 bc0a71fde84a267e777598f270c43f35
SHA1 53bb85f6a29959306eca7f64ddd6bc12185c9ba9
SHA512 aa8b6aab97b093590d21bbd33d75fc32091b23c99fcdb93e2f05947f375fb3d8c132ecf848187c33f11aa256185727e98650ad42e98011bd4d5aa39a185a4f9a
SSDEEP 3072:isQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:isQmpcF8BzXfwV
TLSH
T1E5E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhczus.exe

Path C:\Temp\zxrpkhczus.exe
Size 230KB
SHA256 0750711cc42bdfe432560d5d9454ce54001e299db6c41ad05ef67fdb3d6b7eae
MD5 70caf1e440b9c0a6751ee91d1078d045
SHA1 4b8616c38f48ea8dc148fcb01a05928ba4c62516
SHA512 32838e877b33b52f8bd92dbce6f4a43b274b56f7e661ad9bff12ac45d44c7d3070694a520d10c0664f990fa73f4202ee1512a018c5222667394cefc0fef24761
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T18C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5af8c737d44d5414bafa749a0c297ccb8730c26576af8f7d3b0936cdefffc962
MD5 b8819a35ec7212f1235126ba03c2cb3f
SHA1 f3bfb09a3aae8b1c3e5dea89fdca807f8edae8fa
SHA512 06e6e4f131c222eea53ecb14f63910ec2d177d501a43d25821bebc3dfd998c808e86ea0c8af83caf16f56bdbdb174ffcafc348289757c8bddef464ad3f037db0
TLSH
T184E02BAAC820EC774DFD471C10484389E76413671B904D4B3A3C92098FB16374546CAC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b519ec1a9c980881f7fc3f2dbb8b209f6b6a8bdc70cbd5c5f5da76c89402fb6c
MD5 db90b906556c878b58657387d7c56642
SHA1 c2ec0d1d4d9664f7eb30f4d0076cd97def979525
SHA512 c9584f17feaa19a6d0aa1cbb4a8a7393f8b55fa40d89acdda5312bd9b241ca85b401a61eb7d8eea949dcea9e9fda01aa07e3092338aab4f4608410577e249fb6
TLSH
T1FD41AEF3C3E8856E891195F0BA186E2FCE1D0650436C7C5A89E4EF1BA3E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3ba3c2d5eb336f5faaa6fd994a1f91bdf52354cf28b495bf955180694b413df4
MD5 ca479fa38aac45522fb5d67137b9b356
SHA1 d078f9cfb0753b85113a892c7c7175c2b6fbed13
SHA512 7e3e21b34073bbcf7f140f2e30fac1f44bba480aafb4015366b27eb5db4b66983d55f2ca32eb1876fcd47a81efc145eb01199161a48de9a1d9694c0eb600f4cc
SSDEEP 192:sxZMR1yMqZ/K1Ml8UQXc12/fusOXi+DxsKJIILcGzodpZ8/W6+WNsR1Y/Y0lPaAA:sxZMOqs12/fusOXiEHI39+/b7/5K2YD
TLSH
T19372F816AA349D7B8CD7D319BA45BB53D7F8116292904E449AFCCF0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fca6f123e4a696171b8e2a0e8f0891b2fc5b6e155d467a148af69300e7b031ae
MD5 ce53453721b238141b6d2c4440fbc8e5
SHA1 edf392d40a7f00d354190570031e2e273f9d5fb9
SHA512 75926bd35b19ada104598b1dfc4985f61ed98063a817f17ff357b2fa83887fbc431125f1713cdb93360f1d6c55dce4475f8bae7aedd1d1d851c713459d3164a4
SSDEEP 192:sxZMR1yMqZ/K1Ml8Mc12/fusXXM+DxsKJIILcGzodpZ8/W6+WNsR1Y/Y0lza3B44:sxZMO012/fusXXMEHI39+/b7/5Fjc
TLSH
T17772E7056A389D7B8CD7D319BA45BF53D7F91562D2904E44AAFCCB0C04E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 d0d252cc70a4616e4b2962f9735ca596e27748a5c68992c7cd040fe747548f97
MD5 9e31cce710d0a7a81a496ffa8c5748df
SHA1 515ddc59ba5033cb6e536f722b49cc7e70a507c2
SHA512 ee7d20d04e2dbebbd38ed7b8a4781f9011bbfa4459338c8cf68715cb483987a06b31cc18e898a86553832fdeb777b3150154299dd3ab2c6d6330927f414bd537
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3Y7yZLlB:EZN9b8PT24ZE/CuWRmCCQx6u1jaKY7yd
TLSH
T141031C3B280CCB7F4F804E9CDD26BE8E6DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 2f8717d2dde5902cb5978555fd78086d04e6df72d61593b875dbaceec3427978
MD5 32fb4b530ae0a525c7cb968af5fc5bbb
SHA1 38c6ad74f599c440c61537e2521d0d051101f5f6
SHA512 2d2a10f14ba89238a79d94474595e452bbe97f765be2bd48b1414f386cba55ecb4033da4a6ef8485d8db771eb7ac192d7c7964650d5fdadbe73dd87a1c624b13
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZ7Ln:cdOlNXJjSSjroduZ7Ln
TLSH
T17DB23D55713713D03ABD298A8594B4AF52C231A33018E43B7BB954AA0F67E54DCFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 9a3329b30a017d964c854a06fffa5b321804d4990862951a44e08d60856b6bb6
MD5 23656960be1ded8dd030c0fdba510827
SHA1 713366f823411bff3e580991ccd0111f909f93d9
SHA512 f96131831eb9bcfbd98dd225605472158565cbe6f94a37f2c418e240c23c6589793ab4f0806293f78e06b6dbc2275383a13b1e63770cf60bd62755b1f5140683
SSDEEP 384:nuiFavqMg38N18TUNTUlIxB4d45aJK14fXKgfslwjDNc33Ra4UgOUprN1k+5vI+f:FFayv3uwgLoJHKgfs6fNc33Ra99UNL
TLSH
T187C24B75EC58DAABADE64FCAA70A7703EFE001A7859C4AD8DAC81D1D00971DD1307C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97a9142eda63aa1c88e63d639d365ed3d57366634253cdbb7046f69d1aaffaed
MD5 a02834214b9a1c2382062ab1dfe6c221
SHA1 269d02f540988ab16bb8bc1ce30f51709b614348
SHA512 08e628a3c343c234110e9262cd9b882e320282d4094e64122387beac581a2eb9067ad93d4f8529b58701bd0f391edb2535cfee29c56700296d1b395a45237703
SSDEEP 384:nDiFavqMg38Ny8TUNTUlIRy4dRjS14fXKgfslwjDCUoycR3Ra4UgOUprN1k+5vI2:uFayv3hwg5/Kgfs6fCUBcR3Ra99UNL
TLSH
T1A5C26C71EC58DEABADDA9F99B70A7743EEE001A3898C4ED4DAD81D0D00971DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 09dc9f62ec231ac62f74d6665fd27dc5b6f53313ca0f916bbd83c581573affcf
MD5 6119027ddf66a3b224600c1c1f067021
SHA1 5a59b804cfdfec224978502e0c4eb73222ed2b94
SHA512 4348316ec3e4c0ec2e1cab96c8a8068b653ad0ba26fec6773eb9aaf2ae738dc8df533335017f11aaaff24aa560bd4af1d03470b350ed68b7477b9224a0d8288c
SSDEEP 384:nriFavqMg38NW8TUNTUlIxB4dEEj14fXKgfslwjDCUoycR3Ra4UgOUprN1k+5vI2:GFayv3xwgEaKgfs6fCUBcR3Ra99UNL
TLSH
T158C25C75EC98DEABADDA8F99B70A7643EEE001A3898C4ED4D6D81D0D00971DD270BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1d7497a3602670641397f5ab7aa36192ad742d6bef3e26ec3d4849c557336f4d
MD5 d02072ee3fc57eee39dc65cd4d508e18
SHA1 1301bd8d73686819a962e72a3d50a699f3750053
SHA512 e98adf50da8908edeca879f86f9db800e994f66ae8ecfaf9e1e7afe322266d521785fc32f48daa91e44a9ac52398659ce755385725b2c710c7a7f71202f062ca
SSDEEP 384:nDiFwcXqny8Ny8TUNTUlIRLLM4dMgz214fXKgfslwjDCUo7cR1tTzN6QNrN1k+5O:uFyyhwg9LXzrKgfs6fCU8cR1tsQp2
TLSH
T13EC25C75E898DDABADEA8BC9B30A7643EFF011A3858C5EC4D5D45D0C00972DD270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f1d7034a5ac8e82cff37522ab340f0f67ede520b4be478ce0ac3da633a3dd1f3
MD5 ea5cdc703364dad0336b730f52adee1e
SHA1 5a541bbb705a63ebdc1468762200e232cab20ac3
SHA512 50fff1aa66f5eaeef3e1c9a6ae70b41f6e83e98925b36f4aaf46cb1bff2f9b9843d0c730f1bdd0340392fcd56c26fde86e71eec1213ef0b46193f912b0efe356
SSDEEP 384:naiFscXqn88Ny8TUNTUlIRLLM4dogz214fXKgfslwjDCUo/cR1tTzN6QNrN1k+5O:RFu8hwg9L7zrKgfs6fCUkcR1tsQp2
TLSH
T121C25C75E894DDABADDA8BC9B30A7643EFF011A3858C5EC4D5D85D0C00972DD270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c60cc8d2d706719970b754c69083780b07c966ab8d290eeeeadd364997e73444
MD5 13ef64f235fb7a88587faa2236b14d69
SHA1 6874f364b26b591411949c550e6cfd31fd0fe059
SHA512 f78874b440b34b9742b1324ab38a804b211d0a32eb1c7f23a674b02bc4630a5d07991caa78c2251951003550ef870b4fb1f9686e56961ea2c28d836b44319d1e
SSDEEP 384:nOiFscXqn88Ny8TUNTUlIRLLM4dAgz214fXKgfslwjDCUo5cR1tTzN6QNrN1k+5O:lFu8hwg9LTzrKgfs6fCU2cR1tsQp2
TLSH
T137C25C76E894DDABADEA8BC9B31A7743EEF011A3858C5EC4D5D85D0C00972DD270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 52991465fe7a27a00dae62c56707f4c39235faa38aef1c6cfaef387e2fb794a8
MD5 278172b7f1834e6b4ab3f6d125c9e988
SHA1 4de1da418da1ad5c35b88dd41d2dd63943fa58c9
SHA512 5af16c422a9d5d679529ab187106c06fd4b8879ca791d4da76f1c3c4d5c5fed9984fae3f82da3e7357a80e02ebf5de4a16836ff8bce5673d832a48eb9ed4bdc3
SSDEEP 384:nDiFrcXqnZ8Ny8TUNTUlIR3LM4dRgz214fXKgfslwjDCUo7cR1tTzN6QNrN1k+5O:uFzZhwg9LWzrKgfs6fCU8cR1tsQp2
TLSH
T191C25C75E898DDABADDA8FC9B70A7643EEF011A3858C5EC4D5D85D0C00972DD270BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 db6bb77f04e57265a7e400edf603d2da3bdbf0a9f13a7d059f2bbc2106e3d0b1
MD5 076bbfe2a1c8bc1f480db73680ee4b7f
SHA1 fe57543de30de83c2b98b93f18365774863dbc2f
SHA512 daed1daac790b69d037290e7d8cdadc9cd25e8d37923066897d40e3d9c33c024034cbcf77ad1ab2f90d0c26d69a51fd9345a1816af203311f1a747846b1440b5
TLSH
T1A9412ED14C3E2AD2D4FD0A2E749B38FC96D8D72AF4A4347D6864EA94063E51D648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 9e547f808a698c4a2c666b3ad423dfe133ff2df06bb2facc380a1f209779c3f2
MD5 fc815aebc490eaa4ea45c0861705c411
SHA1 2060a23bf6cd180c611330d28c01fd4130710abe
SHA512 91d79e00ae38a2553f91d4c1fe54c3ef230f4937ae2e379cc4403daa0c8995d5067d52b9d1bc23fc02d6fb79c68512b875cf03800a1cf89e233c11fbeaba5a56
TLSH
T17B4162E04C3E2AC1E0BD0A6E749B38FC95CCD729F4A4347D2824EAD4063A11D748443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 3a013b392a2498a6ee58f8139b2d2bbb3d1bbe58be6e28602f449519520fe49f
MD5 168adaccc39a8117e1fb87d3e794a40b
SHA1 0f7b7b5812de8fefc4fbef5f1ee16bc11b483f4a
SHA512 a8963e3c1a48ce0284bb7ee1fcdd5afd2b4bd96e8020c90a6009897ce7cc79b38871e25f61a8e98a0293e747fc7e43c9a68adc069c91ee8d7b21bceaa61fba56
TLSH
T1F2413ED18C3E66D2D4FD0E2E609B38FC95D8D729F4B4347D5868EA94063A51D644043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_438715605\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_438715605\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_566080694\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4912_93192074\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-622-0x0000000000840000-0x00000000008BA000-memory.dmp

Download

memory/692-595-0x0000000000980000-0x00000000009FA000-memory.dmp

Download

memory/980-677-0x0000000000970000-0x00000000009EA000-memory.dmp

Download

memory/1048-591-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/1060-599-0x0000000000980000-0x00000000009FA000-memory.dmp

Download

memory/1080-610-0x0000000000830000-0x00000000008AA000-memory.dmp

Download

memory/1088-598-0x0000000000970000-0x00000000009EA000-memory.dmp

Download

memory/1096-752-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/1100-522-0x00000000008C0000-0x000000000093A000-memory.dmp

Download

memory/1316-765-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1436-681-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1472-574-0x00000000009A0000-0x0000000000A1A000-memory.dmp

Download

memory/1604-712-0x0000000000840000-0x00000000008BA000-memory.dmp

Download

memory/1676-867-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-835-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1712-654-0x0000000000670000-0x00000000006EA000-memory.dmp

Download

memory/1944-873-0x0000000000870000-0x00000000008EA000-memory.dmp

Download

memory/2044-822-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/2060-870-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/2224-733-0x0000000000A00000-0x0000000000A7A000-memory.dmp

Download

memory/2324-680-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/2512-853-0x0000000000640000-0x00000000006BA000-memory.dmp

Download

memory/2576-204-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2580-877-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/2628-226-0x0000000000860000-0x00000000008DA000-memory.dmp

Download

memory/2656-819-0x0000000000590000-0x000000000060A000-memory.dmp

Download

memory/2660-642-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/2680-876-0x00000000009A0000-0x0000000000A1A000-memory.dmp

Download

memory/2712-643-0x0000000000980000-0x00000000009FA000-memory.dmp

Download

memory/2748-858-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-713-0x0000000000850000-0x00000000008CA000-memory.dmp

Download

memory/2844-240-0x0000000000980000-0x00000000009FA000-memory.dmp

Download

memory/2904-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-834-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/2940-874-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2968-623-0x0000000000820000-0x000000000089A000-memory.dmp

Download

memory/3056-283-0x0000000000620000-0x000000000069A000-memory.dmp

Download

memory/3060-626-0x0000000000970000-0x00000000009EA000-memory.dmp

Download

memory/3096-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3180-580-0x0000000000820000-0x000000000089A000-memory.dmp

Download

memory/3316-734-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3540-756-0x0000000000970000-0x00000000009EA000-memory.dmp

Download

memory/3724-67-0x0000000000820000-0x000000000089A000-memory.dmp

Download

memory/3728-272-0x0000000000870000-0x00000000008EA000-memory.dmp

Download

memory/3752-772-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3820-523-0x0000000000620000-0x000000000069A000-memory.dmp

Download

memory/3864-581-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3876-377-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3908-854-0x0000000000660000-0x00000000006DA000-memory.dmp

Download

memory/4016-573-0x0000000000840000-0x00000000008BA000-memory.dmp

Download

memory/4100-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-705-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/4292-710-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4300-676-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/4484-232-0x0000000000670000-0x00000000006EA000-memory.dmp

Download

memory/4552-869-0x00000000009B0000-0x0000000000A2A000-memory.dmp

Download

memory/4812-791-0x00000000009A0000-0x0000000000A1A000-memory.dmp

Download

memory/4848-767-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/4952-704-0x0000000000990000-0x0000000000A0A000-memory.dmp

Download

memory/5000-544-0x0000000000850000-0x00000000008CA000-memory.dmp

Download

memory/5048-592-0x00000000009C0000-0x0000000000A3A000-memory.dmp

Download

memory/5072-709-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/5112-771-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/5188-790-0x00000000009B0000-0x0000000000A2A000-memory.dmp

Download

memory/5208-596-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-612-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5408-271-0x0000000000630000-0x00000000006AA000-memory.dmp

Download

memory/5412-768-0x00000000009B0000-0x0000000000A2A000-memory.dmp

Download

memory/5416-263-0x0000000000890000-0x000000000090A000-memory.dmp

Download

memory/5660-857-0x0000000000650000-0x00000000006CA000-memory.dmp

Download

memory/5680-753-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/5680-611-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-820-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5824-225-0x0000000000820000-0x000000000089A000-memory.dmp

Download

memory/5924-68-0x0000000000980000-0x00000000009FA000-memory.dmp

Download

memory/5928-197-0x0000000000960000-0x00000000009DA000-memory.dmp

Download

memory/5972-627-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6004-823-0x0000000000890000-0x000000000090A000-memory.dmp

Download

memory/6128-241-0x0000000000980000-0x00000000009FA000-memory.dmp

Download