systex | 1585c175e0b069b3e9270160e0ab6fc12e7fde4221f1a28fa8d13b5413546cde

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260629-hhpc6sft9x
SHA256 1585c175e0b069b3e9270160e0ab6fc12e7fde4221f1a28fa8d13b5413546cde
MD5 629a785b770d8afecc3b796740b6c7a7
SHA1 e5f23fd08344980651c958c508aca78cb04d9c1a
SHA512 f9a684242b28f45baada9a0687dc66ce994383941c9bc220cb06579d91a3d9e6983137a40325fa27b0a084cef4de793aa2537d81da1c4f0ac470da4059b1070d
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5528	CP.exe
1816	xspkicaupk.exe
3900	CP.exe
4924	CP.exe
6112	i_xspkicaupk.exe
5016	caurmkecwu.sys
2452	CP.exe
3060	rpjhczxrmk.exe
5884	CP.exe
2976	CP.exe
3172	i_rpjhczxrmk.exe
1576	pecwuomjec.sys
3176	CP.exe
2624	ebwuomgecw.exe
1884	CP.exe
2152	CP.exe
1856	i_ebwuomgecw.exe
5904	ezwuomjebz.sys
1812	CP.exe
5000	geuoljgeyw.exe
5376	CP.exe
2772	CP.exe
2852	i_geuoljgeyw.exe
4180	ojgebwtomg.sys
2512	CP.exe
4252	igeywqomge.exe
5116	CP.exe
6084	CP.exe
3416	i_igeywqomge.exe
6080	aytqoigdyv.sys
3124	CP.exe
4148	bytqoigdyw.exe
5964	CP.exe
2372	CP.exe
2240	i_bytqoigdyw.exe
2888	bvtnlavtni.sys
1276	CP.exe
5112	nlfdyvpnif.exe
2108	CP.exe
4868	CP.exe
5420	i_nlfdyvpnif.exe
1692	davsnlfdxv.sys
2904	CP.exe
3948	avsnkfdxnh.exe
3928	CP.exe
1236	CP.exe
4388	i_avsnkfdxnh.exe
1116	auspkhfdxv.sys
6092	CP.exe
2632	pnhfaxspki.exe
4604	CP.exe
3804	CP.exe
3032	i_pnhfaxspki.exe
3972	khfzxrpnhf.sys
3344	CP.exe
1136	ecwupmkeca.exe
5092	CP.exe
5396	CP.exe
2764	i_ecwupmkeca.exe
1412	kecwupmkeu.sys
1040	CP.exe
5612	cwurpjhecz.exe
4500	CP.exe
3436	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_1529710088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_633961215\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_988131422\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_988131422\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_488810682\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_488810682\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_633961215\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_988131422\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3068_988131422\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligeyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwurpjhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczxrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqolfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geuoljgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligeyvqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicaupk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczxrmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwurpjhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqolfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupmkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geuoljgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igeywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupmkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebwtrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebwtrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqnlfdx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5148	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6060	ipconfig.exe
1200	ipconfig.exe
6092	ipconfig.exe
1452	ipconfig.exe
3568	ipconfig.exe
5544	ipconfig.exe
1776	ipconfig.exe
4168	ipconfig.exe
1496	ipconfig.exe
1200	ipconfig.exe
4448	ipconfig.exe
4996	ipconfig.exe
5648	ipconfig.exe
5724	ipconfig.exe
3112	ipconfig.exe
1552	ipconfig.exe
2716	ipconfig.exe
3756	ipconfig.exe
5860	ipconfig.exe
5352	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271890742930984"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{6264CE19-9C18-49C8-894B-06E43F64DD23}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe
1816	xspkicaupk.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe
3068	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	6112	i_xspkicaupk.exe
Token: SeDebugPrivilege	3172	i_rpjhczxrmk.exe
Token: SeDebugPrivilege	1856	i_ebwuomgecw.exe
Token: SeDebugPrivilege	2852	i_geuoljgeyw.exe
Token: SeDebugPrivilege	3416	i_igeywqomge.exe
Token: SeDebugPrivilege	2240	i_bytqoigdyw.exe
Token: SeDebugPrivilege	5420	i_nlfdyvpnif.exe
Token: SeDebugPrivilege	4388	i_avsnkfdxnh.exe
Token: SeDebugPrivilege	3032	i_pnhfaxspki.exe
Token: SeDebugPrivilege	2764	i_ecwupmkeca.exe
Token: SeDebugPrivilege	4992	i_cwurpjhecz.exe
Token: SeDebugPrivilege	3512	i_mjebwtrmjh.exe
Token: SeDebugPrivilege	3688	i_jebwtrljge.exe
Token: SeDebugPrivilege	5260	i_ligeyvqolg.exe
Token: SeDebugPrivilege	3692	i_gdyvqolfdy.exe
Token: SeDebugPrivilege	1480	i_gaysqnlfdx.exe
Token: SeDebugPrivilege	3412	i_icausnkfdx.exe
Token: SeDebugPrivilege	1640	i_causmkecxu.exe
Token: SeDebugPrivilege	5292	i_wusmkecwup.exe
Token: SeDebugPrivilege	4516	i_hczurmjecw.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 1800	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 5496 wrote to memory of 3920	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 3920 wrote to memory of 2772	3920	iexplore.exe	91
PID 1800 wrote to memory of 3068	1800	iexplore.exe	92
PID 3068 wrote to memory of 1312	3068	msedge.exe	93
PID 3068 wrote to memory of 5148	3068	msedge.exe	94
PID 3068 wrote to memory of 4800	3068	msedge.exe	95
PID 3068 wrote to memory of 4800	3068	msedge.exe	95
PID 3068 wrote to memory of 4800	3068	msedge.exe	95
PID 3068 wrote to memory of 1308	3068	msedge.exe	96
PID 3068 wrote to memory of 1308	3068	msedge.exe	96
PID 3068 wrote to memory of 5720	3068	msedge.exe	98
PID 3068 wrote to memory of 5720	3068	msedge.exe	98
PID 3068 wrote to memory of 5720	3068	msedge.exe	98
PID 3068 wrote to memory of 5256	3068	msedge.exe	99
PID 3068 wrote to memory of 5256	3068	msedge.exe	99
PID 3068 wrote to memory of 5256	3068	msedge.exe	99
PID 3068 wrote to memory of 1664	3068	msedge.exe	100
PID 3068 wrote to memory of 1664	3068	msedge.exe	100
PID 3068 wrote to memory of 1664	3068	msedge.exe	100
PID 3068 wrote to memory of 752	3068	msedge.exe	101
PID 3068 wrote to memory of 752	3068	msedge.exe	101
PID 3068 wrote to memory of 752	3068	msedge.exe	101
PID 3068 wrote to memory of 1628	3068	msedge.exe	102
PID 3068 wrote to memory of 1628	3068	msedge.exe	102
PID 3068 wrote to memory of 1628	3068	msedge.exe	102
PID 3068 wrote to memory of 2284	3068	msedge.exe	103
PID 3068 wrote to memory of 2284	3068	msedge.exe	103
PID 3068 wrote to memory of 2284	3068	msedge.exe	103
PID 3068 wrote to memory of 6012	3068	msedge.exe	104
PID 3068 wrote to memory of 6012	3068	msedge.exe	104
PID 3068 wrote to memory of 3576	3068	msedge.exe	106
PID 3068 wrote to memory of 4728	3068	msedge.exe	107
PID 3068 wrote to memory of 3576	3068	msedge.exe	106
PID 3068 wrote to memory of 4728	3068	msedge.exe	107
PID 3068 wrote to memory of 1472	3068	msedge.exe	109
PID 5496 wrote to memory of 5528	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 1816 wrote to memory of 3900	1816	xspkicaupk.exe	113
PID 3068 wrote to memory of 356	3068	msedge.exe	116
PID 3068 wrote to memory of 356	3068	msedge.exe	116
PID 3068 wrote to memory of 2716	3068	msedge.exe	119
PID 3068 wrote to memory of 2716	3068	msedge.exe	119
PID 5496 wrote to memory of 4924	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 5496 wrote to memory of 2452	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 3060 wrote to memory of 5884	3060	rpjhczxrmk.exe	126
PID 5496 wrote to memory of 2976	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 5496 wrote to memory of 3176	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2624 wrote to memory of 1884	2624	ebwuomgecw.exe	135
PID 5496 wrote to memory of 2152	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 5496 wrote to memory of 1812	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 5000 wrote to memory of 5376	5000	geuoljgeyw.exe	144
PID 5496 wrote to memory of 2772	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 3068 wrote to memory of 1552	3068	msedge.exe	150
PID 3068 wrote to memory of 6112	3068	msedge.exe	151
PID 3068 wrote to memory of 1204	3068	msedge.exe	152
PID 5496 wrote to memory of 2512	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 4252 wrote to memory of 5116	4252	igeywqomge.exe	157
PID 5496 wrote to memory of 6084	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5496 wrote to memory of 3124	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 4148 wrote to memory of 5964	4148	bytqoigdyw.exe	166
PID 5496 wrote to memory of 2372	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 5496 wrote to memory of 1276	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 5112 wrote to memory of 2108	5112	nlfdyvpnif.exe	175
PID 5496 wrote to memory of 4868	5496	2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe	178

C:\Users\Admin\AppData\Local\Temp\2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_629a785b770d8afecc3b796740b6c7a7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x358,0x7ffd800ec188,0x7ffd800ec194,0x7ffd800ec1a0
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,3587637070278963585,9745998062224648746,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
      4⤵
      System Time Discovery
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,15077323248696420445,18205831763065489157,262144 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2684,i,6059370480291209284,12114042237234376222,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:13
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,12006840863582107342,15420761026699218899,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3632,i,9254332653004015530,6585432530134637838,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,15870933432045242727,13307025001356442503,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,594686182268996231,4196110363239304005,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4372,i,8001267583872073411,3930299627712698561,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:1628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5460,i,6024039265769737081,474980424575465490,2097152 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,8104490856231670397,2278930165910370545,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:6012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,16977025336200758728,17912956936750508600,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,6429068739512200371,9056075822644157285,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:14
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12350622953503621950,2353045035077821029,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12350622953503621950,2353045035077821029,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,11559483317476987728,2928423907371558165,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,6295225927552897440,11869036297586732903,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:14
      4⤵
      PID:2716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,6583208261311511123,17475815963759750674,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,12881554840458365450,16273125673614856298,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,4122219613636672755,16930487247159756083,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,15156404561175022974,7237576183430654853,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,8680453924168232766,2452500214875888942,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:2664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,16818403256484616681,18221757172488599461,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,18307953932589517814,17145721723241731856,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=1260 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5712,i,4414246830269630326,10698903722585525996,262144 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=1480 /prefetch:10
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7760362161003192386,8077222071252656166,524288 --field-trial-handle=2640,i,17221735940708992304,13988050495314427041,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:2124
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkicaupk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5528
- - C:\Temp\xspkicaupk.exe
    C:\Temp\xspkicaupk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkicaupk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\i_xspkicaupk.exe
    C:\Temp\i_xspkicaupk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczxrmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2452
- - C:\Temp\rpjhczxrmk.exe
    C:\Temp\rpjhczxrmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczxrmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2976
- - C:\Temp\i_rpjhczxrmk.exe
    C:\Temp\i_rpjhczxrmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3176
- - C:\Temp\ebwuomgecw.exe
    C:\Temp\ebwuomgecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2152
- - C:\Temp\i_ebwuomgecw.exe
    C:\Temp\i_ebwuomgecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geuoljgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1812
- - C:\Temp\geuoljgeyw.exe
    C:\Temp\geuoljgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geuoljgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2772
- - C:\Temp\i_geuoljgeyw.exe
    C:\Temp\i_geuoljgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igeywqomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2512
- - C:\Temp\igeywqomge.exe
    C:\Temp\igeywqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igeywqomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\i_igeywqomge.exe
    C:\Temp\i_igeywqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqoigdyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3124
- - C:\Temp\bytqoigdyw.exe
    C:\Temp\bytqoigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqoigdyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2372
- - C:\Temp\i_bytqoigdyw.exe
    C:\Temp\i_bytqoigdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1276
- - C:\Temp\nlfdyvpnif.exe
    C:\Temp\nlfdyvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4868
- - C:\Temp\i_nlfdyvpnif.exe
    C:\Temp\i_nlfdyvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkfdxnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2904
- - C:\Temp\avsnkfdxnh.exe
    C:\Temp\avsnkfdxnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkfdxnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_avsnkfdxnh.exe
    C:\Temp\i_avsnkfdxnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6092
- - C:\Temp\pnhfaxspki.exe
    C:\Temp\pnhfaxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3804
- - C:\Temp\i_pnhfaxspki.exe
    C:\Temp\i_pnhfaxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwupmkeca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Temp\ecwupmkeca.exe
    C:\Temp\ecwupmkeca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwupmkeca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\i_ecwupmkeca.exe
    C:\Temp\i_ecwupmkeca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwurpjhecz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1040
- - C:\Temp\cwurpjhecz.exe
    C:\Temp\cwurpjhecz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwurpjhecz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3436
- - C:\Temp\i_cwurpjhecz.exe
    C:\Temp\i_cwurpjhecz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjebwtrmjh.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\mjebwtrmjh.exe
    C:\Temp\mjebwtrmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjebwtrmjh.exe ups_ins
  2⤵
  PID:1720
- - C:\Temp\i_mjebwtrmjh.exe
    C:\Temp\i_mjebwtrmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtrljge.exe ups_run
  2⤵
  PID:1144
- - C:\Temp\jebwtrljge.exe
    C:\Temp\jebwtrljge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtrljge.exe ups_ins
  2⤵
  PID:792
- - C:\Temp\i_jebwtrljge.exe
    C:\Temp\i_jebwtrljge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligeyvqolg.exe ups_run
  2⤵
  PID:5024
- - C:\Temp\ligeyvqolg.exe
    C:\Temp\ligeyvqolg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligeyvqolg.exe ups_ins
  2⤵
  PID:2112
- - C:\Temp\i_ligeyvqolg.exe
    C:\Temp\i_ligeyvqolg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqolfdy.exe ups_run
  2⤵
  PID:3512
- - C:\Temp\gdyvqolfdy.exe
    C:\Temp\gdyvqolfdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqolfdy.exe ups_ins
  2⤵
  PID:6100
- - C:\Temp\i_gdyvqolfdy.exe
    C:\Temp\i_gdyvqolfdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqnlfdx.exe ups_run
  2⤵
  PID:6016
- - C:\Temp\gaysqnlfdx.exe
    C:\Temp\gaysqnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqnlfdx.exe ups_ins
  2⤵
  PID:4432
- - C:\Temp\i_gaysqnlfdx.exe
    C:\Temp\i_gaysqnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run
  2⤵
  PID:2592
- - C:\Temp\icausnkfdx.exe
    C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins
  2⤵
  PID:1160
- - C:\Temp\i_icausnkfdx.exe
    C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  PID:2912
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  PID:3864
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wusmkecwup.exe ups_run
  2⤵
  PID:4544
- - C:\Temp\wusmkecwup.exe
    C:\Temp\wusmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wusmkecwup.exe ups_ins
  2⤵
  PID:1512
- - C:\Temp\i_wusmkecwup.exe
    C:\Temp\i_wusmkecwup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hczurmjecw.exe ups_run
  2⤵
  PID:3568
- - C:\Temp\hczurmjecw.exe
    C:\Temp\hczurmjecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hczurmjecw.exe ups_ins
  2⤵
  PID:5532
- - C:\Temp\i_hczurmjecw.exe
    C:\Temp\i_hczurmjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2152

C:\Temp\caurmkecwu.sys
C:\Temp\caurmkecwu.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\pecwuomjec.sys
C:\Temp\pecwuomjec.sys
1⤵
- Executes dropped EXE
PID:1576

C:\Temp\ezwuomjebz.sys
C:\Temp\ezwuomjebz.sys
1⤵
- Executes dropped EXE
PID:5904

C:\Temp\ojgebwtomg.sys
C:\Temp\ojgebwtomg.sys
1⤵
- Executes dropped EXE
PID:4180

C:\Temp\aytqoigdyv.sys
C:\Temp\aytqoigdyv.sys
1⤵
- Executes dropped EXE
PID:6080

C:\Temp\bvtnlavtni.sys
C:\Temp\bvtnlavtni.sys
1⤵
- Executes dropped EXE
PID:2888

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
- Executes dropped EXE
PID:1692

C:\Temp\auspkhfdxv.sys
C:\Temp\auspkhfdxv.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Temp\khfzxrpnhf.sys
C:\Temp\khfzxrpnhf.sys
1⤵
- Executes dropped EXE
PID:3972

C:\Temp\kecwupmkeu.sys
C:\Temp\kecwupmkeu.sys
1⤵
- Executes dropped EXE
PID:1412

C:\Temp\kebwuomhez.sys
C:\Temp\kebwuomhez.sys
1⤵
PID:4076

C:\Temp\ljebwuomge.sys
C:\Temp\ljebwuomge.sys
1⤵
PID:4440

C:\Temp\ljdbvtqolg.sys
C:\Temp\ljdbvtqolg.sys
1⤵
PID:4456

C:\Temp\oigaytqljd.sys
C:\Temp\oigaytqljd.sys
1⤵
PID:5808

C:\Temp\lidbvsnlfd.sys
C:\Temp\lidbvsnlfd.sys
1⤵
PID:3120

C:\Temp\nhfausqkif.sys
C:\Temp\nhfausqkif.sys
1⤵
PID:1324

C:\Temp\fcxvpnkfca.sys
C:\Temp\fcxvpnkfca.sys
1⤵
PID:3028

C:\Temp\hczxrpnkfc.sys
C:\Temp\hczxrpnkfc.sys
1⤵
PID:5280

C:\Temp\ecwuomhezx.sys
C:\Temp\ecwuomhezx.sys
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqoigdyv.sys

Path C:\Temp\aytqoigdyv.sys
Size 141KB
SHA256 2d7e5f52de3703734c612ff3da10b3a507a1c433ec9c1dcf94701d582ddaa009
MD5 a08b92303dff9067e38abceaca15af4a
SHA1 ab10b7d891df4a63d4bf5008818be5ff7a2feaf9
SHA512 0f3b29ef13bf5ee5e90b93767b3150b5ad51ee7a905790e73e9b8d5dc2aaeb70373cf31d48cf3cc42d7fc24c7ca8f127f0bd9504e79bbf2abbc307b63026d2d1
SSDEEP 3072:usQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:usQmpcF8BzXfwV
TLSH
T10AE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlavtni.sys

Path C:\Temp\bvtnlavtni.sys
Size 141KB
SHA256 51fb7d531e0bfea1dfb8c4d9faef67636c83df8397362f5b437a183b62822141
MD5 7335ad4bc85fbfdaa48702ce7728e0ea
SHA1 d2873e14df2352eb735619795aa333c9d9abb653
SHA512 d7e6bd743af330ec1cef0cd6c25fa10fcdca772e97bbb7f137621022c3feb58c1d639363e0e347e676e0ff1718b880e919d5003d079e24dde1078224b47f2133
SSDEEP 3072:tsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:tsQmpcF8BzXfwV
TLSH
T16CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytqoigdyw.exe

Path C:\Temp\bytqoigdyw.exe
Size 230KB
SHA256 d8221e80078d94e177fd80604c45cdb23ce86c4433567ef516f44713df9068eb
MD5 b014bf67eb557aa0b0315f486b6a0dac
SHA1 55f4726f60369bccf267acc0636ce68c7b2f78a3
SHA512 badb3853e50bfe30e24eb9a66e32db9fd1aaab3f42b4df63721de018b58d4b18514753cca1b02131dde45754a41f77f6b62568c07d3757914852668edf74a9b8
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T160344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caurmkecwu.sys

Path C:\Temp\caurmkecwu.sys
Size 141KB
SHA256 7bdab447ae2e836c8399dd89e11ef0ccf23582680e605015b791356fb7a265cf
MD5 546510e8643c9b22be950f7360164c03
SHA1 df49a539d80db36287535597dfcc7721bf48d949
SHA512 4fce27f1dbd236ac74eba0f57ee2f4d779c735e5c053ee269775796a460f6e694e93cf01321a4f0ae1a139364b6ce093547ba86d994d494abd96076d50905a7d
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T190E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwuomgecw.exe

Path C:\Temp\ebwuomgecw.exe
Size 230KB
SHA256 1d8cdd5edbb981fe80310af6b426e86cf5eca91d891f5f03b0d7d00876b48db6
MD5 aab54a0136d649d43d4fc3d46bca188d
SHA1 3d7242c2334abf8da2c6f8530bfcabd206f1ab53
SHA512 020f892203cfc8695888b4164203648fe183fe6b4046ec4852c83edded19c71f9083c7449ec4dba1fd6b2beab19895b52602ade0eb986e4814ff0f18021b8446
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T17F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwuomjebz.sys

Path C:\Temp\ezwuomjebz.sys
Size 141KB
SHA256 465ef0dbf0ba46082b2b772da9e5b2404c10124892bfbd1796cbfe32ab26a687
MD5 161448ee1490c6519588b9113dcfc1b9
SHA1 1dccbfe79d94d12ea6906234dc9cab0f6435b870
SHA512 60d087121f41c8b7b2b8aaafcfa42cdcb73f3954e4dc4e297007d0181e9b9c77ad8a515093295236f017f9b9a955e1438d1d2c46fb1568e29163e31133c642de
SSDEEP 3072:3sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:3sQmpcF8BzXfwV
TLSH
T1CEE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geuoljgeyw.exe

Path C:\Temp\geuoljgeyw.exe
Size 230KB
SHA256 24410fa52640c40f60c118e9042566b326249e7f1b96bb97f2980e236a5f7cb8
MD5 5b11d92cecead48732a645c747676095
SHA1 355917accedf8dfa227cd20b13b0b6ad7566e19f
SHA512 1776b9b90a3c0d130cb3f5c5605e297570346492fb00527c245e1de9dff8f4f449170da4d85d277e0fd46f1f963efe150cd4a98a14fee5d8f12aab778914996f
SSDEEP 3072:IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:IghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytqoigdyw.exe

Path C:\Temp\i_bytqoigdyw.exe
Size 230KB
SHA256 a112abee468c90842076a96d35a68af8acce98d6849564363f6ac3a41e044afa
MD5 2cd4562702712650d1b648ef0a8d5422
SHA1 d9e6b41baab5b1fb1cf89980accabfa959093f6b
SHA512 2a424277e49671616c92061ef58844fd873a7ad125607b478fd317cb0f89a476a0d8c704e4a8d3720f5a736c895ad586eda0d4cf472d33d06174c9f6128d91fa
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T173344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwuomgecw.exe

Path C:\Temp\i_ebwuomgecw.exe
Size 230KB
SHA256 7c26cadaa1de8a2ebd8aa656520a79cf0768c3485fc19f9c0e120e8c6a96df83
MD5 e74fdb6111d88db12ab4f4cae21fde4b
SHA1 2565b8adf6fcfd87bd352a3917483870a194c439
SHA512 83d12effd67eda0c04a19e1955d1a9803da421f6f1c724f4c44d5d0bd73f06b5239560a101553cdf330ddf5788a6595619d91c9ae7115596cef8cb9eef3de6b2
SSDEEP 3072:RKJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9d:IghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geuoljgeyw.exe

Path C:\Temp\i_geuoljgeyw.exe
Size 230KB
SHA256 84b1c1212f65fde86c51c7c98c23e736f27e48b923060ac07bf2b06292b0731e
MD5 9a00dfdbdd0ba8fd8c0e024eb29353f1
SHA1 937313fa3e6583e025c2e4155dfd2f50730ae321
SHA512 13c74764b1829394e88ea82767b94296d5be133a8783122bc9d43f596402764fd4a45c726ff84de067c7c758674e0ccfe9d48713ea06ce2f36d590df98701c4f
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T106344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igeywqomge.exe

Path C:\Temp\i_igeywqomge.exe
Size 230KB
SHA256 11496de5eb4af3c5ba5489be38824382f84034541d076190e31fd3f8274a4d9b
MD5 c3f29034cc7893ba51331fabfe40acea
SHA1 c0d138e17dc29303d3aabb7004f400dc6b06f749
SHA512 939273911b7562a20b1624c170fbb9aa7267e917de7efbe79981af6ea2fab164784b16521fd977a8e090a31129210ac89e0420c0f624c8dab14b8465296f1353
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhczxrmk.exe

Path C:\Temp\i_rpjhczxrmk.exe
Size 230KB
SHA256 1da80ad1a13b7fa189e07d732af87dec6728692a16f9b4a45994c4b36817c115
MD5 2c69a483bda5043feb7456275175aaca
SHA1 e73631a5b07495a87b0483f9d17429ea52a6761b
SHA512 c1968dccdcdb1a6814438e6da764a8ae6edb5c66c45f1aff66375593f60002575a421a0be10d2da298a80f1ad623c4c7597a8175368a81f7a5fc10df68aebbde
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T196344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicaupk.exe

Path C:\Temp\i_xspkicaupk.exe
Size 230KB
SHA256 362f990fb0e0a4a8c3c929fb4796c31c4a968aa70a88236e810f3cda804bff88
MD5 e5c8670e79bbaf7ded66c1584ed19ecf
SHA1 0e743e2e4fbd724f1c51106857fe6c0366393494
SHA512 7b953ab558d36621ace470b38f9617d9b5376a2a2440493a857a5a96521e0d75e6bc07c73466b13e769e54a0a84f82ced7b3de3edbd82c17843c78c5df3297d4
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeywqomge.exe

Path C:\Temp\igeywqomge.exe
Size 230KB
SHA256 57729edf3abe741d124663cff708890eeba11890857f6e53336dde1d72f3af92
MD5 24fb83474ef371daf20f98e71af9df74
SHA1 36cbf8d94760460ba5e6fa8b787ecd268e27fbb8
SHA512 3ae9fe3d4ba5c089c28203e95f70e08051a63a9ab32d05b51290ea62fb91aad4abb892c6c165d890d26702b14b1a94a36c83f3cafc486293374de234d28a06d4
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T11C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgebwtomg.sys

Path C:\Temp\ojgebwtomg.sys
Size 141KB
SHA256 47ede32a4720d578a6b9e2ad537ae0a92f13a0a42ee5db739c7c6bd0911ddbc8
MD5 5d7f771f792fe00348b6e44acaf1e724
SHA1 fb57ae69657c2642bf800e06c084e15f4052d01c
SHA512 fa8644609b15054cc448ae60336fbcdcbcbcecc74c367faf189152ef551ae3b0b5ff100988ccd8e699f771a6d5157ace3958a36bbeb01a33b0dbfd5abb7bd610
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T1E9E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pecwuomjec.sys

Path C:\Temp\pecwuomjec.sys
Size 141KB
SHA256 0cd51bf7223037bab765463532dd0e3240a580c50b9ca8648f658796d8c90115
MD5 0f3656d13f3c1439fb1d12f7136f97b6
SHA1 19382a962e2908890556e48c1490a30b7c125df7
SHA512 d0806b9343cb940cbde690e3fc9444226450950dcb60873bbbdd3c693958a7e9d72f99fadf83570ed694f4fa23f1d8bd9603b86ab0c22c9bc9e65011c11e42fa
SSDEEP 3072:PsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:PsQmpcF8BzXfwV
TLSH
T1C9E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczxrmk.exe

Path C:\Temp\rpjhczxrmk.exe
Size 230KB
SHA256 6e3cc72646458e5b4ab7c9fbf6f647e0c0ec5c4417e775f149e462c21389927d
MD5 775568c01d2e12687d63deead936324a
SHA1 b376f351af727be02d314186d46363b7bc949753
SHA512 234082fe2aad5eb8fd125d10cfeb95dce0b753fdd08209bf186942e9122cfa0b323cf9fb87a7b27de27cd6cbbf7ca83cd563ec5061699937513836ac738e9753
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicaupk.exe

Path C:\Temp\xspkicaupk.exe
Size 230KB
SHA256 c8c864d05e5400338925918163e369e81bf7ee1944c9a62b20fb8f7e3bbfbebd
MD5 8d1ea6806ff0ac09639999455287b82e
SHA1 ec9379b120b0faf2fdd5ce70c3ea895e74e7529f
SHA512 c971ec30e73f095f1594cdf6cfb114f4aeb892871b9da2c48a24ebcc5565e8a5b856ec58f63e1dbded485b4aa27c08a71b73173aa6113b9028d8eee7e850e073
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T132344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4f1f24e5-54c6-4682-b06c-15de6b3d3303.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4f1f24e5-54c6-4682-b06c-15de6b3d3303.tmp
Size 38KB
SHA256 e66dfca1d7eae7c6ed194c55042eb9b2226dabbd7367b49382b549f11b672a81
MD5 b805781d7988d7d45e56f941e31cdc44
SHA1 90661826fdc30d48544b60e932e00f9a1bd8f4a2
SHA512 ef5cf5ebc588696d652cb63567e84bf0b99cf5a4dae9b7f6343020dab54a6810195df1b889a672aba1e71d8746234e59c3a36f08980e722c3b51989b870c3425
SSDEEP 768:UjaeqD4MlshiLdMmQ3sFgaffmfWyJ5p3EFlnNMLmKpyjWtTzTb:UqcjhIdMH3MfmfDp3EFlSCyyj2v
TLSH
T18403D03A98A05C77CC769685760B77976EF04693CB913A59D8CC7A0E40AB3DE130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d4fd35663b02db08c62f7b3c6893c5b67e4323a594e5630529b968005a74fe5
MD5 1b39f57384fbb4eac1f89563ab6336a3
SHA1 ddfc46b2273d05819958f696555d3db07bc7a4ed
SHA512 877126d091d1ace683c81a203529aa4aecc06ebd6bf27ba635cea82791a10f0faf9e4280e149d6f2b1a9d9f2571e2da1aacaf7695b3654816f4de063192526ca
TLSH
T1E3D0A7687E26E9D9C12810B595314F00BB66746372165601A1548C0D9CB94C556D6991
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 57343e4ab3f89e2f733c4da07885c42e8dfdb3e23b9ad0708cd0f60f8003c1e0
MD5 3fcbd94c91fc2321769a98fc7f4213b1
SHA1 b7da6d60b6bad4951fb5690597df4c1e07f47319
SHA512 291029cafd3a7ec13b301d74d1bbd8c7b10b767ed65a68cb83365e643ed17b3c9dc20dae5cee5d2c7ddda211828bfe6fe9e6bcd559b212d2fbb774a07e5db084
TLSH
T17E612B5005B00E7EDB2641BD6CF2249E3BF0E4EA17172E224E94A3B85D7BF08104FA1B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fc20862e599460fcec7367db030c1a1ff49ef35902e63f093e3c789c5912e12c
MD5 4609225c188babbcaa169acb1de74b9e
SHA1 392dbc9f9d72ddfba029f44886dc264070d7b4ad
SHA512 d5836c64d85de030dfbaff5ebee6b56b3c948909e46910f8cbba4862882dc140a07f5bfca141de4147aed32a7327b31e73af8ff8c5ff47dd55a48e68a85aeb8c
TLSH
T1C451ABF3C3E8866D890156F0BA186E2BCE1D0954832C3D5AC9E4AF5BA3E2471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4a18899fd80993f78106769506a22472346dcc3e96be0b382f379b7196f039d5
MD5 11727a86f48abe3dedac09a07cb52a86
SHA1 f594a89ddaa2f241928b65960cbfe105137f6f42
SHA512 14f359738e8b3259d5dc076143d50228c25b4f2e4570887e3c51831017d3a0ede2b7a527f039fcd2a8007c2f14c870d07a77c144dc3530ab0394317d8134ba23
SSDEEP 192:sxRFFRoyM/jK1Ml8wc0/fLsDNPUaJZRcW9zoA8p9a/g6+WNC92/YYMQYuqDG4Igg:sxRFFyC0/fLsD+aHa1k/5P/Dqhg
TLSH
T16662D915AA389977DCDBD20CFA557B53D6F85572A2900E44A9FCCA0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 89349d1ec6e2f979f070e8132bd27039cd2243871e86fe5d986ea9eb328626d0
MD5 6ae9d6c5a3fd691bf7bb7b9a0609bf61
SHA1 c30a4036a7ba8d96843bae65c9993e2426d40472
SHA512 83924ef2e6b1e48abbf0c77a50aa3c43034ae50c26a905db4461f66688b39c4cb16e5ae57c7f48e84abc71bc9f24c21a8657104fb90602e5b3e1f49ad8f3b118
SSDEEP 192:sxRFGRoyM/jK1Ml8wc0/fLsgNPUaJZRcW9zoA8p9a/g6+WNC92/YYMQYuqDG4Ig6:sxRFGyC0/fLsg+aHa1k/5P/Dqh6
TLSH
T17D62EA15AA349977DCDBD20CFA557F53D6F85572A2900E44A9FCCA0C04EBAED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 06cadd497f841982ac4e09a9fd3b3962d648065de8907c41c161abe0f0ec94f0
MD5 7529f8d2a51fe0c1cd250ae2a83ab340
SHA1 9adcb3801a0f0ca4941de2a647756e45f42c946d
SHA512 ffbc14f30de498eec8c5f3c5d446ea8ce0ca5af2fa530dcdcbb85c89167b8f5b17f3c9080a9110b82f3c8147534ff89c2fd4b0a91031a406b90fc6c3e4181135
SSDEEP 192:sxRFGRoyM/jK1Ml8UQZc0/fLsgNPD+aJZRcW9zoA8pra/g6+WNC92/YYM1vYuqD2:sxRFGyqO0/fLsgJ+aHa1W/5P/Wqhs
TLSH
T19362D915AA389977DCDBD20DFA557F53D2F85472A2940E44A9FCCA0C04E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ff94e3570ee604a94ea0dfa38527054cb0bfe8b469c1612aeead325874ce8603
MD5 cd03b2889878efdd99583a3a11b666e9
SHA1 b7c7e535ccdf4532bb4877eee92b538e7a05ebc4
SHA512 c2956ea706c2f1b16de191a8aef51217e63c8555a81ee257a60e6b4670206fd6738fd4da50e38fa70fe2b640cf73fd74070fc7d539e72697761aec76b1c6008f
SSDEEP 768:j+8uRA7pLuL7q7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVq6pBJ68roltH3:j+8uRME7q7WgNVfq3u1ja16pH6nltH3
TLSH
T12CE2ED3B680CCB7E4F804DDCE829BE9A6DE801CB96D8CD5447E9841C03C66EB551A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e125312912930a5786a7160b002fde82e081273e36bea4d594b5bbae1c4e4600
MD5 ce472231314a2f60621b06f3f7690857
SHA1 6f35bf31965889b33d69256b7e72fffadd0a6b18
SHA512 e328705740536619d2aa99db7bf019f7bcb16027ca1fce13b528d2efd2d6d247394a9113331dc0b0d71477c77dbe1f03c985813404acfc102bad42cc57e67148
SSDEEP 24:KFxf63OgrFL/H+H7seI7DHK4QhgdH1SRXSkpqc6PMyXe0fDGRguFk0y+8KsBI7a0:KsOI3KzKoLyNFIZKmkci5I1KKYg/yK
TLSH
T1F1916142717B664828BD398A92D4A56E06463473315BB43B7FA860E24F2FE401FFF4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e073.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e073.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 8421802cebbc4b2cc668df7ede72b4de9460098dce2368c9f63d89e54d2fc2b1
MD5 4106791ba05308cd0f963773ed71b710
SHA1 5c692d6d0662bb1482e5872d10dc985a1926602e
SHA512 30096cd3217e1ada56bcb847bf1106ca896780f677dd0a77f07b24cd76a212887fb137c08451ec5fef2c0141573d3e9661934d249b3a5cb18288c579359af82d
SSDEEP 768:MjaeqD4MlshiLdMmQ30R5gaffmfnfYayJ5p3EFlnNMLmOAyjWtTzTE:MqcjhIdMH30Rfmfnfgp3EFlSCDyj2g
TLSH
T12103C13598B09C638CB6D685764B77D76EF046A3CA913E59ECC86A0E40973DE230F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 010f72239feeee16ffcb5ca70753acac84191dbd0c1b0a05a75d2a4a77bd522c
MD5 bb0177971b9c8946f707c9b644db7e01
SHA1 358ecaf7e4dd31b5d1862694b479c42f78719647
SHA512 dd38f8d2d176b3866f64e76dc6ae153e9dc1f60e86a2cabf45640e92f21fad2972d7792b48bb949bc3fed6ca138a5fe157935ce90da0d47b068be62b1a006053
SSDEEP 768:oj+9y3pJFwl3gaffmfnfYWyJ5p3EFlnNMLmOAOJX:39y3PFMfmfnf4p3EFlSCDiX
TLSH
T10BE2AF31ACA09D638DAAD685754B3787BEF45673DA802E44D8DCAF0E44C73DD270B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c24bc9217bc58ad726ca2a1201aed763850052a3616ec905934caa8189c8f7a
MD5 5576dc9491e75703e99ff8135c314aca
SHA1 f9a37be00e7fe930c031091e9396b51fc8cbfa63
SHA512 17703ce347dc95949da53bf27443efea8ae3c359cd31ed5f60a71b5e823c616d91cde6b87b936cae101d28b4623f344ede2c373b5b341293957d0137ac69b1dc
SSDEEP 768:GjaeqD4MlshiLdMmQ3TJFwl3gaffmfnfYByJ5p3EFlnNMLmOAOJNTA:GqcjhIdMH3tFMfmfnfrp3EFlSCDim
TLSH
T1A903CF35ACA05C638DBAD645764777D7AEF046B7CA803E58E8C96A0E00973DE270BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 d685428212e6166cf94ffe8f01bf206c497da21cee1929eade2e2a8de80d98e7
MD5 6871d8c6db8f7b2acd2f09e113218ae2
SHA1 45852d39db9583c3e3459231e9bae467e48f8f0e
SHA512 ea272b03e29405c3c1d7c579e14961a359c5f30253d8d401ab05112f43196379c0ef30eb9203ef0164a07b08a0774db76e4d8d0eabe6d2d691e4bfc9a4496046
SSDEEP 768:8F1j+943Lwg9JFaldXfmfnfYdyJ5p3EFlnNMLmOAOJX:x9431FYfmfnfZp3EFlSCDiX
TLSH
T1B41307F598D38936D99E8783673E6E469DFCC163B5846984BBC85D0DCC822BFD30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3068_713651178\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1116-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1324-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1412-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1576-244-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1596-507-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1692-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2888-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3120-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3972-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4076-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4180-283-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5280-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5808-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6080-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download