systex | 43311c1f489a6de31c4e70618c8dd9b96daed010d39e57da697d7f7b838ca86b

Analysis

max time kernel
149s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260630-e5ntdae14m
SHA256 43311c1f489a6de31c4e70618c8dd9b96daed010d39e57da697d7f7b838ca86b
MD5 b6aa9c8f71a0584edb9b3d9181de58b3
SHA1 546e7bda876213287f4915609877867efbd89b1b
SHA512 c098dd888908b5e05bccb26c7014a7d1afd7eee62ccab71d6b28db9556a3bdc4a89e35d0c81dda3bfd9cc9a8d06fe60f6a99e71fc9ba3468a216035bc97aace3
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T197344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3716	CP.exe
1308	wqojgbvtoj.exe
6632	CP.exe
7088	CP.exe
7056	i_wqojgbvtoj.exe
6756	yvtoljdbvt.sys
6672	CP.exe
2836	tqljdbvtnl.exe
6444	CP.exe
4260	CP.exe
6752	i_tqljdbvtnl.exe
6588	aytqkidayv.sys
3696	CP.exe
1576	sqkigaysqk.exe
2912	CP.exe
5624	CP.exe
3888	i_sqkigaysqk.exe
2328	axsqnlfdxv.sys
1564	CP.exe
2072	vsnlfdxvpn.exe
1920	CP.exe
5944	CP.exe
2132	i_vsnlfdxvpn.exe
6424	pnhfzxspkh.sys
1704	CP.exe
4488	pkicausnkf.exe
5488	CP.exe
4628	CP.exe
1000	i_pkicausnkf.exe
4896	xrpmkicaxu.sys
4840	CP.exe
6152	uspjhczurm.exe
6268	CP.exe
6912	CP.exe
6760	i_uspjhczurm.exe
3988	mkecwupmhe.sys
792	CP.exe
6704	mkhczurmke.exe
2040	CP.exe
2164	CP.exe
5840	i_mkhczurmke.exe
7056	ecwuomhezw.sys
260	CP.exe
6756	ecwuomgebz.exe
4596	CP.exe
2692	CP.exe
5108	i_ecwuomgebz.exe
6368	eywromgero.sys
2260	CP.exe
2592	trljdbzwto.exe
1720	CP.exe
3668	CP.exe
3028	i_trljdbzwto.exe
2328	geywqomgey.sys
1688	CP.exe
3584	ytqljdbvtg.exe
2768	CP.exe
2148	CP.exe
2144	i_ytqljdbvtg.exe
4864	jdbvtnljdb.sys
4324	CP.exe
6748	jgaytqljdb.exe
6924	CP.exe
5484	CP.exe

Loads dropped DLL 1 IoCs

pid	Process
1256	msedge.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\passwords.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_1275813854\kp_pinslist.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_971616496\well_known_domains.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\english_wikipedia.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\model.markov	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\surnames.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\test.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_1275813854\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_1275813854\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\us_tv_and_film.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\ranked_dicts	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_1275813854\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_971616496\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\female_names.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1256_167595980\male_names.txt	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbzwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspjhczurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wjgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljhbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbzwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbvtg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhecwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wjgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljhbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkigaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbvtg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpmkifz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqojgbvtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqojgbvtoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdbvtnl.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 21 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5992	ipconfig.exe
5040	ipconfig.exe
5056	ipconfig.exe
5192	ipconfig.exe
1936	ipconfig.exe
1872	ipconfig.exe
3336	ipconfig.exe
1032	ipconfig.exe
4932	ipconfig.exe
2500	ipconfig.exe
3944	ipconfig.exe
2056	ipconfig.exe
4660	ipconfig.exe
4516	ipconfig.exe
4832	ipconfig.exe
5952	ipconfig.exe
6452	ipconfig.exe
6292	ipconfig.exe
2296	ipconfig.exe
7108	ipconfig.exe
6852	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2581000985-3042091657-4068028891-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2581000985-3042091657-4068028891-1000\{D178C2ED-8156-4C10-A083-6EE6FFA698D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe
1308	wqojgbvtoj.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	7056	i_wqojgbvtoj.exe
Token: SeDebugPrivilege	6752	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	3888	i_sqkigaysqk.exe
Token: SeDebugPrivilege	2132	i_vsnlfdxvpn.exe
Token: SeDebugPrivilege	1000	i_pkicausnkf.exe
Token: SeDebugPrivilege	6760	i_uspjhczurm.exe
Token: SeDebugPrivilege	5840	i_mkhczurmke.exe
Token: SeDebugPrivilege	5108	i_ecwuomgebz.exe
Token: SeDebugPrivilege	3028	i_trljdbzwto.exe
Token: SeDebugPrivilege	2144	i_ytqljdbvtg.exe
Token: SeDebugPrivilege	1868	i_jgaytqljdb.exe
Token: SeDebugPrivilege	4200	i_qnifdxvqni.exe
Token: SeDebugPrivilege	3188	i_usnkfdxvpn.exe
Token: SeDebugPrivilege	712	i_fdxvpmkifz.exe
Token: SeDebugPrivilege	3444	i_rpmhecwurp.exe
Token: SeDebugPrivilege	6936	i_heczurmkec.exe
Token: SeDebugPrivilege	2332	i_wjgbztrljd.exe
Token: SeDebugPrivilege	6932	i_bztrljhbyw.exe
Token: SeDebugPrivilege	2308	i_tolgdbvtnl.exe
Token: SeDebugPrivilege	4784	i_avtnlfdxvq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 4204	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5504 wrote to memory of 6856	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4204 wrote to memory of 1256	4204	iexplore.exe	90
PID 6856 wrote to memory of 1236	6856	iexplore.exe	91
PID 1256 wrote to memory of 6732	1256	msedge.exe	92
PID 1256 wrote to memory of 2284	1256	msedge.exe	93
PID 1256 wrote to memory of 4880	1256	msedge.exe	94
PID 1256 wrote to memory of 4880	1256	msedge.exe	94
PID 1256 wrote to memory of 4880	1256	msedge.exe	94
PID 1256 wrote to memory of 944	1256	msedge.exe	95
PID 1256 wrote to memory of 944	1256	msedge.exe	95
PID 1256 wrote to memory of 3172	1256	msedge.exe	98
PID 1256 wrote to memory of 868	1256	msedge.exe	97
PID 1256 wrote to memory of 3172	1256	msedge.exe	98
PID 1256 wrote to memory of 3172	1256	msedge.exe	98
PID 1256 wrote to memory of 868	1256	msedge.exe	97
PID 1256 wrote to memory of 868	1256	msedge.exe	97
PID 1256 wrote to memory of 5336	1256	msedge.exe	99
PID 1256 wrote to memory of 5336	1256	msedge.exe	99
PID 1256 wrote to memory of 5336	1256	msedge.exe	99
PID 5504 wrote to memory of 3716	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 1256 wrote to memory of 3220	1256	msedge.exe	101
PID 1256 wrote to memory of 5068	1256	msedge.exe	102
PID 1256 wrote to memory of 3220	1256	msedge.exe	101
PID 1256 wrote to memory of 5068	1256	msedge.exe	102
PID 1256 wrote to memory of 6280	1256	msedge.exe	106
PID 1308 wrote to memory of 6632	1308	wqojgbvtoj.exe	107
PID 5504 wrote to memory of 7088	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 5504 wrote to memory of 6672	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 2836 wrote to memory of 6444	2836	tqljdbvtnl.exe	118
PID 5504 wrote to memory of 4260	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 5504 wrote to memory of 3696	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1576 wrote to memory of 2912	1576	sqkigaysqk.exe	127
PID 5504 wrote to memory of 5624	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 5504 wrote to memory of 1564	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 2072 wrote to memory of 1920	2072	vsnlfdxvpn.exe	136
PID 5504 wrote to memory of 5944	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 1256 wrote to memory of 6836	1256	msedge.exe	141
PID 1256 wrote to memory of 3616	1256	msedge.exe	142
PID 1256 wrote to memory of 5484	1256	msedge.exe	143
PID 5504 wrote to memory of 1704	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4488 wrote to memory of 5488	4488	pkicausnkf.exe	148
PID 5504 wrote to memory of 4628	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5504 wrote to memory of 4840	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 6152 wrote to memory of 6268	6152	uspjhczurm.exe	157
PID 5504 wrote to memory of 6912	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5504 wrote to memory of 792	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 6704 wrote to memory of 2040	6704	mkhczurmke.exe	166
PID 5504 wrote to memory of 2164	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 5504 wrote to memory of 260	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 6756 wrote to memory of 4596	6756	ecwuomgebz.exe	175
PID 5504 wrote to memory of 2692	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 1256 wrote to memory of 532	1256	msedge.exe	182
PID 1256 wrote to memory of 532	1256	msedge.exe	182
PID 5504 wrote to memory of 2260	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 2592 wrote to memory of 1720	2592	trljdbzwto.exe	187
PID 5504 wrote to memory of 3668	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 5504 wrote to memory of 1688	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	194
PID 3584 wrote to memory of 2768	3584	ytqljdbvtg.exe	196
PID 5504 wrote to memory of 2148	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 5504 wrote to memory of 4324	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	203
PID 6748 wrote to memory of 6924	6748	jgaytqljdb.exe	205
PID 5504 wrote to memory of 5484	5504	2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe	208
PID 1256 wrote to memory of 3852	1256	msedge.exe	212

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b6aa9c8f71a0584edb9b3d9181de58b3_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7fff78ffc188,0x7fff78ffc194,0x7fff78ffc1a0
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,15421606372233460593,6631516081047235407,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,3829587623659418796,410890130654359058,262144 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
      4⤵
      PID:4880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12200079886424569350,3396889508647330274,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:13
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,10566756335459765063,523916263000229643,2097152 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16880091322382170176,12754334547865364723,2097152 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3484,i,12871599112099925211,15003931069181995181,2097152 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,12978274445984652236,13800531474394122163,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,16633603866806778778,8856001657398444438,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:5068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,2628415993448110996,2559995115512918413,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,2628415993448110996,2559995115512918413,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
      4⤵
      PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,15763430260511774610,2475732440152244225,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:6836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,8604899388242039317,608374037204373614,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12262758475342129602,13705388450295566425,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,8810255561481192145,11288472964004182382,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:14
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,14412555562501131312,1622216864028530500,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,12484470050641990553,7373930835506194717,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:6368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5356,i,7662267287556466399,17457020682221055951,262144 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:10
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,7847794241948173446,1611499393904683607,524288 --field-trial-handle=2596,i,404418609019525920,8674119999658737728,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:14
      4⤵
      PID:2420
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:1236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqojgbvtoj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3716
- - C:\Temp\wqojgbvtoj.exe
    C:\Temp\wqojgbvtoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqojgbvtoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:7088
- - C:\Temp\i_wqojgbvtoj.exe
    C:\Temp\i_wqojgbvtoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6672
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkigaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3696
- - C:\Temp\sqkigaysqk.exe
    C:\Temp\sqkigaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkigaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5624
- - C:\Temp\i_sqkigaysqk.exe
    C:\Temp\i_sqkigaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnlfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1564
- - C:\Temp\vsnlfdxvpn.exe
    C:\Temp\vsnlfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnlfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5944
- - C:\Temp\i_vsnlfdxvpn.exe
    C:\Temp\i_vsnlfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkicausnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1704
- - C:\Temp\pkicausnkf.exe
    C:\Temp\pkicausnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkicausnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Temp\i_pkicausnkf.exe
    C:\Temp\i_pkicausnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspjhczurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4840
- - C:\Temp\uspjhczurm.exe
    C:\Temp\uspjhczurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspjhczurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6912
- - C:\Temp\i_uspjhczurm.exe
    C:\Temp\i_uspjhczurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczurmke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:792
- - C:\Temp\mkhczurmke.exe
    C:\Temp\mkhczurmke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczurmke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2164
- - C:\Temp\i_mkhczurmke.exe
    C:\Temp\i_mkhczurmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgebz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:260
- - C:\Temp\ecwuomgebz.exe
    C:\Temp\ecwuomgebz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgebz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2692
- - C:\Temp\i_ecwuomgebz.exe
    C:\Temp\i_ecwuomgebz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbzwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2260
- - C:\Temp\trljdbzwto.exe
    C:\Temp\trljdbzwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1720
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbzwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3668
- - C:\Temp\i_trljdbzwto.exe
    C:\Temp\i_trljdbzwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbvtg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\ytqljdbvtg.exe
    C:\Temp\ytqljdbvtg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbvtg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2148
- - C:\Temp\i_ytqljdbvtg.exe
    C:\Temp\i_ytqljdbvtg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgaytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4324
- - C:\Temp\jgaytqljdb.exe
    C:\Temp\jgaytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgaytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5484
- - C:\Temp\i_jgaytqljdb.exe
    C:\Temp\i_jgaytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifdxvqni.exe ups_run
  2⤵
  PID:5736
- - C:\Temp\qnifdxvqni.exe
    C:\Temp\qnifdxvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifdxvqni.exe ups_ins
  2⤵
  PID:6580
- - C:\Temp\i_qnifdxvqni.exe
    C:\Temp\i_qnifdxvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkfdxvpn.exe ups_run
  2⤵
  PID:2492
- - C:\Temp\usnkfdxvpn.exe
    C:\Temp\usnkfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkfdxvpn.exe ups_ins
  2⤵
  PID:1804
- - C:\Temp\i_usnkfdxvpn.exe
    C:\Temp\i_usnkfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpmkifz.exe ups_run
  2⤵
  PID:5296
- - C:\Temp\fdxvpmkifz.exe
    C:\Temp\fdxvpmkifz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:7064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpmkifz.exe ups_ins
  2⤵
  PID:3580
- - C:\Temp\i_fdxvpmkifz.exe
    C:\Temp\i_fdxvpmkifz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhecwurp.exe ups_run
  2⤵
  PID:5924
- - C:\Temp\rpmhecwurp.exe
    C:\Temp\rpmhecwurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhecwurp.exe ups_ins
  2⤵
  PID:3300
- - C:\Temp\i_rpmhecwurp.exe
    C:\Temp\i_rpmhecwurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\heczurmkec.exe ups_run
  2⤵
  PID:1896
- - C:\Temp\heczurmkec.exe
    C:\Temp\heczurmkec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1800
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_heczurmkec.exe ups_ins
  2⤵
  PID:6964
- - C:\Temp\i_heczurmkec.exe
    C:\Temp\i_heczurmkec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wjgbztrljd.exe ups_run
  2⤵
  PID:5916
- - C:\Temp\wjgbztrljd.exe
    C:\Temp\wjgbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wjgbztrljd.exe ups_ins
  2⤵
  PID:5792
- - C:\Temp\i_wjgbztrljd.exe
    C:\Temp\i_wjgbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljhbyw.exe ups_run
  2⤵
  PID:1000
- - C:\Temp\bztrljhbyw.exe
    C:\Temp\bztrljhbyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljhbyw.exe ups_ins
  2⤵
  PID:3588
- - C:\Temp\i_bztrljhbyw.exe
    C:\Temp\i_bztrljhbyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgdbvtnl.exe ups_run
  2⤵
  PID:3260
- - C:\Temp\tolgdbvtnl.exe
    C:\Temp\tolgdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgdbvtnl.exe ups_ins
  2⤵
  PID:1264
- - C:\Temp\i_tolgdbvtnl.exe
    C:\Temp\i_tolgdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdxvq.exe ups_run
  2⤵
  PID:2012
- - C:\Temp\avtnlfdxvq.exe
    C:\Temp\avtnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdxvq.exe ups_ins
  2⤵
  PID:5180
- - C:\Temp\i_avtnlfdxvq.exe
    C:\Temp\i_avtnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnlfdxv.exe ups_run
  2⤵
  PID:2400
- - C:\Temp\cavsnlfdxv.exe
    C:\Temp\cavsnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5952

C:\Temp\yvtoljdbvt.sys
C:\Temp\yvtoljdbvt.sys
1⤵
- Executes dropped EXE
PID:6756

C:\Temp\aytqkidayv.sys
C:\Temp\aytqkidayv.sys
1⤵
- Executes dropped EXE
PID:6588

C:\Temp\axsqnlfdxv.sys
C:\Temp\axsqnlfdxv.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\pnhfzxspkh.sys
C:\Temp\pnhfzxspkh.sys
1⤵
- Executes dropped EXE
PID:6424

C:\Temp\xrpmkicaxu.sys
C:\Temp\xrpmkicaxu.sys
1⤵
- Executes dropped EXE
PID:4896

C:\Temp\mkecwupmhe.sys
C:\Temp\mkecwupmhe.sys
1⤵
- Executes dropped EXE
PID:3988

C:\Temp\ecwuomhezw.sys
C:\Temp\ecwuomhezw.sys
1⤵
- Executes dropped EXE
PID:7056

C:\Temp\eywromgero.sys
C:\Temp\eywromgero.sys
1⤵
- Executes dropped EXE
PID:6368

C:\Temp\geywqomgey.sys
C:\Temp\geywqomgey.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\jdbvtnljdb.sys
C:\Temp\jdbvtnljdb.sys
1⤵
- Executes dropped EXE
PID:4864

C:\Temp\nifdaysqnl.sys
C:\Temp\nifdaysqnl.sys
1⤵
PID:3896

C:\Temp\icayvqniga.sys
C:\Temp\icayvqniga.sys
1⤵
PID:2556

C:\Temp\icausmkfcx.sys
C:\Temp\icausmkfcx.sys
1⤵
PID:7048

C:\Temp\smkeczurpk.sys
C:\Temp\smkeczurpk.sys
1⤵
PID:1960

C:\Temp\hezwuomjec.sys
C:\Temp\hezwuomjec.sys
1⤵
PID:3924

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
PID:5456

C:\Temp\ywqomjebzt.sys
C:\Temp\ywqomjebzt.sys
1⤵
PID:6000

C:\Temp\qolgdbvtqo.sys
C:\Temp\qolgdbvtqo.sys
1⤵
PID:932

C:\Temp\igaytqljdb.sys
C:\Temp\igaytqljdb.sys
1⤵
PID:3148

C:\Temp\idaysqnigd.sys
C:\Temp\idaysqnigd.sys
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqnlfdxv.sys

Path C:\Temp\axsqnlfdxv.sys
Size 141KB
SHA256 c694ef4d70439b6b3812475bdc9ba5d74067d40b1a1efbb3372052c2495c2a57
MD5 e6187515198fd88a0bed834d2c529a59
SHA1 78de549532dd049476cbecf0829ff319a2f9f55e
SHA512 b865803f1d9467268e49bf93e5937bb7f378d7d39cd7fa072d8e76ae2fc256791e469cff76bcc3e2839e74ce79ea01e103aa95a1e6709a60c3a9ba9c2fb25099
SSDEEP 3072:DsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:DsQmpcF8BzXfwV
TLSH
T181E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqkidayv.sys

Path C:\Temp\aytqkidayv.sys
Size 141KB
SHA256 d7cc58df00c62112e4d896a66d8b39eeca3176987dd112e3e7e138e450ad0e6b
MD5 52e7c5dde1eaf03ca8a90f8e809988dd
SHA1 ef72d44708522f03650292a6daedf3fb8a6ca145
SHA512 092c12509c9e6a61c6f0b972d0d99c8bd105093b10b5e7d2c5077f18a18247eb4227bf72cc27e00c9451b4ff4cfe241ce27c6d63064bc8873d4cde9131c401c0
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T1A5E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pkicausnkf.exe

Path C:\Temp\i_pkicausnkf.exe
Size 230KB
SHA256 5cf7601f3f9fc06ee3b27f9c1d4cb1df4caa12a4b6c9e11424ed8436c0c5c9e4
MD5 73da96ef9069b4497fe7bb5725671e57
SHA1 1b63c13a0dc7dd07d76c45d09d1f74abd5302d9e
SHA512 a6f095e44152510e5855602e0fe3fe2bcdce2935620324d9392f4e44d6154065bcbcda72cb2fdf3f66d36ddf0c0cd2726e913fd30281504211921b7f50fd514e
SSDEEP 3072:tJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:tghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkigaysqk.exe

Path C:\Temp\i_sqkigaysqk.exe
Size 230KB
SHA256 0664493bcb7f43fc030f4fff0487338407243cd5c4a3769b8be97d21dda47061
MD5 0d2b9eac6f25c1d68c7c436d76fac804
SHA1 cdfc7fe09fb96955ab3c018c1c310ade26e58e20
SHA512 c4110aff5d0bf51c6659d6229fe56db7318f8dd88e7aeceb039fe3372555048d45f0958ff59017d8973c2fcf14f1ec549323f45e763edfabd2b44f95f71efe60
SSDEEP 3072:+JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:+ghLQ0sQmpcF8BzXfwVfAI
TLSH
T109344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvtnl.exe

Path C:\Temp\i_tqljdbvtnl.exe
Size 230KB
SHA256 3e6f320b1d55f51cecb91003079a09a39a17a1eb3d7bba079621012e091e45be
MD5 c0eb12e09e72a6e393e8b05e10d22fad
SHA1 4a7f17cb72b12b572adfb3261e84b59b0f161d44
SHA512 98a67a1d6ee7d69ef93b1a2fb79e20aa3b33b366f33ea0e1583796ef65834d90d4697feafe66f6700e9fbadd5439113c5b9e8f17eefc29d73afefbc8bcad75c9
SSDEEP 3072:tJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:tghLQ0sQmpcF8BzXfwVfAI
TLSH
T142344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspjhczurm.exe

Path C:\Temp\i_uspjhczurm.exe
Size 230KB
SHA256 cfd102dd6860906510a2758148885c044b9e801f07bdab239a24803ba32689bc
MD5 2ffff75c660a5cd0019b1dada7c623f9
SHA1 c961f10dbc60e00595cbdc2222e076abef488687
SHA512 6aedbdf4c371d9853796e763c972da600fbe39f6238ad4c78dd6631f2eaaec5a775bdd66e0aa9f8be8d835eda7495c1f44c0b10a967f562c3899a8712e58018f
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnlfdxvpn.exe

Path C:\Temp\i_vsnlfdxvpn.exe
Size 230KB
SHA256 4ba3899a349379a67d9dfa6860db3bbe67d40f1359a9bcd9aff120e75703d562
MD5 9c00710b4f3ebd2a33ec54ab6453bd5b
SHA1 c69e2e1425d065f3ea34fbe30886d676633c36cd
SHA512 4de4873bfccf7e4faf76b09717d1c19ec68c23e127f74198d7684fc655af8b93f89aa8a66cfe4fa8a19bb49f3371bf41c9d2d62d90dca3d0f929ccd7a2d67232
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T14B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wqojgbvtoj.exe

Path C:\Temp\i_wqojgbvtoj.exe
Size 230KB
SHA256 30c01d3f40c14ef434fcc8a621c4771b0b64d27be9bb44d23f6c6783cbd0fe3e
MD5 3a61619ad8638d558223b6785399774c
SHA1 69b5edbd81befba18183d692202e7c348e0745ab
SHA512 f0753e0ef0259c913532cede5215ebbfa510c7bbb90caf4bcee9690bc86d027ba70b5003dc2ae81ce67181df7049ac18d5952389766927ca29fdc1aabcf7e10b
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T124344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecwupmhe.sys

Path C:\Temp\mkecwupmhe.sys
Size 141KB
SHA256 73462a4aa725a3ad2b082e630b2f2f6fb16546f5898ddf155d2ddc18fae98e38
MD5 54a89f4c48b45c1a60b6564d4136e3b5
SHA1 122d05d278ab7a3965a54959800891dea39d121b
SHA512 f76bde5c38f09c6da24efa7daaa718e1099b25ae5340e33503c4a1dbd0a2767258b107ef2ff5461a846baea93641121418af7ab6cd0e1aba410658b5240e95de
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T168E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczurmke.exe

Path C:\Temp\mkhczurmke.exe
Size 230KB
SHA256 bcdbd1d281b09e385cb3c145cc758f9f295ab62df081725216554589fcd11e88
MD5 de1638e4a66269ff13773f784937781b
SHA1 7474be06b891457b960a45a40091f4821e2f00e9
SHA512 c90d6c553cf6df8fb461a4f4094d001b6616a8623e450882eaf9ec61a0898c72df0f0933a42d31c54e2d58a6272a417a5254570373e83f3e8efbd59297b1658d
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T14A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausnkf.exe

Path C:\Temp\pkicausnkf.exe
Size 230KB
SHA256 ef56ebfbb6ef1389470be9225ffa722c151878e4785a99f470b1e669e1b6eefa
MD5 b98997a4b11f850072a335098966da0c
SHA1 f33c634ef3daa64445740781ca30707a10c594c8
SHA512 c568d4bec07684b7b2e7ab98dbcab65915f154a1a336ff8306fa4b96e8d85252cb95a1161f31aeaf032914813df12cbab2d1b63218af7ec60f8ce58444801c91
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspkh.sys

Path C:\Temp\pnhfzxspkh.sys
Size 141KB
SHA256 1c301ef4226fa81e75ba755b01d3b5cdf2a1f676aeaef0a836ff9784870b5df0
MD5 a5d0b83cea825018b3edf4a998624469
SHA1 07f64e86879e37fe1bfd545ba73230ecff529d66
SHA512 2c1c3b7e00cedac0fb34ef034a4d829476647d306b3654d7f5ad20fd638171d09e1cc098adf89676d01080d5df4b24be9337479178ffbdc09522e29864403c79
SSDEEP 3072:OsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:OsQmpcF8BzXfwV
TLSH
T1CBE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkigaysqk.exe

Path C:\Temp\sqkigaysqk.exe
Size 230KB
SHA256 5b12a91cb1f1b65e16b6c9435b97f54ce5c7eca8c2915a6ecd6a0e18eda286b6
MD5 12eb114db064021e5d8ce3f0ed088428
SHA1 9c8ed4e11f84682051d3cce28d0eb21ed7bff729
SHA512 1991fec5125b23e67653a9f5c53a52c4350d6918ea44cbd40603043aba4183e48348c0b5ecf25fd3dfb8ced2498ac5483fa40919fb4a461bbfd02cc49f8342b9
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvtnl.exe

Path C:\Temp\tqljdbvtnl.exe
Size 230KB
SHA256 b153f01884b0a6f7914f2bd91b77b1ee4ff7a48f6e91f3148a4fed3d83eb18e0
MD5 6b8f55934eb66f4220d74ffd79e3807a
SHA1 b185afabc87e73c9ad9031e089556f7f4a56e7b7
SHA512 f7bc436d45809067b692189f023f5e8d7c5bf5e74877cd18737aa822f3c0d68ac7ba889205f87e4456095f3c5a4c91a115282fba56512b75b17b089c263a4690
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T169344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspjhczurm.exe

Path C:\Temp\uspjhczurm.exe
Size 230KB
SHA256 7803d676793e703a3adc31a86e8753ae84273b1e52d7517d7ce1e654972f19a3
MD5 c0ad8e0b0ac71d263b7fd2eafe3739b1
SHA1 c8f5b2a3b62fbb80c2271d7858875a9e5735ca1f
SHA512 f4976897fee704a05fa90e2373d47444f6b9ff16addb8f39f3ce14128bbfffbe956ee16c5988ea4a121c7f21b279de39041f04d6d91779bcd819ca711c31f9a1
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvpn.exe

Path C:\Temp\vsnlfdxvpn.exe
Size 230KB
SHA256 c393ecb3d8c672c19edbc1516e01edcc87b5768290bed274c64de855c0ec5054
MD5 a445c9143934d27397bba210c469fbb9
SHA1 10b06774d7232b344f7aa494949c19114d479e5b
SHA512 1ededce4e431f0baaddee5208ab5c34b75d995a5708a34375736e993ff0acc71a5932f675b9be04015b00d44405bf97e5ed66f6fc84244ca26a0ca19e530e54c
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T138344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wqojgbvtoj.exe

Path C:\Temp\wqojgbvtoj.exe
Size 230KB
SHA256 c7a02ad9fdbcef7fea00b09ed950dd87f0564a108f52f04d45e366c51f55b8df
MD5 4f8066a5684b5b9b8a2054e158f192a4
SHA1 48494a12dff9fd40c43b0376ac3049be261e289e
SHA512 a78d462098f70cb0cc4ea111e85cbf54b0fc44878854169b3772234aa1f5b238eae132d264ad7b317893234d06bb99149458eb55aabf51038e40488233a54441
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T184344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpmkicaxu.sys

Path C:\Temp\xrpmkicaxu.sys
Size 141KB
SHA256 ed7bd2b68c28143748b89b014296fa6b40631efdddf082f75c3f52462a623927
MD5 361eec60fc4d5cd466a8165c166ec27e
SHA1 0fdc4497737ecc3488538c423a9396760dd8e0cc
SHA512 b9d11c7eb7e49879cf1160cd0bd0c82ff47193a04000ee5c1ce5d5313c84315c3420ebbc0381e51f0c50166acef2c00643b2e5f478fa4af8815aa78fc23320a7
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T1F8E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtoljdbvt.sys

Path C:\Temp\yvtoljdbvt.sys
Size 141KB
SHA256 ba6e989382cc8be742f8cd068743c016df14a16ee3318d68f4a51a3d3858e78d
MD5 bb2c7cf5f2870f3240dd1db41830146b
SHA1 b278034d468e4a222aa9b944aff5ea8acd284e32
SHA512 bc3bdc1562af48257225e44b3e1182abb6ecc0df070773f43a7d5c3660b7f9c63d6bf4ee8970ae7ff6306917257ff059d0c5669430714c46ee3aedae452b2263
SSDEEP 3072:osQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:osQmpcF8BzXfwV
TLSH
T156E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a068243c4584907cd5534c5544cd99e57be64a6790401ecb34e138b941be50d8
MD5 487201c9d5f8581b404c328a57b95064
SHA1 9118509fc3137d34e8bd3939f3883afe9e9beffe
SHA512 6e13ca057d8cd084911b83c51e96582deab6bc970f1d4d15642021e2d461c0a71257fc4e9734447735b2fbe584808ce6833fbe556372a5954dea7135d7b571e7
TLSH
T1E8D080747F18B841C5D53571553B8700BE964116355FC645F052D10C4C398E5FBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55097ae3e8e09b80bce3e3812987755ecca81384247ee729ac4262e176ac5f09
MD5 c1487ee49f8ccdda3c17fbfc8fc5855d
SHA1 22e1d68df0a4913cac107ff5af4cb564d869972f
SHA512 cdb748df700c498fc821f44fbc432a65b818ee7361fa8899d196bb2c32c7c86bd90573282a6465e8a2d722cbc27ecdf3b960978409d4ad6fc7fe8483e801e91f
TLSH
T1FFD0C0703F08B841C5D4313045378700BE924116340FC200F052C10C4C398E4BBD7297
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 298dbfd720b4c23219184ee34c22486818d53dc1cb117db25400c864c8cddcb6
MD5 7972c23af2eeeeb9f7a4aeb624c7087d
SHA1 f5f4330c0c62758acc19c539c5880471cc9e56e7
SHA512 5908210aac901fef9eff627fa7b5b46b45b9a613aeed72265a21f77e6f607324b37fabf98b92bcf04cdc5d42a687cf4bcbba9ff6fd21ca754a9b5d5b5c4fce05
TLSH
T122E022BAD821EC6B18F90B5961A4024AEB5613172A40496BBA3C810D8FF163A128A86C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b433db0198fe3e3380d1ea3d86b16d89249d4f83af2846de66e55427cd4bb5bb
MD5 98d8a072a51e1888859991d5545651a3
SHA1 58b83e0c514f16e3ea0f34c57a5f6241c6e74158
SHA512 63cd3aefacc4384153b07b798f4385aa1da59db5b575339e3b3175267aae6f1dc1ff445cbd840f07e606b7ffc46b85e2364fbed0a75aaafb6812148c09c76ede
TLSH
T14241CFF783E4856EC91156F0AA18BE2FDE1C0511832C3D59C9E0AF1793E3071E142A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 a020c1bda3cf9ecf776dfcead02231187170598a5b3702af13b2cf6b0138ef22
MD5 c3235f753c970fbf86874388f89e35f1
SHA1 b2654549d0142a029a344ad6e2d7db00301f5115
SHA512 5c6a636347c1e065e318f357e3bbcfc45010f100b8e0be8c6f9ccbfe6d65e62bbc15ae12e0f0db3a01c6ed56cc02bec6f7700a192f873f51290835228c29b37a
SSDEEP 192:sxRkRTyMqZjK1Ml8UQPce/f2sqK7Z5Oh+2NyzoA8prQ/g6+WNCYgfYYctvTOGBIw:sxRkMqEe/f2sqK15OhvN/0/5SfavT77L
TLSH
T1F072D8166A34997B8CDBD219FA857B63D6F81563A2944E44AEFC8B0C01E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef59c9da66a31780ecf115b76946726bd795b751075d2e7d4c7e5cebc7e4d68a
MD5 8faea87570b3610ae6259845f6672200
SHA1 d6c7adde429f90ae6ddf0991b01e72e88b2a2315
SHA512 ceeb29032da889ac1e8025778feff9f6ca9d83dbb8d8de8eecfad8475bfb7cea48e936ac9b0c671f445a93fc551734c9c4e4e0328953d5a3cba6f11802b05d43
SSDEEP 192:sxRkRTyMqZjK1Ml8wce/f2sqK7Z5Oh+2NyzoA8prQ/g6+WNCYgfYYctvTOGBIgjz:sxRkMCe/f2sqK15OhvN/0/5SfavT7jz
TLSH
T1CC72D8166A34993B8CDBD219FA857F63D6F81563A2944E44AEFC8B0C11E76DC211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3570a661839f7f935b32d36a45ff3b7eeff9a2aa716d8c0d28e8f2608cbc3cce
MD5 068030ba440496725c978f10a6ff8ad9
SHA1 12ffa0dbea331d89305b5964819e531054d62044
SHA512 e1b1ba771f61e92444bfb87e0173e14bbe9228c5c4dd771af83a2bfc24f7d3dda2ea445e845a9408b49279da0f336a59d863a66d3b0e6f7b232f7864b84ed10e
SSDEEP 768:57pWlr7pLuL7S3WgTXf0F8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGAVdRtAroYA/Mo:57pWl9E7S3WgTXf0Fu1jaxAVntLYA/5
TLSH
T179E2FC7B684CC77F4F804E9CE8297E9E6DE802CF56D8895447EA840C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 a5b8979efeb18d2ec7058955a7b5927286b1e8fc317a5e87a11ea6ad1c3fae6f
MD5 62d7ec5e3453c2056e6867a7553d3fb2
SHA1 158a18f87a205acb4a7b93fffd6727e929d63c38
SHA512 8b9f432f76368d4de6c20a56641454b25884edbf945a2353417b62beac620766f1c115f640c62d97ca717b7ca19450e44b26b8e9665fc038eb0a360efb2d00d2
SSDEEP 384:97SnL5NRMtAPjvR3R8LLAZrK610IK4cZ0/IAie3+7S6nkM94Z9Lr76TmtNFn3v24:ShJtf3BlQ1KbhJv3Cdq
TLSH
T169B26151307B2B00387D250E93B8841E5A4630A630DEF86B77A975E26F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f216ca531cb06a1e39f1c2a607007a86363962cded53f8761c1c6686054ea440
MD5 73496a5ccfd32327d449460620b60d47
SHA1 d372dc8c0b8688c6e614ad1401e38325ac8efa25
SHA512 0739d81a8ceaf3bca664aa694ee2781887e8f33b9c8349ffea178316842a85c4fa966345a200a5c59fa4f03e97c87382801de0a532c5687e4a13f36026b1a910
SSDEEP 768:aF1j+9Sbwg3bRlGrWlGNgimhLE6mn12bfJM:/9S9cgim50yJM
TLSH
T1C0C24A32D854CE67ADE78BC9B74A778AEEE011A385CC59D4DAD84E4C01C72DD130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf927b7d6759d8d87ee9a99023f2b697bc4edcb47920fd2e35889b0589c3f56f
MD5 710a67973ebe255c888fb1324725a341
SHA1 5b955c855100646d6297c450cdb65151aa5c9acc
SHA512 76af5feb4290f69adfbe7e443e5ddffbe39f4c56cc584548249ba73737d31fc535d74a054b0d747021b80f50f83a5e09c29ef35edbab6d8e26f649b1703bd7a8
SSDEEP 768:nF1j+9S4wg3bRlyrWlGNgim1xmn12bfJM:O9Ss4gim30yJM
TLSH
T12CC24936D894CEA7ADE78FC9B74A774AEEE052A781D819D4D9D84E4C01C72DD0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0877741d146671311806f4fdbde870589d1ecf74c93a83a60f768852555bddf3
MD5 a059ecc6617b389c8cbead10c41de883
SHA1 92fc219b5970a72993bd513cad85fc2a86ee40d0
SHA512 b78e70febf59d1919bc3de673d0a9d228aa84228c5c1b3d486a0a8abffe03e98c5267437e0acc3c8e00fcb335aebffe877750503f61828e4ab60228b2e159b0c
SSDEEP 768:oF1j+9lbwgPbRlSBJWlGNgimhLv6mn12bfD:F9lBogimk0yD
TLSH
T157E2B4F198D78977E89E8B8B677D2E4699FCC163B4881994BBD84D4CCC821BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0a70074-dde5-4316-a7a9-4d989e4fd7c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e0a70074-dde5-4316-a7a9-4d989e4fd7c4.tmp
Size 1KB
SHA256 b3368f64ac6f5e940e1b7b688c9708592aa2920757b5c2cb84e58bb13ba3c690
MD5 bd0196898e9cd08b8479c12e3a847612
SHA1 e2b1b37a258f4d36857935e8424a09b576fcc7d5
SHA512 0830bac846e607f94c91245f29210075b566f459719fef8efef3baa99cd1a024a4e20591b4fb10fcce4b02f7002b283a012bc4de7c19f289caa96c3e6a0c0584
TLSH
T14A3140E088383ED1D4BE096F308B24FC94D8CB26F554347D6858E988467A65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 58becbcdd5a8415e62c320caa1feee1cfd1003afa1caea2b3e24e56b79bbbe07
MD5 239dd0ecf7b269543d0732c6942b125e
SHA1 e02f0be41bbf97cb5960dd9d7ca2ab35e55b97f9
SHA512 5c89ede1c67d429b538ca1cd4c8557d88adf1965490214c38c56704168a7251dd0a66ee44c8523315823ea1dcb2841acad56e80c0c8fcfa7ec43ba8bf92914ed
TLSH
T16E316FE08C383ED2E4BE096F709B24FC94D8CB2AF4A4347D2858E988427D65D658083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 ec8c4b09ce6de17fb078db345fbea35a30b1a3c0cb334cd750428329db6f0e3a
MD5 20f64edfaa47076a575a1b6e048e68c3
SHA1 e472542ea8b290c541f3cbda26f455869c3c0655
SHA512 d4dad4d3f3ad988cf0e2ba4fa33a441ec9feb629d682fc6da099e50539937b88f24e7577277757ba5c401d34954dd5406a834400a99002e36b411604b98deb99
TLSH
T1A3312EE088393ED2D4BE0CAF708B24FCA8D8C726F594347D6864E999813D55D6A8083F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1960-356-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-214-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3148-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3488-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3924-367-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3988-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4864-312-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4896-243-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5456-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6000-392-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6368-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6424-227-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6588-194-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6756-159-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7048-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7056-287-0x0000000000010000-0x0000000000083000-memory.dmp

Download