systex | 6b59e7a85ff5ae84b1c982a7bf5ae02b8f3347372350bb46ab93cd2045810776

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260702-qmrm4ae18w
SHA256 6b59e7a85ff5ae84b1c982a7bf5ae02b8f3347372350bb46ab93cd2045810776
MD5 42749cb7b325f5157307fbf36dacc510
SHA1 98991943eaecc95a49a848f352919d80e087cf28
SHA512 c8755efec3f72be5014be6ae3793395f05f714c6e319f3a4b5d8c78741612a8448a3d2006cc0e96d24e3e50577bdbaa3ca921ad9892c703e722980204e49d409
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3068	CP.exe
2960	pnhfausmfz.exe
6052	CP.exe
4880	CP.exe
3956	i_pnhfausmfz.exe
5856	jhfzxrpjhf.sys
2556	CP.exe
5612	jhecwusmjh.exe
2452	CP.exe
1312	CP.exe
4900	i_jhecwusmjh.exe
5460	eczusecwuo.sys
4824	CP.exe
3788	rmjebwurmj.exe
3660	CP.exe
1740	CP.exe
1496	i_rmjebwurmj.exe
4428	trmjecwuom.sys
3832	CP.exe
4568	trljheuolj.exe
2864	CP.exe
3656	CP.exe
5716	i_trljheuolj.exe
688	ztrljdbywq.sys
4404	CP.exe
2856	tomjdbwtom.exe
5788	CP.exe
256	CP.exe
5996	i_tomjdbwtom.exe
4168	idbvtnlfdb.sys
2608	CP.exe
2020	gbvtnlfdyv.exe
5164	CP.exe
5432	CP.exe
4208	i_gbvtnlfdyv.exe
5548	aysqlavtnl.sys
4164	CP.exe
5328	nlfayvpnif.exe
5872	CP.exe
916	CP.exe
4212	i_nlfayvpnif.exe
2124	vtnifdxvpn.sys
1184	CP.exe
3972	vtnlfdxnif.exe
6088	CP.exe
5776	CP.exe
5572	i_vtnlfdxnif.exe
5400	xspnkfcxus.sys
4612	CP.exe
200	vpnhfaxspk.exe
4536	CP.exe
4616	CP.exe
4632	i_vpnhfaxspk.exe
5892	hfcxupmhfz.sys
5700	CP.exe
2280	eczusmkecw.exe
5056	CP.exe
5380	CP.exe
4468	i_eczusmkecw.exe
5956	mkeczuspmh.sys
5544	CP.exe
4084	ecwurmjhez.exe
6076	CP.exe
2808	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1470072173\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1954652300\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1954652300\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_285201653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1470072173\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1954652300\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_1954652300\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_323920762\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1264_323920762\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljheuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomjdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfayvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupnhfzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfayvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhecwusmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrpmjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfausmfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjdbywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwusmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhecwusmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljheuolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfausmfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomjdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrpmjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebvtqoigd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjdbywrojg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5084	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5568	ipconfig.exe
2920	ipconfig.exe
5756	ipconfig.exe
1516	ipconfig.exe
1376	ipconfig.exe
3776	ipconfig.exe
1736	ipconfig.exe
3920	ipconfig.exe
3192	ipconfig.exe
4136	ipconfig.exe
4408	ipconfig.exe
2184	ipconfig.exe
2188	ipconfig.exe
3732	ipconfig.exe
2580	ipconfig.exe
5144	ipconfig.exe
5960	ipconfig.exe
3196	ipconfig.exe
248	ipconfig.exe
5956	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274721896747430"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{37A8C391-03CB-4BDC-804D-3D79E9042109}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe
2960	pnhfausmfz.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	i_pnhfausmfz.exe
Token: SeDebugPrivilege	4900	i_jhecwusmjh.exe
Token: SeDebugPrivilege	1496	i_rmjebwurmj.exe
Token: SeDebugPrivilege	5716	i_trljheuolj.exe
Token: SeDebugPrivilege	5996	i_tomjdbwtom.exe
Token: SeDebugPrivilege	4208	i_gbvtnlfdyv.exe
Token: SeDebugPrivilege	4212	i_nlfayvpnif.exe
Token: SeDebugPrivilege	5572	i_vtnlfdxnif.exe
Token: SeDebugPrivilege	4632	i_vpnhfaxspk.exe
Token: SeDebugPrivilege	4468	i_eczusmkecw.exe
Token: SeDebugPrivilege	5808	i_ecwurmjhez.exe
Token: SeDebugPrivilege	3804	i_cztrpmjebz.exe
Token: SeDebugPrivilege	5868	i_mjdbywrojg.exe
Token: SeDebugPrivilege	2668	i_gebvtqoigd.exe
Token: SeDebugPrivilege	5536	i_ayvqoigayt.exe
Token: SeDebugPrivilege	2848	i_lidavsnlfd.exe
Token: SeDebugPrivilege	4632	i_xvpnhfaxsq.exe
Token: SeDebugPrivilege	1056	i_pnhfzxspki.exe
Token: SeDebugPrivilege	2076	i_zxupnhfzxr.exe
Token: SeDebugPrivilege	1224	i_pjhezwusmj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 6036	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 1992 wrote to memory of 5916	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5916 wrote to memory of 2176	5916	iexplore.exe	92
PID 6036 wrote to memory of 1264	6036	iexplore.exe	91
PID 1264 wrote to memory of 1168	1264	msedge.exe	93
PID 1264 wrote to memory of 5084	1264	msedge.exe	94
PID 1264 wrote to memory of 5972	1264	msedge.exe	95
PID 1264 wrote to memory of 5972	1264	msedge.exe	95
PID 1264 wrote to memory of 5972	1264	msedge.exe	95
PID 1264 wrote to memory of 5720	1264	msedge.exe	96
PID 1264 wrote to memory of 5720	1264	msedge.exe	96
PID 1264 wrote to memory of 2708	1264	msedge.exe	98
PID 1264 wrote to memory of 2708	1264	msedge.exe	98
PID 1264 wrote to memory of 2708	1264	msedge.exe	98
PID 1264 wrote to memory of 5148	1264	msedge.exe	99
PID 1264 wrote to memory of 5148	1264	msedge.exe	99
PID 1264 wrote to memory of 5148	1264	msedge.exe	99
PID 1264 wrote to memory of 5188	1264	msedge.exe	100
PID 1264 wrote to memory of 4540	1264	msedge.exe	101
PID 1264 wrote to memory of 2680	1264	msedge.exe	102
PID 1264 wrote to memory of 5188	1264	msedge.exe	100
PID 1264 wrote to memory of 5188	1264	msedge.exe	100
PID 1264 wrote to memory of 4540	1264	msedge.exe	101
PID 1264 wrote to memory of 4540	1264	msedge.exe	101
PID 1264 wrote to memory of 2680	1264	msedge.exe	102
PID 1264 wrote to memory of 2680	1264	msedge.exe	102
PID 1264 wrote to memory of 4452	1264	msedge.exe	103
PID 1264 wrote to memory of 4452	1264	msedge.exe	103
PID 1992 wrote to memory of 3068	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2960 wrote to memory of 6052	2960	pnhfausmfz.exe	108
PID 1264 wrote to memory of 2444	1264	msedge.exe	111
PID 1264 wrote to memory of 5360	1264	msedge.exe	112
PID 1264 wrote to memory of 2444	1264	msedge.exe	111
PID 1264 wrote to memory of 5360	1264	msedge.exe	112
PID 1264 wrote to memory of 3680	1264	msedge.exe	114
PID 1264 wrote to memory of 5432	1264	msedge.exe	115
PID 1264 wrote to memory of 5432	1264	msedge.exe	115
PID 1264 wrote to memory of 2500	1264	msedge.exe	118
PID 1264 wrote to memory of 2500	1264	msedge.exe	118
PID 1992 wrote to memory of 4880	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 1992 wrote to memory of 2556	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 5612 wrote to memory of 2452	5612	jhecwusmjh.exe	125
PID 1992 wrote to memory of 1312	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1992 wrote to memory of 4824	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3788 wrote to memory of 3660	3788	rmjebwurmj.exe	134
PID 1992 wrote to memory of 1740	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 1992 wrote to memory of 3832	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4568 wrote to memory of 2864	4568	trljheuolj.exe	143
PID 1992 wrote to memory of 3656	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 1264 wrote to memory of 916	1264	msedge.exe	149
PID 1264 wrote to memory of 5744	1264	msedge.exe	150
PID 1264 wrote to memory of 1228	1264	msedge.exe	151
PID 1992 wrote to memory of 4404	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2856 wrote to memory of 5788	2856	tomjdbwtom.exe	156
PID 1992 wrote to memory of 256	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 1992 wrote to memory of 2608	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2020 wrote to memory of 5164	2020	gbvtnlfdyv.exe	165
PID 1992 wrote to memory of 5432	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 1992 wrote to memory of 4164	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 5328 wrote to memory of 5872	5328	nlfayvpnif.exe	174
PID 1992 wrote to memory of 916	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 1992 wrote to memory of 1184	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 3972 wrote to memory of 6088	3972	vtnlfdxnif.exe	183
PID 1992 wrote to memory of 5776	1992	2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_42749cb7b325f5157307fbf36dacc510_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa9b55c188,0x7ffa9b55c194,0x7ffa9b55c1a0
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2100,i,6319504210376618025,14825289482272403288,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:11
      4⤵
      System Time Discovery
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,12004227283989092327,1217128818076172007,262144 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2696,i,13660893804771662503,13949138006472024334,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,17799650321323588200,219242363685994886,2097152 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,4133726501668122262,5971147075593097781,2097152 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,7576088803537548032,16088671548942934824,2097152 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,6674851576202262677,17209827777618899572,2097152 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4480,i,11101039011439000552,14731863231734529852,2097152 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
      4⤵
      PID:2680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,8883817590336707637,17003995868780210790,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
      4⤵
      PID:4452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,2077118284863017242,4017012769643483091,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,822999649993101779,12494863146829022462,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:5360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,11205931257649252113,9317574569318701070,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,11205931257649252113,9317574569318701070,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,4242666765170487895,10038801139605607752,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,6168337717997222700,11706886985772343959,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:14
      4⤵
      PID:2500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,16761364068938617343,10584876651539553281,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,8418623836141144247,7066299166528302700,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:14
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,8812102145507642936,18085857856021745737,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
      4⤵
      PID:1228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,2899911484447818441,11973868212417126109,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15324508594885760639,16780723204880436521,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,12642279462519014454,17281200109507859948,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:3600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,13604724021925782058,1037926753050363767,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6476,i,9013520843253749014,6438440238768104630,262144 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:10
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3256,i,6828398446223860417,1465527155013318962,524288 --field-trial-handle=2236,i,1874519381091137708,3544396753035787582,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:1748
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:2176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfausmfz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3068
- - C:\Temp\pnhfausmfz.exe
    C:\Temp\pnhfausmfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfausmfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4880
- - C:\Temp\i_pnhfausmfz.exe
    C:\Temp\i_pnhfausmfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhecwusmjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\jhecwusmjh.exe
    C:\Temp\jhecwusmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhecwusmjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1312
- - C:\Temp\i_jhecwusmjh.exe
    C:\Temp\i_jhecwusmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebwurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4824
- - C:\Temp\rmjebwurmj.exe
    C:\Temp\rmjebwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3660
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebwurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\i_rmjebwurmj.exe
    C:\Temp\i_rmjebwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljheuolj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3832
- - C:\Temp\trljheuolj.exe
    C:\Temp\trljheuolj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljheuolj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3656
- - C:\Temp\i_trljheuolj.exe
    C:\Temp\i_trljheuolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomjdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4404
- - C:\Temp\tomjdbwtom.exe
    C:\Temp\tomjdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomjdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:256
- - C:\Temp\i_tomjdbwtom.exe
    C:\Temp\i_tomjdbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbvtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\gbvtnlfdyv.exe
    C:\Temp\gbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbvtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5432
- - C:\Temp\i_gbvtnlfdyv.exe
    C:\Temp\i_gbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfayvpnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\nlfayvpnif.exe
    C:\Temp\nlfayvpnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfayvpnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:916
- - C:\Temp\i_nlfayvpnif.exe
    C:\Temp\i_nlfayvpnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdxnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\vtnlfdxnif.exe
    C:\Temp\vtnlfdxnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdxnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5776
- - C:\Temp\i_vtnlfdxnif.exe
    C:\Temp\i_vtnlfdxnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxspk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\vpnhfaxspk.exe
    C:\Temp\vpnhfaxspk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxspk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4616
- - C:\Temp\i_vpnhfaxspk.exe
    C:\Temp\i_vpnhfaxspk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczusmkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5700
- - C:\Temp\eczusmkecw.exe
    C:\Temp\eczusmkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2280
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5056
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczusmkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5380
- - C:\Temp\i_eczusmkecw.exe
    C:\Temp\i_eczusmkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwurmjhez.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\ecwurmjhez.exe
    C:\Temp\ecwurmjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwurmjhez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\i_ecwurmjhez.exe
    C:\Temp\i_ecwurmjhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cztrpmjebz.exe ups_run
  2⤵
  PID:4504
- - C:\Temp\cztrpmjebz.exe
    C:\Temp\cztrpmjebz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cztrpmjebz.exe ups_ins
  2⤵
  PID:5936
- - C:\Temp\i_cztrpmjebz.exe
    C:\Temp\i_cztrpmjebz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjdbywrojg.exe ups_run
  2⤵
  PID:356
- - C:\Temp\mjdbywrojg.exe
    C:\Temp\mjdbywrojg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjdbywrojg.exe ups_ins
  2⤵
  PID:5560
- - C:\Temp\i_mjdbywrojg.exe
    C:\Temp\i_mjdbywrojg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebvtqoigd.exe ups_run
  2⤵
  PID:3152
- - C:\Temp\gebvtqoigd.exe
    C:\Temp\gebvtqoigd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebvtqoigd.exe ups_ins
  2⤵
  PID:1540
- - C:\Temp\i_gebvtqoigd.exe
    C:\Temp\i_gebvtqoigd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqoigayt.exe ups_run
  2⤵
  PID:5996
- - C:\Temp\ayvqoigayt.exe
    C:\Temp\ayvqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqoigayt.exe ups_ins
  2⤵
  PID:5468
- - C:\Temp\i_ayvqoigayt.exe
    C:\Temp\i_ayvqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavsnlfd.exe ups_run
  2⤵
  PID:2992
- - C:\Temp\lidavsnlfd.exe
    C:\Temp\lidavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavsnlfd.exe ups_ins
  2⤵
  PID:3680
- - C:\Temp\i_lidavsnlfd.exe
    C:\Temp\i_lidavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfaxsq.exe ups_run
  2⤵
  PID:4668
- - C:\Temp\xvpnhfaxsq.exe
    C:\Temp\xvpnhfaxsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfaxsq.exe ups_ins
  2⤵
  PID:1084
- - C:\Temp\i_xvpnhfaxsq.exe
    C:\Temp\i_xvpnhfaxsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  PID:4144
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  PID:236
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupnhfzxr.exe ups_run
  2⤵
  PID:5080
- - C:\Temp\zxupnhfzxr.exe
    C:\Temp\zxupnhfzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupnhfzxr.exe ups_ins
  2⤵
  PID:5728
- - C:\Temp\i_zxupnhfzxr.exe
    C:\Temp\i_zxupnhfzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhezwusmj.exe ups_run
  2⤵
  PID:4160
- - C:\Temp\pjhezwusmj.exe
    C:\Temp\pjhezwusmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhezwusmj.exe ups_ins
  2⤵
  PID:2184
- - C:\Temp\i_pjhezwusmj.exe
    C:\Temp\i_pjhezwusmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6120

C:\Temp\jhfzxrpjhf.sys
C:\Temp\jhfzxrpjhf.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Temp\eczusecwuo.sys
C:\Temp\eczusecwuo.sys
1⤵
- Executes dropped EXE
PID:5460

C:\Temp\trmjecwuom.sys
C:\Temp\trmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4428

C:\Temp\ztrljdbywq.sys
C:\Temp\ztrljdbywq.sys
1⤵
- Executes dropped EXE
PID:688

C:\Temp\idbvtnlfdb.sys
C:\Temp\idbvtnlfdb.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\aysqlavtnl.sys
C:\Temp\aysqlavtnl.sys
1⤵
- Executes dropped EXE
PID:5548

C:\Temp\vtnifdxvpn.sys
C:\Temp\vtnifdxvpn.sys
1⤵
- Executes dropped EXE
PID:2124

C:\Temp\xspnkfcxus.sys
C:\Temp\xspnkfcxus.sys
1⤵
- Executes dropped EXE
PID:5400

C:\Temp\hfcxupmhfz.sys
C:\Temp\hfcxupmhfz.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\mkeczuspmh.sys
C:\Temp\mkeczuspmh.sys
1⤵
- Executes dropped EXE
PID:5956

C:\Temp\mjhezwurmj.sys
C:\Temp\mjhezwurmj.sys
1⤵
PID:4800

C:\Temp\ztrojgebwt.sys
C:\Temp\ztrojgebwt.sys
1⤵
PID:2008

C:\Temp\vtnligeywq.sys
C:\Temp\vtnligeywq.sys
1⤵
PID:2788

C:\Temp\eyvtoljgay.sys
C:\Temp\eyvtoljgay.sys
1⤵
PID:3400

C:\Temp\ayvtnlfday.sys
C:\Temp\ayvtnlfday.sys
1⤵
PID:3744

C:\Temp\qnlfdavsnl.sys
C:\Temp\qnlfdavsnl.sys
1⤵
PID:3404

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
PID:5156

C:\Temp\keczxvpmkh.sys
C:\Temp\keczxvpmkh.sys
1⤵
PID:2588

C:\Temp\hezxrpmhez.sys
C:\Temp\hezxrpmhez.sys
1⤵
PID:4432

C:\Temp\jheywurmjh.sys
C:\Temp\jheywurmjh.sys
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczusecwuo.sys

Path C:\Temp\eczusecwuo.sys
Size 141KB
SHA256 2e9a62bf10cbfde7d99ac1d3f2cf3bed459ec306aa0e70dbac26d75b0c2722ca
MD5 702caa796d1ffb79632fe2829d9c1498
SHA1 3f2722c736ce96339347ca258f4bb63981709a51
SHA512 6375c09a4ea998a2224d86c07739b1e4f2003e97e06b68adc2dc3b242acff781cb71ed313daf118e6c75ee12ca48d59277eddd8998b46f28b5161997ae978ea8
SSDEEP 3072:esQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:esQmpcF8BzXfwV
TLSH
T10AE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtnlfdyv.exe

Path C:\Temp\gbvtnlfdyv.exe
Size 230KB
SHA256 cf9da85c94d68e52208fcdcc9c0f55570307bc31266300068e54581db809fa83
MD5 2cd151bd2bbe5970402dcf2203eb5aca
SHA1 671b3f16794e272ef0eec20bb378571121fac732
SHA512 73b523092c7ab8ca748c052c8fbfd96837b0bf84ced07a08b91ff5af20cc16e48ec4f7d5f58e3153629a7a08c4fc4ead9682088b347937b915ebe5622f7b971c
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gbvtnlfdyv.exe

Path C:\Temp\i_gbvtnlfdyv.exe
Size 230KB
SHA256 beb2606f30cecaf581375866e92b1c3ca10bd33bf56270a36ce67ce2782259af
MD5 9440ac045874293b6050d687552f1870
SHA1 d4770268ef962c4399b362aa9c08e1fbba099f7a
SHA512 8ff483b95a0db07a50685951f05f191a295620025eeab829f9c60243e66035f36039709a4b92af4e14214c8d76d77c276d33a3d99d9e333b542f488413974b02
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T11B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhecwusmjh.exe

Path C:\Temp\i_jhecwusmjh.exe
Size 230KB
SHA256 e64813c6c828c09468edb3d56fe2c607b9265902716ae2f5af1a5087c64549a6
MD5 9fbee0c5bdd919ed2a65dff40fbfc644
SHA1 f941c80ef65eef403fdda15944ca9f6f615cc3d7
SHA512 ace618d1c7aa937899b3c9fc619eef5a0551a9d4ba5cce3f9b75c1b0c0a47ba36b73bec7a39496c4bb19b98b5f2456f2c44d035d4b699fe2ae9ef010c1ed32ba
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T105344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfausmfz.exe

Path C:\Temp\i_pnhfausmfz.exe
Size 230KB
SHA256 83006c39dfb366a21185080044b8f85c1b9bc53477cf3065cd087fb7dd75f032
MD5 c32339cbe0b6ecbe1d1e2a4b1a2b7f6e
SHA1 f79e3c5a770b277e163430e42dafe16161c9713b
SHA512 4e64684d20d2304af632f4cc1d73365705c5ece75eb4b3593b89c3f7621f33480c39ff37b6709376b0aa91643dc1ef84c7d90b089625cefc54d7da9395b840ec
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T168344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjebwurmj.exe

Path C:\Temp\i_rmjebwurmj.exe
Size 230KB
SHA256 116835a4ebe3b25a4f41886302153cd1739075e5c8a3fc2c5b8332d12a58877d
MD5 f801ebe8f2f28bb05d52181399ed165d
SHA1 9db74f9ca8db1f565105f71830c2dd1107ba4113
SHA512 aa848604323400b1fef4359551705746248316e13ec9263ccf263435dfa0db6bf011b58592e68d66b98f93bdbd84807c1ae36684fb0ff12eebe799f699aeb0fd
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomjdbwtom.exe

Path C:\Temp\i_tomjdbwtom.exe
Size 230KB
SHA256 172dfac921b7cfe014327ea8b50b87f2eda6c480b0117d2d982cf9766af2f47e
MD5 7d865e8c7f4c27616b38722dc4723da4
SHA1 849b9236f2b810f81cf24cee0661a5029006cdfb
SHA512 3a4aa73e002ba040ee51b845f4a0120d26c32c6e3bc8fd86223b3d4b7c367760cb22fc8810e22a3197c30bee39f6da892b0e86ac9d5aec45346a26514a860724
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T112344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljheuolj.exe

Path C:\Temp\i_trljheuolj.exe
Size 230KB
SHA256 4f73de960311440e9abf929d5c514a6251b0f0342a97d97ddaeb294a965847b3
MD5 d7f7f8f9318b5ea12762ef0497cf00cf
SHA1 6bcb6979b600418d617854f9ad3079818cb9882e
SHA512 013cdd57b5e451763b12e35b9641cc31b1d0c495e688fe1898f35fdf3a159e3cc00959b90ab6a1658184dab0b57ec363f6b20ac6e6a802311194855a42e14a36
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T146344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idbvtnlfdb.sys

Path C:\Temp\idbvtnlfdb.sys
Size 141KB
SHA256 1c01a8b4edd207b00b741205cc981dbc1b4f8a19c4f0720a10dea4ff35463df4
MD5 12a650ee1408d55478b3d00c3fd19592
SHA1 1d94e80e0c2444868190980324cf3f2959d9daf8
SHA512 d7eb65a251507534261c7295b5bfae8123b5a73c15b106752a9b03dcaecf02667fde3f4d16988be8eb49b08fc52f444b003bb6293b502738a4e043c0ad0d9468
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T1AEE38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhecwusmjh.exe

Path C:\Temp\jhecwusmjh.exe
Size 230KB
SHA256 85680bcb9e9857c4746f2b712792bc4e72cc979bc618c88c0a0b92906ab47f92
MD5 ab363d903bb395faa763095a88e5dc6c
SHA1 8b2edcac048a9b6da8f0daf553910f3b405b37be
SHA512 3e1c3bd2569cfbf1379be8b0734cbdfaf2adec540409714d25ad9faa809224cc4c46ce957cdcbc4526d038feadeea760228507fd1b2378e33a6537861cd19036
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T147344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxrpjhf.sys

Path C:\Temp\jhfzxrpjhf.sys
Size 141KB
SHA256 8d65d1d5e63e84cbb8bd80a7e6482e35f1a3aa325acf080e3d89ba3860caa502
MD5 52860804f04d675a51ad9cc4015036f4
SHA1 6dce09703991d9cc77b6f6927ef42736177d6b2a
SHA512 c2669c4f2d89e306c257f6a5722f7755d820b0ef3e3e45f52a02a4b82d219d76585600dfaa1d95d11ba0b268b79d9178f5610f920bf3cfaa0fc9ce35cb67fd55
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T113E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfausmfz.exe

Path C:\Temp\pnhfausmfz.exe
Size 230KB
SHA256 d39341d6832ef25f9ea892fd7103cb39341174bf2c92a8940ab907cb596c9218
MD5 9508d5be043ff2e3ed0fcf3b6d97582a
SHA1 163fbb2d510767b9dc5715d21702fa312e590155
SHA512 ea5f067fceead176e42b03f499f4d851bc39ce8ebc859ee34bf1db4ddc358cbcdb31b2ff893da763f58a98f7b91b3a648bfe42d134f66cba94498fceac8db205
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T142344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjebwurmj.exe

Path C:\Temp\rmjebwurmj.exe
Size 230KB
SHA256 9189ad9a638699f2445b36eb8ffae43b24213e56aa29b729385030364dd83bd8
MD5 56adc2de56bed318df3dd3968b0435ad
SHA1 8f4c74c4b981d051d916233d58e721019c303354
SHA512 ce61744fdfc79ffd488c920cde1d67f50eebc9a85e9c935176c3439c21dda239df06e77411c77a937332d52f9b636fe7bc6429fdd4eefc5df5faccfb569972a5
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T112344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomjdbwtom.exe

Path C:\Temp\tomjdbwtom.exe
Size 230KB
SHA256 c0b2165d4e370b3c63d09c80d3237d5bd06d819aa13bcb8e1d91e91e5b5f8154
MD5 fd309bdf993acdaec432dd7f334328d5
SHA1 3225919728a66db9a929fcdc65a683f9604ca27d
SHA512 11cf3a8674643a9560e08f7994c726e8b532e9e72b605b5da409b20cbdf8b2a869696793fcca21c25549b4bcec8cae6814236f93662c7053dc9af4b00db14b65
SSDEEP 3072:3JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:3ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljheuolj.exe

Path C:\Temp\trljheuolj.exe
Size 230KB
SHA256 364b96b32454134fca871ecb3e6d18f8a09b28614e8d8d9b057e8c95d1bd3778
MD5 2ffaeeb44350f901866ebf30f92ce44a
SHA1 dfb45dd28bdd85171ccdc01acea254ba00dede02
SHA512 ffc437f33ae6b0018dc5c96155767e19ce47f7ced2743562b63ed5d88abe326c31eb6abe2f7c35587ed39496897a7d4a8d589cb0a07e154d468ea9c460b69250
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjecwuom.sys

Path C:\Temp\trmjecwuom.sys
Size 141KB
SHA256 26bfa9dd88d994077d9e430e6f908f788f17a671e03f3199ed8ad49517247769
MD5 eacd21301774a2855edc8d6be22db021
SHA1 f508d213f5e3c57d298511f8c743f9de20d4d531
SHA512 95c0159cd1eeac1f6cd5d6c36cfd72a8a07d8542a35e28de31b64bce6f4707e3ec618433b2aeaf6f362022f3e7a9041d0e286fb843920d9e17aafed417be912b
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T166E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbywq.sys

Path C:\Temp\ztrljdbywq.sys
Size 141KB
SHA256 05ff8da3d54df2e7370185e6908adfaa18eb6d2c474f91c4ea93e625de3203ee
MD5 ffd5b3a0393208347e0be61ad20f4963
SHA1 e961f621c0a6884bba4e3ef1c7d291d87d01a37f
SHA512 6decc3d3cad9ea779a618d8bccfba9a6d4ea19f50027e678c1ec5dfd35003b39cd9fb729b4563b55f651269742623d264b693da230bd4030ea6b176a33875f4f
SSDEEP 3072:hsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:hsQmpcF8BzXfwV
TLSH
T1F1E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 883ee18c8e9a33ecb9a690c9a191a59c1fea8231dcfe32cdd9f9cd2edfe265d4
MD5 9efc92cf912f0c6ee68b917e637dd6b1
SHA1 b51e55491895483a24525c0a6e811a6c21d02f7a
SHA512 b29e60900634b2c15ea509d544e3d9f1803567f86e2cbe321d2a3c25e49ff3a1c7892872170dca0c57f9377fdcf2f7ce3000a6d6f0f26e48d6854fc5f4368514
TLSH
T1447141247720A5D2CB6B357F92F1D2CFB2B0C742421F6EA27781A0B46A66F1C1403690
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5944cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5944cf.TMP
Size 3KB
SHA256 33264fe6d7970db56f19f867e9b81574ec29c58254af57b035e05e089a817c31
MD5 b96755fd7557530b803996b735c6291d
SHA1 463f5a5d041529e8c00544a501166d27b0a0ada6
SHA512 76ca560a6fc4af911437c65bcac22f01ed530beb20d4e710306ebefb532db911ffd56f91e798fad561a342fe30f4f5f89bc4a74b3fe8781112f932ad4100bdac
TLSH
T18F7151287710A5D2CB6B357F92F1D2CFB2B0C742421F6EE27781A0B46A66F1C2413690
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 affc0d295fb486caaa21eceeecc702b5212f1b45f9f70e9e4ddd28af0e8e1da0
MD5 8d7215c7a132f0565622ecfa93c79fe1
SHA1 c2f2a2c3f24695235a24609ec84cc800e865940d
SHA512 569ebc651bd8e51951bc4664dbc184019eae9adcb1d661e54947c4bc105500a1e425371fcf23f17dd44579dad3b21129966e21477600de56c3edc8dbdfd4d124
TLSH
T17C51CDF7C3E8866DC91146F0BB186E2BCE2D0914832C3D9AC9E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d5469812db371b33976035c22c7412b51d76bbe0e993f840c4ab9deb798669b1
MD5 ef57cb0fdbbb9d8b2ad4762fa83eb8e4
SHA1 fd93577bade3aeab636f84194134d2460fbdfef3
SHA512 cd250246c734350a37890dc4de032affed21ddbc93088d6255ca7427231d9e37e9f0e31c40211b94409bfbaeec3209da19a38fef98f46304c0085f05b8f6ff8f
SSDEEP 192:sxRjRxyM/jK1Ml8wcq/fUsq58prZYwzoA8p9f/g6+WNC4PfYTqVSGDPIgDOJ:sxRj5Cq/fUsqUF6V/5Bfj52
TLSH
T1DA62EA05AA245937CCDBD309FA557B63D6F91573A2501E48AEFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d7bc4f33e030587f36a013d35b1653c63f92dc9d791935f9412a7ea0ef13844f
MD5 6237deee6d1c5f6dcdb2a7bb12f611f1
SHA1 e6b057282367d01c7b0284208e045227d26d8e88
SHA512 fd352a99660a27621104966158b4ba11aeaecf9fece59fcf4fd62ed3acf7814085a716707cd8cc73ed31293c100338791d601d2bf8540e2bcb6f1faee3c1b316
SSDEEP 192:sxR8RxyM/jK1Ml8wcq/fUsK58prZYwzoA8p9f/g6+WNC4PfYTqVSGDPIgtJ:sxR85Cq/fUsKUF6V/5Bfj53
TLSH
T14D62E905AA245937CCDBD309FA557B63D6F91563A2905E08EEFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bf3764d167679b239e6252658775e69eef79ffbe77fa18366efad3a2cc331623
MD5 096e0f1fa43511d079931737fc7bf1fd
SHA1 585af95f5a54124c02653e7ee624621418c43311
SHA512 a8cf4ba51b6e28a3e2635bf8a96bbaa6796aec6cd093de21f595b3ce22e4c99f5640d64ee88edcd2e76a7e4c9d42ca8ab387e4659c96c89189ebb864ee1a9009
SSDEEP 192:sxRjRxyM/jK1Ml8UQEcq/fUsq58VrZYwzoA8prf/g6+WNC4PfYTsEVSGDPIgDAJ:sxRj5qDq/fUsqIF6T/5BfW5A
TLSH
T1FC62C916AA245937CCDBD309FA557B63D6F91573A2500E48AAFCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 9453487e22a751c5bf74bd32005e91b6925def10b46d29f7dd25a3d2934a96ac
MD5 9c92332dee23b555ca63ec605f0a4450
SHA1 d411490beedb327b62d5ebc54d252cc84beb04e0
SHA512 5ea5a3963d0cc334f33fdda61696dc77904d641fd22bc77ee1b5c87aaad1644c68d928384d2053abafedc3476c6b2072adb6583125f87a62024808a8c02edcac
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCADzFYgrol8o6:RGqOBfE7CrWgTvfiXu1jahADRYrl96
TLSH
T189E2FC7F680CCB7E4F804A9CEC29BD8E6DE801CB56988D5447FA890C03C67EB51164EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a455d9575af27a26067d3b8abc01e5b83d6585a0bd9b4b5e6a42f96829219af5
MD5 f14cabf1104a6a64e6d9b94b3eab1fa4
SHA1 6c9a6ee0db95bcdbdb21c1d3c9481eb110540c7e
SHA512 fb8b141463b5de001a3144fa92d67a6e81420448e95bf3116a506a65ba3d7a05b317bad37e9c57489ded39b58c04bfcaacbc07bc7d1bd2563b72b501c243dd7d
SSDEEP 96:K8msK/aCCeQKXKxYp8IamqwWuzjgwwK4lgSwcgwDyYdHgRkQiOn:qP/cYp8IamqXuzcwElgSPgwDyYdHgRko
TLSH
T139914311377A32C5397E350CC4A9A51F868735B23069B4AF7BB914924F6AE10CEFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9b6d9cb-85c9-49d4-b9f6-31f57893bff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9b6d9cb-85c9-49d4-b9f6-31f57893bff9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e044.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e044.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 bb2c7206b695b0936e0b845a7e2b4c822bfc5dadfeab77a520ddc5d1c0c111ba
MD5 b86ae8fa1b55ef0a1ea4ff238c286660
SHA1 677aa081e41f1300c16b6807d8e83b15bf6001ea
SHA512 8b881d0a153971f907f13f96508865fbf0cc247a66d7597a1792cadc81dd75a1bfe0d9d4a3bb09ea6760d4462a9a32be264d55b9d3204afed2b697eae2ad4009
SSDEEP 768:qrv+4UNbdj336urz0zXodOiIyN8Y1M1fmBnZilv06:qbsbl33lqXodI11dlX
TLSH
T10203C032E864D9739CF39288B55732837FF811A78AC54B48DDD92B4E4507BEE234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 52bb803f7cc57ed6e94b74064bc6394b73022859c2c28f16b4dc0286d791ca10
MD5 eb5111a5a8a8ba365c2795cb898d5093
SHA1 1271157ec4961358acd13a08bbd8151bd0dbf491
SHA512 9a824463ff36ff194436fdc804fecfa62200170b98552a170f37dd31387b6afff6029118b3acc09630c6d133da553aef03f999bcf5344f33d6fd22b42fc701e8
SSDEEP 768:Yrv+4UNbdj3S6apzZXodOiIyN8Y1M1fmBnl9v0B:Ybsbl3SnZXodI11u8
TLSH
T1D103C032E864D5778CF38288B55732433FF451A78BC50B88CADD2B0E8547AEE234B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e87293f068d8c79aa8a86bf86b2b05c41d0c6384afead645d18a581b662ae741
MD5 c4786c4b1773ec25cc98108c23eac424
SHA1 bfe065d05bb22bb107f20d6bc2c11d30beeb6303
SHA512 3aa5589cfd4d15df0568f1b3cbf533f96b15dd66d2601585e1d3d470ddc71d14700787e7eef09b7d5c0efe191aa1951425932a9161bb148cbd6dcfe0cc600d1f
SSDEEP 768:3hj+9R3y65uYz0rXodOiIyN8Y1M1fmBnZilDl8BvTPaSww:389R3yQOXodI11dlDl0WSww
TLSH
T142F2AF71DC558D734CF3938CB65326866EF551B7A6852E48DEDC6B0E00437AE234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b3fb4d732fb71f57948e25c556e071787d72d02b406049ea5766a9141dd3dd00
MD5 8a76c69914c68ed74892912f82cd6c4f
SHA1 168f48ff2be28290bd72056148ed82e8427c0ddd
SHA512 baa59260be0f1e99684bd6e32c47c72ef302a27e57c8869e86d960cdb6bf2e3de8b3f528689971cedc91fa72552ae804167433804e014737aee76d1536f2745b
SSDEEP 768:krv+4UNbdj3r61uYz03XodOiIyN8Y1M1fmBnZilDl8BvTPaSw/:kbsbl3reUXodI11dlDl0WSw/
TLSH
T1AB13CF71EC6889734DF3A288B59775873EF811A39AC51A58DED8270E00477EE230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d769e9fb7c852965e18ee1d431781a4fbc2e764d3198360bf67a7274baed4497
MD5 6d1ec6c960433b35df3175499cb7378e
SHA1 bea07f91294c0f72ea2a4963a0aa180965eb8817
SHA512 4e312b4e0f0e8bc8090f85cdbfcbc660c852c86e1490b2bd042fc449e67eda3a227dc3bd13dff698b35029d3cf2ef2934401ba282ac5394472eed5839eb892f7
SSDEEP 768:lj+9R3r65uYz0rXodOiIyN8Y1M1fmBnZilDl8BvTPaSww:Q9R3rQOXodI11dlDl0WSww
TLSH
T1FDF2BF71DC558D734CF3938CB65326866EF551B7A6852E48DEDC6B0E00837AE234BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 791a9cc2a15f21b42383ec29fdcc1ac335a067032e423239511bf3b9222ce5f2
MD5 19f68038466cee836bca3b0916d74060
SHA1 e75621d46f9691177bb67e95678a03d58857e321
SHA512 be753b06467a79d503adb2a81d145ee9e0f76c6bdc97edcfaa86e60b721a5c10ee434fb0a1f8d6f3ab9fe60461a1b2fe31aee5817040aab0da2c93ad868207ca
SSDEEP 768:P5F1j+983YwgV61uZV0ZXodOiIyN8Y1M1fmBnZilDl8BvTPaSww:PI983MPsXodI11dlDl0WSww
TLSH
T1821318F198D38937D8AE4787A77E6D455AFCC1A3B5845884BBD81E0DCC822BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1264_359244230\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/688-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2008-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2124-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2588-483-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2788-423-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3400-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3404-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4168-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4428-274-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4432-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4800-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5156-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5460-246-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5548-326-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download