systex | 28433d4376b833eeb97e30adb84651fb2eb75af539ddb893857f8dd27f3376b9

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260714-arprasdv6v
SHA256 28433d4376b833eeb97e30adb84651fb2eb75af539ddb893857f8dd27f3376b9
MD5 e9fdc738b5a34930907af350ecd47d23
SHA1 1ddda1938f860f8e9018d3d003f4f5e03d264bb2
SHA512 1d745900561af78d9ee3eb4b0b318f3120b0651933fc99a8abb53f88fd63c53caf7f906c67d97e96280e2feebd1b263ef1b2c9b53bedad05d0a8c907316b6444
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T121344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1620	CP.exe
2400	vpnicaupki.exe
3896	CP.exe
2608	CP.exe
1136	i_vpnicaupki.exe
2644	kfcxvpnhfz.sys
1112	CP.exe
1776	xmhfzxrpke.exe
2540	CP.exe
6124	CP.exe
2980	i_xmhfzxrpke.exe
5932	zxrpmhfzxr.sys
3204	CP.exe
5524	rmkecwuomh.exe
5692	CP.exe
5628	CP.exe
832	i_rmkecwuomh.exe
2964	ztrpjhbzur.sys
5360	CP.exe
1316	omgezwroje.exe
3932	CP.exe
1136	CP.exe
6100	i_omgezwroje.exe
5412	ljdbwtrljd.sys
4964	CP.exe
4524	ebwtomgeyw.exe
4840	CP.exe
1872	CP.exe
864	i_ebwtomgeyw.exe
4796	olgdywqoig.sys
4764	CP.exe
5164	vqnigaytql.exe
5900	CP.exe
4176	CP.exe
200	i_vqnigaytql.exe
2360	tnlfdysqli.sys
3448	CP.exe
5684	dyvqoigavt.exe
4748	CP.exe
1144	CP.exe
3284	i_dyvqoigavt.exe
2896	qkidavtnlf.sys
936	CP.exe
2436	davtnlfdxv.exe
1160	CP.exe
1688	CP.exe
1264	i_davtnlfdxv.exe
4808	nhfaxvpnif.sys
5840	CP.exe
2932	causnkicax.exe
3392	CP.exe
3580	CP.exe
5776	i_causnkicax.exe
2656	causmcxupn.sys
1724	CP.exe
1992	mhfzxrpmhf.exe
5976	CP.exe
1360	CP.exe
3228	i_mhfzxrpmhf.exe
3088	nhfzxrpkhc.sys
3684	CP.exe
3344	rpjhczurmk.exe
732	CP.exe
2996	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1445555586\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_2075325825\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5780_1445555586\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnicaupki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xmhfzxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnicaupki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwroje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkicax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhfzxrpmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhfzxrpmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xmhfzxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqlidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3088	ipconfig.exe
5516	ipconfig.exe
2304	ipconfig.exe
4916	ipconfig.exe
1204	ipconfig.exe
1988	ipconfig.exe
4108	ipconfig.exe
2092	ipconfig.exe
2564	ipconfig.exe
2940	ipconfig.exe
4592	ipconfig.exe
3088	ipconfig.exe
2804	ipconfig.exe
5476	ipconfig.exe
2356	ipconfig.exe
3032	ipconfig.exe
5896	ipconfig.exe
4212	ipconfig.exe
1412	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284624261764781"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{BDD33962-70C3-4463-B18C-D96584C10E9D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe
2400	vpnicaupki.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe
5780	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1136	i_vpnicaupki.exe
Token: SeDebugPrivilege	2980	i_xmhfzxrpke.exe
Token: SeDebugPrivilege	832	i_rmkecwuomh.exe
Token: SeDebugPrivilege	6100	i_omgezwroje.exe
Token: SeDebugPrivilege	864	i_ebwtomgeyw.exe
Token: SeDebugPrivilege	200	i_vqnigaytql.exe
Token: SeDebugPrivilege	3284	i_dyvqoigavt.exe
Token: SeDebugPrivilege	1264	i_davtnlfdxv.exe
Token: SeDebugPrivilege	5776	i_causnkicax.exe
Token: SeDebugPrivilege	3228	i_mhfzxrpmhf.exe
Token: SeDebugPrivilege	5100	i_rpjhczurmk.exe
Token: SeDebugPrivilege	1540	i_cwuomhezwr.exe
Token: SeDebugPrivilege	4328	i_ojgbztrljd.exe
Token: SeDebugPrivilege	5860	i_jdbvtolgdy.exe
Token: SeDebugPrivilege	2316	i_igaysqkida.exe
Token: SeDebugPrivilege	2212	i_aysqlidavt.exe
Token: SeDebugPrivilege	5024	i_causnkfcxv.exe
Token: SeDebugPrivilege	1308	i_xvpnhfzxrp.exe
Token: SeDebugPrivilege	3424	i_zxrpjhczus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 4688	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 2024 wrote to memory of 3056	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4688 wrote to memory of 5780	4688	iexplore.exe	89
PID 3056 wrote to memory of 4168	3056	iexplore.exe	90
PID 5780 wrote to memory of 2100	5780	msedge.exe	91
PID 5780 wrote to memory of 4944	5780	msedge.exe	93
PID 5780 wrote to memory of 4684	5780	msedge.exe	92
PID 5780 wrote to memory of 4944	5780	msedge.exe	93
PID 5780 wrote to memory of 4944	5780	msedge.exe	93
PID 5780 wrote to memory of 4680	5780	msedge.exe	94
PID 5780 wrote to memory of 4680	5780	msedge.exe	94
PID 5780 wrote to memory of 4712	5780	msedge.exe	96
PID 5780 wrote to memory of 4712	5780	msedge.exe	96
PID 5780 wrote to memory of 4712	5780	msedge.exe	96
PID 5780 wrote to memory of 8	5780	msedge.exe	97
PID 5780 wrote to memory of 8	5780	msedge.exe	97
PID 5780 wrote to memory of 8	5780	msedge.exe	97
PID 5780 wrote to memory of 6136	5780	msedge.exe	99
PID 5780 wrote to memory of 3184	5780	msedge.exe	100
PID 5780 wrote to memory of 3092	5780	msedge.exe	98
PID 5780 wrote to memory of 6136	5780	msedge.exe	99
PID 5780 wrote to memory of 6136	5780	msedge.exe	99
PID 5780 wrote to memory of 3184	5780	msedge.exe	100
PID 5780 wrote to memory of 3184	5780	msedge.exe	100
PID 5780 wrote to memory of 3092	5780	msedge.exe	98
PID 5780 wrote to memory of 3092	5780	msedge.exe	98
PID 5780 wrote to memory of 696	5780	msedge.exe	102
PID 5780 wrote to memory of 696	5780	msedge.exe	102
PID 2024 wrote to memory of 1620	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 2400 wrote to memory of 3896	2400	vpnicaupki.exe	106
PID 5780 wrote to memory of 1320	5780	msedge.exe	109
PID 5780 wrote to memory of 1320	5780	msedge.exe	109
PID 5780 wrote to memory of 2420	5780	msedge.exe	110
PID 5780 wrote to memory of 2420	5780	msedge.exe	110
PID 5780 wrote to memory of 5600	5780	msedge.exe	112
PID 5780 wrote to memory of 2356	5780	msedge.exe	113
PID 5780 wrote to memory of 2356	5780	msedge.exe	113
PID 5780 wrote to memory of 1988	5780	msedge.exe	114
PID 5780 wrote to memory of 1988	5780	msedge.exe	114
PID 2024 wrote to memory of 2608	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 2024 wrote to memory of 1112	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 1776 wrote to memory of 2540	1776	xmhfzxrpke.exe	123
PID 2024 wrote to memory of 6124	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2024 wrote to memory of 3204	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 5524 wrote to memory of 5692	5524	rmkecwuomh.exe	132
PID 2024 wrote to memory of 5628	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 5780 wrote to memory of 4224	5780	msedge.exe	137
PID 5780 wrote to memory of 4224	5780	msedge.exe	137
PID 5780 wrote to memory of 4224	5780	msedge.exe	137
PID 5780 wrote to memory of 6096	5780	msedge.exe	140
PID 5780 wrote to memory of 6096	5780	msedge.exe	140
PID 5780 wrote to memory of 6096	5780	msedge.exe	140
PID 2024 wrote to memory of 5360	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1316 wrote to memory of 3932	1316	omgezwroje.exe	143
PID 2024 wrote to memory of 1136	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 5780 wrote to memory of 4016	5780	msedge.exe	149
PID 5780 wrote to memory of 2796	5780	msedge.exe	150
PID 5780 wrote to memory of 4100	5780	msedge.exe	151
PID 2024 wrote to memory of 4964	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4524 wrote to memory of 4840	4524	ebwtomgeyw.exe	156
PID 2024 wrote to memory of 1872	2024	2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 5780 wrote to memory of 4316	5780	msedge.exe	163
PID 5780 wrote to memory of 4316	5780	msedge.exe	163
PID 5780 wrote to memory of 4316	5780	msedge.exe	163

C:\Users\Admin\AppData\Local\Temp\2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_e9fdc738b5a34930907af350ecd47d23_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c0,0x300,0x7ffaca48c188,0x7ffaca48c194,0x7ffaca48c1a0
      4⤵
      PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2152,i,1759059882150241145,13055688892724282928,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:11
      4⤵
      System Time Discovery
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1956,i,791344397827060916,16475016419124974304,262144 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,13304134605841359910,12716264753887798336,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:13
      4⤵
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,4798380283275919745,595421177614099275,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,17112547857790740477,1672950962360881435,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,15677425980424317953,9918743877949183319,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:3092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4312,i,14104397072172099739,13522560643243589046,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2712053661812187982,13035608638870855277,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:9
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7537991219861612925,11257273505604485258,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,11032048041988723290,17823836077196007509,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,14741486309274403484,15625241718352639731,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,13481254475035412307,11867142596995036203,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,13481254475035412307,11867142596995036203,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,11013113951839749388,5731626508425858146,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,12950926183721262881,15676942336333061695,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4784,i,4451290677086985681,16684002476431767939,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4460,i,11514853102349104450,17839737956304173930,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1352,i,13730580811086470438,12260649671638996121,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:4016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,3856488958765167634,791147815003287091,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
      4⤵
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,231066561892318011,6560710344512388959,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4736,i,9005661498944110586,3507649038051681833,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,13196637900241589797,1269967929990691304,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4460,i,3015127511099591419,15647164918585119871,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5756,i,17252965609334861132,3395879973423119510,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,11010349116395948406,9491732364954574419,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7144,i,6982745818398394031,17137648829222464158,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,530401110730273072,3114775125285728394,262144 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:10
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,8180812625525266608,5114332959722895356,524288 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
      4⤵
      PID:1320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7132,i,15465951498057200971,17880414163826995235,2097152 --field-trial-handle=2620,i,10560087906331377366,5325561240364558917,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:2592
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnicaupki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1620
- - C:\Temp\vpnicaupki.exe
    C:\Temp\vpnicaupki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnicaupki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2608
- - C:\Temp\i_vpnicaupki.exe
    C:\Temp\i_vpnicaupki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xmhfzxrpke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1112
- - C:\Temp\xmhfzxrpke.exe
    C:\Temp\xmhfzxrpke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xmhfzxrpke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6124
- - C:\Temp\i_xmhfzxrpke.exe
    C:\Temp\i_xmhfzxrpke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmkecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3204
- - C:\Temp\rmkecwuomh.exe
    C:\Temp\rmkecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmkecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5628
- - C:\Temp\i_rmkecwuomh.exe
    C:\Temp\i_rmkecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwroje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5360
- - C:\Temp\omgezwroje.exe
    C:\Temp\omgezwroje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwroje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1136
- - C:\Temp\i_omgezwroje.exe
    C:\Temp\i_omgezwroje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\ebwtomgeyw.exe
    C:\Temp\ebwtomgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\i_ebwtomgeyw.exe
    C:\Temp\i_ebwtomgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4764
- - C:\Temp\vqnigaytql.exe
    C:\Temp\vqnigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4176
- - C:\Temp\i_vqnigaytql.exe
    C:\Temp\i_vqnigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3448
- - C:\Temp\dyvqoigavt.exe
    C:\Temp\dyvqoigavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\i_dyvqoigavt.exe
    C:\Temp\i_dyvqoigavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1688
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causnkicax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5840
- - C:\Temp\causnkicax.exe
    C:\Temp\causnkicax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causnkicax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3580
- - C:\Temp\i_causnkicax.exe
    C:\Temp\i_causnkicax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhfzxrpmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1724
- - C:\Temp\mhfzxrpmhf.exe
    C:\Temp\mhfzxrpmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhfzxrpmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1360
- - C:\Temp\i_mhfzxrpmhf.exe
    C:\Temp\i_mhfzxrpmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3684
- - C:\Temp\rpjhczurmk.exe
    C:\Temp\rpjhczurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\i_rpjhczurmk.exe
    C:\Temp\i_rpjhczurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezwr.exe ups_run
  2⤵
  PID:3356
- - C:\Temp\cwuomhezwr.exe
    C:\Temp\cwuomhezwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezwr.exe ups_ins
  2⤵
  PID:2008
- - C:\Temp\i_cwuomhezwr.exe
    C:\Temp\i_cwuomhezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  PID:1640
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  PID:2924
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgdy.exe ups_run
  2⤵
  PID:1920
- - C:\Temp\jdbvtolgdy.exe
    C:\Temp\jdbvtolgdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgdy.exe ups_ins
  2⤵
  PID:3108
- - C:\Temp\i_jdbvtolgdy.exe
    C:\Temp\i_jdbvtolgdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysqkida.exe ups_run
  2⤵
  PID:5500
- - C:\Temp\igaysqkida.exe
    C:\Temp\igaysqkida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysqkida.exe ups_ins
  2⤵
  PID:1108
- - C:\Temp\i_igaysqkida.exe
    C:\Temp\i_igaysqkida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqlidavt.exe ups_run
  2⤵
  PID:5420
- - C:\Temp\aysqlidavt.exe
    C:\Temp\aysqlidavt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqlidavt.exe ups_ins
  2⤵
  PID:5516
- - C:\Temp\i_aysqlidavt.exe
    C:\Temp\i_aysqlidavt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causnkfcxv.exe ups_run
  2⤵
  PID:5192
- - C:\Temp\causnkfcxv.exe
    C:\Temp\causnkfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causnkfcxv.exe ups_ins
  2⤵
  PID:5836
- - C:\Temp\i_causnkfcxv.exe
    C:\Temp\i_causnkfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnhfzxrp.exe ups_run
  2⤵
  PID:2724
- - C:\Temp\xvpnhfzxrp.exe
    C:\Temp\xvpnhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnhfzxrp.exe ups_ins
  2⤵
  PID:2584
- - C:\Temp\i_xvpnhfzxrp.exe
    C:\Temp\i_xvpnhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczus.exe ups_run
  2⤵
  PID:4740
- - C:\Temp\zxrpjhczus.exe
    C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczus.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_zxrpjhczus.exe
    C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3424

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1204

C:\Temp\kfcxvpnhfz.sys
C:\Temp\kfcxvpnhfz.sys
1⤵
- Executes dropped EXE
PID:2644

C:\Temp\zxrpmhfzxr.sys
C:\Temp\zxrpmhfzxr.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\ztrpjhbzur.sys
C:\Temp\ztrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:2964

C:\Temp\ljdbwtrljd.sys
C:\Temp\ljdbwtrljd.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\tnlfdysqli.sys
C:\Temp\tnlfdysqli.sys
1⤵
- Executes dropped EXE
PID:2360

C:\Temp\qkidavtnlf.sys
C:\Temp\qkidavtnlf.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\nhfaxvpnif.sys
C:\Temp\nhfaxvpnif.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\causmcxupn.sys
C:\Temp\causmcxupn.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Temp\nhfzxrpkhc.sys
C:\Temp\nhfzxrpkhc.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\mgezwrpjhb.sys
C:\Temp\mgezwrpjhb.sys
1⤵
PID:3624

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
PID:1300

C:\Temp\tqljdbvtol.sys
C:\Temp\tqljdbvtol.sys
1⤵
PID:1176

C:\Temp\aywqoigbyt.sys
C:\Temp\aywqoigbyt.sys
1⤵
PID:3332

C:\Temp\lidavtnlfd.sys
C:\Temp\lidavtnlfd.sys
1⤵
PID:1004

C:\Temp\nkicausnkf.sys
C:\Temp\nkicausnkf.sys
1⤵
PID:1252

C:\Temp\hcausmkica.sys
C:\Temp\hcausmkica.sys
1⤵
PID:3592

C:\Temp\smkecxupmh.sys
C:\Temp\smkecxupmh.sys
1⤵
PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwtomgeyw.exe

Path C:\Temp\ebwtomgeyw.exe
Size 230KB
SHA256 c519c6fd5aad75814494e151f25dc132c977b45fdc9aa37dd3cc24e3e35449ad
MD5 3d28a49782d3d19dde8b18be31f23dea
SHA1 e7d009a621e4dd32f81fbad7c5b2935d731b7b0c
SHA512 33aace4f9ce709eeb47b2a29faeb091fb963a8a19c91bbf0bc3ad73686a1dd2b2361f53edfb410566d29d936857e0b208a9960c3682dff74d028b52f615a0a91
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebwtomgeyw.exe

Path C:\Temp\i_ebwtomgeyw.exe
Size 230KB
SHA256 9a483cca98dd1f7933350aaed38d407c8c645bc9ca87b55466671c08321a1ae8
MD5 567d15e5d7f71ab9828fe09e461c03a9
SHA1 ff72b2edd27cd5e26bc7a4489de93bd955aada64
SHA512 c870e4b51b4caf96ddaa98438af9e9ab30efa14a42b134bd3b3ac8c5cdd4845f2a8f9327e5aca6e3f11e3709c725f163e35752577dde89aab26f7bd1a4b0f5b1
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T18D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwroje.exe

Path C:\Temp\i_omgezwroje.exe
Size 230KB
SHA256 873a5bd8a60d9ed55c520a9aef8540aaf24b182db0311abfac4a164d80157c6b
MD5 ea22600004aa3813652bddf3b26ae6e4
SHA1 18ef3e58dae1bde7771134ecd027260ee21b19f7
SHA512 8e1c5eaa7030b5c08805a16980fc308b73c76d04381b8a247140e211591136d44d01c40b9086e5b428a5964c2aa305598b893d4de664ba73fc1a887c5aebc695
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T125344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmkecwuomh.exe

Path C:\Temp\i_rmkecwuomh.exe
Size 230KB
SHA256 15d27f9af97dc886b9226883495b41082e1229e870a036925d8cdbf28741640b
MD5 b052b965e30bb6b29e2837700a006a28
SHA1 e4394a3acbc87fc8a4ff2c8cf9a807f539162ddf
SHA512 1d8388a80a6b74dd8ddd07832d46f370b36086ac262886eafc5d75bdd25694da63014a75c0ddc11716feb96db4bc1b08211cc859c332d4824b7a679a5d0d1514
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T147344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnicaupki.exe

Path C:\Temp\i_vpnicaupki.exe
Size 230KB
SHA256 7b1e8159eb8e0e0aa2851b0663662a3dde985c36ac677b4273fa25caab142799
MD5 11f0e9165baa977006f2cfdd97310443
SHA1 4e5a0037a6ca3497ca6ba96a1ed9dc56b96bc6df
SHA512 9e27fd4cd9898a8e1ab1670cd7c3ed9817dd4ff143b1e25639eebed0100472c1ea0e54bc7314a75c0f087d21cd63a82ca473d02069cd8520506be4d8460e4180
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T157344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xmhfzxrpke.exe

Path C:\Temp\i_xmhfzxrpke.exe
Size 230KB
SHA256 25aa90f81ef654666edfc93fa8134c3fea4042a1a7cc648a9c7bb5b63755ce1e
MD5 4d9d72be54c1c70f57fcb4c25dffe4c9
SHA1 d2302f3ddf98e1c606da7acde2b4709937f6089f
SHA512 1715c71882177fc3581098c71977dcfda53895893e1e0658fbb436bab72720d8fdaf079a539281f269a275ef018a7dbba04281d7ac8ff063038703602a4311ae
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T129344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcxvpnhfz.sys

Path C:\Temp\kfcxvpnhfz.sys
Size 141KB
SHA256 877749d523dc297fdeb02b1a27ed0ce8c84f82fc5b1c3fd1d9678d9ab1f7ce8c
MD5 c35ecfc1f41b608da2e6ccb5bb59e0aa
SHA1 982ae90fd8dd1f7c78e1dea0fc8de2f06b114ac5
SHA512 ed796548128127a79db9ce9974bd9f27b276b2a3affdc804bae671875b8f9975287c052e1309cd9ba5532130f20a96589fb2d9c77b101e356a9956781b2a3337
SSDEEP 3072:ysQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ysQmpcF8BzXfwV
TLSH
T1CBE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbwtrljd.sys

Path C:\Temp\ljdbwtrljd.sys
Size 141KB
SHA256 35de69be9c99a5c5272f1072e29074fa38d2a4635c55b5138697c1dfe9500e6a
MD5 b2685581d38265859f27b13135770c38
SHA1 6865d5ef863d4ea13e4b0e6ed9390d6ef4bbdd21
SHA512 c106b277a8ead89a0b7e841d61ba6c7aac9b7ad4c2b54bb121f4d882b989ffeb6e98b1c1684e6c51d8cd58b7c7a99162fee81a4358c35982a1a7f188bfb951f4
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T195E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqoig.sys

Path C:\Temp\olgdywqoig.sys
Size 141KB
SHA256 e304d3847eee4678708769cf1bd9938bf5963a002918ce7f772100cea7c7cc31
MD5 369068e0415b73e083028c5cd885e59a
SHA1 345279f1d137cdb202fb20a414bd76d18c3dfc50
SHA512 4535a24073f5359cb5953c00308e9e96fc19d4312f8cb972f523c6a90faad32cfb19ba525cf52232b70b4e05dd5209671e49441de5e8948308e13a0805499452
SSDEEP 3072:esQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:esQmpcF8BzXfwV
TLSH
T134E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwroje.exe

Path C:\Temp\omgezwroje.exe
Size 230KB
SHA256 346ef1425991bb77bbf63bceabb8d523451e3e44be381c15106f49c4cb71293a
MD5 4065cbe2fc956eed763b9e32f44f00bc
SHA1 1fb6b32c0b01e0732c02d257f84eebaf2830093e
SHA512 0e89fbe0e35db93b19a3497ccd6ab5776bb81a6f1a1387dec50aa7013f9472240fcfb1b02099672015d1de48df50f7444dfaa6f2be03f6864d2994da4ded74c1
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmkecwuomh.exe

Path C:\Temp\rmkecwuomh.exe
Size 230KB
SHA256 48bcefece1873f18e38114c9d1246b115668d0a141c9e9c845eb8414f342da5c
MD5 95e0243aa6960d89c6c8b33a79291862
SHA1 97265c81f8a48138adf29e98d406516157cedc49
SHA512 0b66f65b0cba3b82e227a97aabcb6e85614f1715f961720f513e9c017349fbc39427743144bd84b61f1582ed34250f19886170f65537a1d74c5397fe0e714d03
SSDEEP 3072:0JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:0ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AE344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnicaupki.exe

Path C:\Temp\vpnicaupki.exe
Size 230KB
SHA256 05161fa5b5c601fc8c90c03a1f7672669172acf57a645db317bbe460f593409f
MD5 d81f1e16b78a0c2b7d4e28a152e4c0c8
SHA1 42ba6289b4986efa04f5d18aca229fbdf17acf10
SHA512 173f7467cf280c94e1c81ec4fb9b895cc68598336472a59a2028f145a58be68a5e8578d62ee2b75a907e5baa9ba1538a2c5a71450748d96a6d2326d0fad1b721
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T141344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnigaytql.exe

Path C:\Temp\vqnigaytql.exe
Size 230KB
SHA256 a5e7ed0761548ee084402d1399af1f51163b17b9573476f1d7c9cba2da02e334
MD5 abe8402c7e55e7c0c69dbaade9e0d3e1
SHA1 4b170adb84f34ba2fd283859138730f64e8782bb
SHA512 37eb8a415ad37a496383fe4c4d7f5a347f9075b02a88b4fd54e987955b0e630c319d1be267ce8c65f34311db34c52957581052b9f94f1bbe2c075f9f6a5ef763
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T15A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmhfzxrpke.exe

Path C:\Temp\xmhfzxrpke.exe
Size 230KB
SHA256 e48d52288d44caec99c64e0f17ef4f6daf6b0a321d3f8f6ebfce6d4154883c87
MD5 feb4def93a8f90494117ab81c061726d
SHA1 0a875495441ccabb7c13b762ef624f9973491e8e
SHA512 aacc135c84ac22db70f39381868e78e3cebf127e38b3497398f82c332a444939e3a5ed5737c7f2ae53d3870f5a81868e070a8a3e4ef3fc511d7e8c92ac4212ef
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T144344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrpjhbzur.sys

Path C:\Temp\ztrpjhbzur.sys
Size 141KB
SHA256 1792e096120335949c68abd8cd6bd7205934c9dd04632d4d209d90d0c50e5932
MD5 d6cf3758d65da2287a256395d2eaf577
SHA1 a34dac507a5d2528cd7f2f424a4935b8a0b8b2bb
SHA512 99cb72731df2932403841282b73acdfcfb84b6ecfdfb844dced5fc18fe0b0b7611e4ce181feea6a0e114c9a8abc0931c9d8c13a505eb9c67936dfc72541886f4
SSDEEP 3072:AsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:AsQmpcF8BzXfwV
TLSH
T155E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmhfzxr.sys

Path C:\Temp\zxrpmhfzxr.sys
Size 141KB
SHA256 eacc7095d90e745a3d182c5731602a2696efb177fd98695ed8f38a4adf44e59a
MD5 bc0a425079d585a4d4a9211cea22e44b
SHA1 bfafd80654a95596322173abb4321be17ac253de
SHA512 7d8905f682e73fadc2e59fd549e41bfa86ea2823f2b8ed3f63511ec88129bcef3db48b0129f796fc24de77027d946ec7f0f8c775cc73e8bff89f725a3081f8a1
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T16FE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 99cd59f1b750a8038b9568722970c4bd53b476081a891c8774d852084227ea49
MD5 cc8b2d86cd712cacadd6bc6a19030aac
SHA1 589377f5a7d21928d0d0d7dcc04f4222eabe0dff
SHA512 d8193672dd7d6bf5365b8f083be8b17b8eafa77c19f645618141a22c7ff030ff4bf219c4cbf0e4df1f4d06fc160d961eb28f3734f0c9648b1dc0fefa2d5dfdaf
TLSH
T1FF619458232E59E3DF2559B002D964F832B684C34D4F6E026034BF744906FDF6D29E6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5931d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5931d4.TMP
Size 3KB
SHA256 fa1357ff758579547912e71c689adccac94b7a18db72d219441822d05b15c4eb
MD5 d17b2c0a02702874bc40c80a6cd31d0f
SHA1 cd45a72a84f6f21ce2dc0b7e94d2eefc239f5b02
SHA512 02f921b5c35c69b80d6600ef1affeac6bf84dde787e97f22a827932ec1d9d5360c774ab8adf4824b79247f49bd034a04b383e7d8c3b40b5195061f401284b4f7
TLSH
T1C9619419232D59E3DF25597042D964F832B688C34D4F6E0260347F754906FDF6C29E6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bc95969e0e566415e026c113ae3391518c113d7bfbff515a810d086014a03260
MD5 2f53fda7e9336a20bebb2972c26c6165
SHA1 fda0057e77b198005469cd0cad5bbaa3b3195182
SHA512 2004aacdfee3121a99e2226acea81df6d76ecab433319828d9b5910a65e01c534261661ff2f8b37691b5690d9a38a1e57aba86628b18757303f361df4e709cac
TLSH
T14A216DB3C7E4856E8A0156F06A24AE2BDE1D0915832C3D5989D4EF2B93F2475E10195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d312acac1c64a193294a898af0cbf2706c731f9d08256d83ea76e1f05b9b01ab
MD5 2bbd7427cc907980172e90d7f00bd70a
SHA1 ff4cc9436a3b3ccff12dfca5546061f52edb0ab3
SHA512 d4033f825fbd090b573481738a1c8cde1019541222a4b869e1d6ef0e297d267f2a5da6a468897be12ace422808b40ff795fe725f7192d43a7796bdfe77d5e451
SSDEEP 192:sxRIRFyM/jK1Ml8wCI/fHsJOhZswszoA8pi/g6+WNIYxvJSGzIgtJ:sxRI58I/fHsJOvDi/5I4l3
TLSH
T19052FB156A34997BCCDBD20DFA557F93D6F85573A1900E44AAFCCA0C01E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3dcdfa2fb5e604d997e8b7aad023cdc95c515166625c13d7d771d54888248155
MD5 c2d2667319218adc7521370501108cd7
SHA1 27d1a843c3b62785d9ea635af6556b995a19ae5a
SHA512 f52fc6a549dd410c7f6f2d49aa67f7de7aff9cb3fa820f75744487e26f831806f81a4dd303e4ae64689c9f4d47ce02bb5fcf9573bbfea1190fe7e10b9b1798d7
SSDEEP 192:sxRPRFyM/jK1Ml8wCI/fHsPOhZswszoA8pi/g6+WNIYxvJSGzIgD+J:sxRP58I/fHsPOvDi/5I4l+
TLSH
T1D952FA15AA34697BCCDBD20DFA417F93D6F85573A1900E44AAFCCA0C01E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ff076a96e9ca15b56f0d893892518381e6a2c13fe4c24154daae156a37f29d8f
MD5 7ec812c592490ba3f0a7d3fdd14cffa5
SHA1 aa8fa894954dfd29b082f0e956a533ae82150e7b
SHA512 953998673f943449b2b6d4c1e7bc9ae90c0c01666c5ae2910a9c56c873f7d17c38c0f690fd25c6c4f342a3246d65710b13212441ba0f2355e4f8f424c5b7f78c
SSDEEP 192:sxRPRFyM/jK1Ml8UQ3CI/fHsPGhZswkzoA8pr1/g6+WNIYx+JSGzIgDwJ:sxRP5qyI/fHsPGvXZ/5IFlY
TLSH
T17A62D916A934697BDCDBD20DFA517F93D6F85572A1900E44AAFCCB0C01E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8fbc7af576dc29654e324144f30f0a4140a73fdee138d2983e738375cec85e11
MD5 119ed3cd3b29eeec17ec6be40724d336
SHA1 b47287bd6f5695462d9bf61eea2713d09d0292ad
SHA512 8ded7f44f585f932cd5231d9745cce026f9bfdbed5173449703d706d7f9d63581c37a82de0b26f7091e7739a0a6e2ae606ecc4fad86918925ce55d1855021f29
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVCy4rVArroJq7De:0xCyDQE7ijWgbrfM1u1jaRy4pAYJqXe
TLSH
T1B2E2EC7B680CCB7F4F404A9DEC297EDEADE802CB96D8C95447EA840C03C66EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 111e27910ed2479cd2bdf8f76e3cc72fdbc0e4d3ce250a8fc4f2f9b8045c2fd7
MD5 fec67ae0703c76f417b533c0c43e00a2
SHA1 aaf3313d3c29f19dd92fd592d91764f9dd3c86b1
SHA512 45289d8b4699b16e3cc231e20b647032e68df312e70d2f6bcf4aff58b7615e0dc02ba7112beaaf97f4154f57350d4a1936cde8070915665ab4acaaa667aab290
SSDEEP 48:KwlIpKGcETy2ls/blPvhm7G8IlDhKsI0lhgNxnuD0lI1KOggHyW:KwliKGciC6YKHKAleKOgiZ
TLSH
T1D3911F85707AA615787F2A089555CA67C6C1F0B33015A43B7BE910B24F6BF010DBD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f0b8b7bb11492ef02130686d5fac1b065c01cea6f79100b631afd22a70b6783f
MD5 9ee81411c69d69405ab43c80303d85aa
SHA1 c071d6e161cede261ae8c33d7aad08478a44d235
SHA512 f45f2431a2c8bbcd5133dae63eb4a403a7cf53a74e241fa852cba7d11a6c1157eba7019d9638f97206dc076bf2c35f5c503804ad37e258a24bc1128f5b665cfe
SSDEEP 768:5j+9j3/tnkKL2ktbQjF669yrqUjWiIwwxMtob9M/:k9j3yHjF66INWZTMab+/
TLSH
T186F2AF74AC559EB3C8E6D786B21337C6EFE051A396C40E88DADCDB0D06875DC274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fa6f3d779cd8b926603ac80a6d0e1d35b6900cdd1c058cae509110c6492e1e20
MD5 6185fbc0a2e07104175ddaa5d2531fbd
SHA1 f949ab4fa6bc03bde38297200aa71a90082ff170
SHA512 39476ab592b5929740de205a00590d2b4cf77c5d785617b69bee4f9236cb02bb25919c925bb3a28c0b5b1f3ed4716cb2cd344b3c1a7f829376debc47d72a8c07
SSDEEP 768:hrv+4UNbdl3W1kKL2ktbIjF669yrqUjWiIwwxMtoUile0:hbsbX3/rjF66INWZTMaUsz
TLSH
T1F503BE70A858AAB3CDF6D286B15337C3BF74209395C50F98CADD970D464B0D92B4792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d0cd12966b6b707bcaa78776c3d22d9cab9986d3856ead4613dd8d9e0243c5bf
MD5 2d20437aa338aac9bf4d81887e3d0e74
SHA1 7a2194c3cb8d66719aa8a31eef4f7d99ffb90c7a
SHA512 efc6830cf62c886353c73836c8cfe5f1ebba9c1f2f1af43fd091255e35b1e179f7d7d63bb88ef22622a8ce25e8d48a51a6f2e5ef89e7a2d0d458073be2f2c48c
SSDEEP 768:arv+4UNbdl3kPkKL21jF669yrqUjWiIwwxMRcXOUiler:absbX37NjF66INWZTMuXOUsQ
TLSH
T1E903CE31AC589AB7CDF2D68672533783BFB4109396C50B88CADC670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 b381dd0032da38917458cdea296e35761142ef50e3615b0e97b75c79eb7ae9c5
MD5 0a95a85eaced50c86a7732b4e1828499
SHA1 42d65852400bace8c33201f24b8512b19b23c848
SHA512 f35eb5c244f56f84c5f68c0832913f8f1b06c28218cf62761ceaff08d331e99dfad3b8d68875e8570acbfb2b7761da30ca8eb57e0f2d3a01e49ea9ebb6ee2654
SSDEEP 768:ej+9W3/tGStb3nF669yrqUjWiIwwxMtob9M/:d9W3xnF66INWZTMab+/
TLSH
T11CF27C74E865DEA7C8E2D78672123BCAEEE051A386CC0DC8DAD89F0D05C75DD174782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8aed73e7c8e0b3f74626a0e51aa90ac188c0b16a7850fd8f14fb4c890bb63931
MD5 ec73bf8e95ce52398c9e42c71ea87139
SHA1 7f162d5143452ea92d43a1e4be2cc7367a76f07a
SHA512 9bc66637f47aaee1b3ebc37ea2027991e4f6cbbad8080623f9718cecb159cec20cd80b158aceed9e567f0ae5b17ad6ae7a39a5240c8dd952771efea32a0beaeb
SSDEEP 768:Kj+9j3ytnkKL2ktbQjF669yrqUjWiIwwxMtob9M/:p9j3DHjF66INWZTMab+/
TLSH
T18AF2AE74AC559EB3C8E6D786B21337C6EFE051A396C40E8CDADC9B0D06875DC274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

49e1d7cb-7c70-4944-90b5-7199f6530269.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\49e1d7cb-7c70-4944-90b5-7199f6530269.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5780_829912493\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1176-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1300-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2360-316-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2644-196-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2656-349-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2896-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-263-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-376-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-353-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3332-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3592-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3624-365-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4808-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-275-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5904-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download