systex | cd3787d891a0d6690dd110c59c4bd5a971e1586da553125572022626fbf6e2ea

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260715-t3x2lact21
SHA256 cd3787d891a0d6690dd110c59c4bd5a971e1586da553125572022626fbf6e2ea
MD5 c8f05f3bbeb644446c7b336fb0fdd089
SHA1 723d6a9b64684ad76249968bd555887f6996cc4e
SHA512 cb3ba737546ce2b566aead5e1badde089ec478a678745069796f942f02b9b00b06af4ec0ddf603d5a71669cb6aecc729ba5c2e96c3c245733e932c49d03c1dc9
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T195344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3872	CP.exe
5704	jecurmgezr.exe
5916	CP.exe
2600	CP.exe
1872	i_jecurmgezr.exe
6000	oigbytrljd.sys
3092	CP.exe
1980	eywtojgbyt.exe
4640	CP.exe
6104	CP.exe
3384	i_eywtojgbyt.exe
2988	olgdywqojg.sys
4412	CP.exe
2452	gdytqoigay.exe
3160	CP.exe
5888	CP.exe
4552	i_gdytqoigay.exe
3308	fdxvqnifdx.sys
3772	CP.exe
4316	ysqlfdxvqn.exe
5468	CP.exe
2688	CP.exe
4816	i_ysqlfdxvqn.exe
5900	lfaxvpnlfd.sys
5096	CP.exe
5160	cavsnkfdxs.exe
1072	CP.exe
3468	CP.exe
3416	i_cavsnkfdxs.exe
4320	fzxvpnicau.sys
4136	CP.exe
2344	fzxspkicau.exe
248	CP.exe
6084	CP.exe
2912	i_fzxspkicau.exe
5812	zuspkheczu.sys
1628	CP.exe
3940	zxrpmkecwu.exe
1960	CP.exe
1104	CP.exe
2116	i_zxrpmkecwu.exe
6072	czurmkecwu.sys
1392	CP.exe
4128	bzurmkecwu.exe
2168	CP.exe
3140	CP.exe
1280	i_bzurmkecwu.exe
2616	jhbzurmjhb.sys
4660	CP.exe
4268	trojgebwtr.exe
2672	CP.exe
3648	CP.exe
3372	i_trojgebwtr.exe
1700	bztrljdbwt.sys
304	CP.exe
2384	wtomgebwto.exe
2940	CP.exe
1884	CP.exe
3588	i_wtomgebwto.exe
4084	toljebvtol.sys
6008	CP.exe
2232	rljdbwqoig.exe
2984	CP.exe
1644	CP.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5824_542494079\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5824_1630416695\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5824_1630416695\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5824_1238694922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5824_542494079\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtojgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cavsnkfdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usqkfcavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbwqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jecurmgezr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdytqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlfdxvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cavsnkfdxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trojgebwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbwqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usqkfcavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbwtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jecurmgezr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmkecwu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2676	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
248	ipconfig.exe
5460	ipconfig.exe
5628	ipconfig.exe
5456	ipconfig.exe
6128	ipconfig.exe
5928	ipconfig.exe
3940	ipconfig.exe
5480	ipconfig.exe
3556	ipconfig.exe
5480	ipconfig.exe
3432	ipconfig.exe
6036	ipconfig.exe
6128	ipconfig.exe
1888	ipconfig.exe
3356	ipconfig.exe
4664	ipconfig.exe
4784	ipconfig.exe
4312	ipconfig.exe
2368	ipconfig.exe
2532	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286069440763021"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{C2EEA3AA-D39F-4FA8-A577-1B34E90F8FC3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe
5704	jecurmgezr.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe
5824	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1872	i_jecurmgezr.exe
Token: SeDebugPrivilege	3384	i_eywtojgbyt.exe
Token: SeDebugPrivilege	4552	i_gdytqoigay.exe
Token: SeDebugPrivilege	4816	i_ysqlfdxvqn.exe
Token: SeDebugPrivilege	3416	i_cavsnkfdxs.exe
Token: SeDebugPrivilege	2912	i_fzxspkicau.exe
Token: SeDebugPrivilege	2116	i_zxrpmkecwu.exe
Token: SeDebugPrivilege	1280	i_bzurmkecwu.exe
Token: SeDebugPrivilege	3372	i_trojgebwtr.exe
Token: SeDebugPrivilege	3588	i_wtomgebwto.exe
Token: SeDebugPrivilege	4556	i_rljdbwqoig.exe
Token: SeDebugPrivilege	52	i_gaysqkidav.exe
Token: SeDebugPrivilege	2512	i_usqkfcavsn.exe
Token: SeDebugPrivilege	4692	i_usqkicausn.exe
Token: SeDebugPrivilege	4884	i_causmkecxv.exe
Token: SeDebugPrivilege	3944	i_pjecwuomhe.exe
Token: SeDebugPrivilege	4580	i_gezwrmjebw.exe
Token: SeDebugPrivilege	3948	i_ljgbztrlje.exe
Token: SeDebugPrivilege	3312	i_lgdbwtolge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5824	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 1840	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 3224 wrote to memory of 4068	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 1840 wrote to memory of 5824	1840	iexplore.exe	89
PID 4068 wrote to memory of 2940	4068	iexplore.exe	90
PID 5824 wrote to memory of 4248	5824	msedge.exe	91
PID 5824 wrote to memory of 2676	5824	msedge.exe	92
PID 5824 wrote to memory of 1340	5824	msedge.exe	93
PID 5824 wrote to memory of 1340	5824	msedge.exe	93
PID 5824 wrote to memory of 4160	5824	msedge.exe	94
PID 5824 wrote to memory of 4160	5824	msedge.exe	94
PID 5824 wrote to memory of 4160	5824	msedge.exe	94
PID 5824 wrote to memory of 3952	5824	msedge.exe	96
PID 5824 wrote to memory of 3952	5824	msedge.exe	96
PID 5824 wrote to memory of 3952	5824	msedge.exe	96
PID 5824 wrote to memory of 1852	5824	msedge.exe	97
PID 5824 wrote to memory of 1852	5824	msedge.exe	97
PID 5824 wrote to memory of 1852	5824	msedge.exe	97
PID 5824 wrote to memory of 4564	5824	msedge.exe	98
PID 5824 wrote to memory of 2224	5824	msedge.exe	99
PID 5824 wrote to memory of 4832	5824	msedge.exe	100
PID 5824 wrote to memory of 4564	5824	msedge.exe	98
PID 5824 wrote to memory of 4564	5824	msedge.exe	98
PID 5824 wrote to memory of 2224	5824	msedge.exe	99
PID 5824 wrote to memory of 2224	5824	msedge.exe	99
PID 5824 wrote to memory of 4832	5824	msedge.exe	100
PID 5824 wrote to memory of 4832	5824	msedge.exe	100
PID 5824 wrote to memory of 5544	5824	msedge.exe	101
PID 5824 wrote to memory of 5544	5824	msedge.exe	101
PID 3224 wrote to memory of 3872	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 5704 wrote to memory of 5916	5704	jecurmgezr.exe	106
PID 5824 wrote to memory of 2892	5824	msedge.exe	109
PID 5824 wrote to memory of 3412	5824	msedge.exe	110
PID 5824 wrote to memory of 3412	5824	msedge.exe	110
PID 5824 wrote to memory of 2892	5824	msedge.exe	109
PID 5824 wrote to memory of 4632	5824	msedge.exe	112
PID 5824 wrote to memory of 2744	5824	msedge.exe	115
PID 5824 wrote to memory of 2744	5824	msedge.exe	115
PID 3224 wrote to memory of 2600	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5824 wrote to memory of 2308	5824	msedge.exe	118
PID 5824 wrote to memory of 2308	5824	msedge.exe	118
PID 3224 wrote to memory of 3092	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 1980 wrote to memory of 4640	1980	eywtojgbyt.exe	123
PID 3224 wrote to memory of 6104	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 3224 wrote to memory of 4412	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 2452 wrote to memory of 3160	2452	gdytqoigay.exe	132
PID 3224 wrote to memory of 5888	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 3224 wrote to memory of 3772	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 4316 wrote to memory of 5468	4316	ysqlfdxvqn.exe	141
PID 5824 wrote to memory of 5796	5824	msedge.exe	145
PID 5824 wrote to memory of 5796	5824	msedge.exe	145
PID 5824 wrote to memory of 5796	5824	msedge.exe	145
PID 3224 wrote to memory of 2688	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5824 wrote to memory of 5708	5824	msedge.exe	148
PID 5824 wrote to memory of 2656	5824	msedge.exe	149
PID 5824 wrote to memory of 3140	5824	msedge.exe	150
PID 3224 wrote to memory of 5096	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 5160 wrote to memory of 1072	5160	cavsnkfdxs.exe	155
PID 3224 wrote to memory of 3468	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 3224 wrote to memory of 4136	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 2344 wrote to memory of 248	2344	fzxspkicau.exe	164
PID 3224 wrote to memory of 6084	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 3224 wrote to memory of 1628	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 3940 wrote to memory of 1960	3940	zxrpmkecwu.exe	173
PID 3224 wrote to memory of 1104	3224	2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe	176

C:\Users\Admin\AppData\Local\Temp\2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c8f05f3bbeb644446c7b336fb0fdd089_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff9bd7dc188,0x7ff9bd7dc194,0x7ff9bd7dc1a0
      4⤵
      PID:4248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,7469323599898176033,10525643162489794059,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
      4⤵
      System Time Discovery
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2656,i,6503410823511892043,17649868802375383843,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,4301489428877152428,9878740238054552756,262144 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13903735291053525191,11814945719139544641,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,12662146158480489663,955692733436521243,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
      4⤵
      PID:1852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4440,i,8404080408065789786,11985648531854344074,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,9865454199426281572,448782168067270639,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,14046819860326681209,13753769741097367151,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:9
      4⤵
      PID:4832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,11302428835948548445,2080362590365558793,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,5350943541070177317,7828797712310231480,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12820436624826319813,7002947452087518184,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,6833163507380031573,13146478148758625903,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:1540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,6833163507380031573,13146478148758625903,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,18169516239221290241,16119813147377646758,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,18399784505503186932,11562903074171475353,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4796,i,1058343913130688008,17344604571719541503,2097152 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
      4⤵
      PID:5796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,3658131434468338216,926408170012977574,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:14
      4⤵
      PID:5708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,9766978285900054253,16989428250617321796,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:14
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1300,i,14071970236305406919,3806153201879187351,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,5826071737440373510,2968200089191281836,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,3270915689456656219,1658861479569008913,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,4580537185873543234,15320480829685053904,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:14
      4⤵
      PID:1888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4072,i,2881845625663472694,13195212222319337406,524288 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=920 /prefetch:14
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4480,i,2551927474509975434,5897046584794714280,262144 --field-trial-handle=2532,i,14645302480316270254,4004081928585729306,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:10
      4⤵
      PID:5108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jecurmgezr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3872
- - C:\Temp\jecurmgezr.exe
    C:\Temp\jecurmgezr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5704
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5916
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jecurmgezr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2600
- - C:\Temp\i_jecurmgezr.exe
    C:\Temp\i_jecurmgezr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtojgbyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3092
- - C:\Temp\eywtojgbyt.exe
    C:\Temp\eywtojgbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4640
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtojgbyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6104
- - C:\Temp\i_eywtojgbyt.exe
    C:\Temp\i_eywtojgbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdytqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4412
- - C:\Temp\gdytqoigay.exe
    C:\Temp\gdytqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2452
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3160
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdytqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\i_gdytqoigay.exe
    C:\Temp\i_gdytqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqlfdxvqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3772
- - C:\Temp\ysqlfdxvqn.exe
    C:\Temp\ysqlfdxvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqlfdxvqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Temp\i_ysqlfdxvqn.exe
    C:\Temp\i_ysqlfdxvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cavsnkfdxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5096
- - C:\Temp\cavsnkfdxs.exe
    C:\Temp\cavsnkfdxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1888
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cavsnkfdxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3468
- - C:\Temp\i_cavsnkfdxs.exe
    C:\Temp\i_cavsnkfdxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4136
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1628
- - C:\Temp\zxrpmkecwu.exe
    C:\Temp\zxrpmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1104
- - C:\Temp\i_zxrpmkecwu.exe
    C:\Temp\i_zxrpmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\bzurmkecwu.exe
    C:\Temp\bzurmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3140
- - C:\Temp\i_bzurmkecwu.exe
    C:\Temp\i_bzurmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trojgebwtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\trojgebwtr.exe
    C:\Temp\trojgebwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trojgebwtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3648
- - C:\Temp\i_trojgebwtr.exe
    C:\Temp\i_trojgebwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtomgebwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:304
- - C:\Temp\wtomgebwto.exe
    C:\Temp\wtomgebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtomgebwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1884
- - C:\Temp\i_wtomgebwto.exe
    C:\Temp\i_wtomgebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljdbwqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6008
- - C:\Temp\rljdbwqoig.exe
    C:\Temp\rljdbwqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljdbwqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Temp\i_rljdbwqoig.exe
    C:\Temp\i_rljdbwqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  PID:928
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
  2⤵
  PID:1912
- - C:\Temp\i_gaysqkidav.exe
    C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:52
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkfcavsn.exe ups_run
  2⤵
  PID:4356
- - C:\Temp\usqkfcavsn.exe
    C:\Temp\usqkfcavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkfcavsn.exe ups_ins
  2⤵
  PID:5388
- - C:\Temp\i_usqkfcavsn.exe
    C:\Temp\i_usqkfcavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usqkicausn.exe ups_run
  2⤵
  PID:2528
- - C:\Temp\usqkicausn.exe
    C:\Temp\usqkicausn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usqkicausn.exe ups_ins
  2⤵
  PID:5184
- - C:\Temp\i_usqkicausn.exe
    C:\Temp\i_usqkicausn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxv.exe ups_run
  2⤵
  PID:708
- - C:\Temp\causmkecxv.exe
    C:\Temp\causmkecxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxv.exe ups_ins
  2⤵
  PID:5344
- - C:\Temp\i_causmkecxv.exe
    C:\Temp\i_causmkecxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjecwuomhe.exe ups_run
  2⤵
  PID:5460
- - C:\Temp\pjecwuomhe.exe
    C:\Temp\pjecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjecwuomhe.exe ups_ins
  2⤵
  PID:5172
- - C:\Temp\i_pjecwuomhe.exe
    C:\Temp\i_pjecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrmjebw.exe ups_run
  2⤵
  PID:5212
- - C:\Temp\gezwrmjebw.exe
    C:\Temp\gezwrmjebw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4984
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrmjebw.exe ups_ins
  2⤵
  PID:5168
- - C:\Temp\i_gezwrmjebw.exe
    C:\Temp\i_gezwrmjebw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgbztrlje.exe ups_run
  2⤵
  PID:5764
- - C:\Temp\ljgbztrlje.exe
    C:\Temp\ljgbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgbztrlje.exe ups_ins
  2⤵
  PID:3816
- - C:\Temp\i_ljgbztrlje.exe
    C:\Temp\i_ljgbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdbwtolge.exe ups_run
  2⤵
  PID:5072
- - C:\Temp\lgdbwtolge.exe
    C:\Temp\lgdbwtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdbwtolge.exe ups_ins
  2⤵
  PID:4636
- - C:\Temp\i_lgdbwtolge.exe
    C:\Temp\i_lgdbwtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtnlid.exe ups_run
  2⤵
  PID:1592
- - C:\Temp\ljdbvtnlid.exe
    C:\Temp\ljdbvtnlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4176

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:6000

C:\Temp\olgdywqojg.sys
C:\Temp\olgdywqojg.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\fdxvqnifdx.sys
C:\Temp\fdxvqnifdx.sys
1⤵
- Executes dropped EXE
PID:3308

C:\Temp\lfaxvpnlfd.sys
C:\Temp\lfaxvpnlfd.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Temp\fzxvpnicau.sys
C:\Temp\fzxvpnicau.sys
1⤵
- Executes dropped EXE
PID:4320

C:\Temp\zuspkheczu.sys
C:\Temp\zuspkheczu.sys
1⤵
- Executes dropped EXE
PID:5812

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:6072

C:\Temp\jhbzurmjhb.sys
C:\Temp\jhbzurmjhb.sys
1⤵
- Executes dropped EXE
PID:2616

C:\Temp\bztrljdbwt.sys
C:\Temp\bztrljdbwt.sys
1⤵
- Executes dropped EXE
PID:1700

C:\Temp\toljebvtol.sys
C:\Temp\toljebvtol.sys
1⤵
- Executes dropped EXE
PID:4084

C:\Temp\idavsqlida.sys
C:\Temp\idavsqlida.sys
1⤵
PID:3028

C:\Temp\kigavsnlfd.sys
C:\Temp\kigavsnlfd.sys
1⤵
PID:2120

C:\Temp\avsnkfcaus.sys
C:\Temp\avsnkfcaus.sys
1⤵
PID:5204

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
PID:4092

C:\Temp\rpjhczurpj.sys
C:\Temp\rpjhczurpj.sys
1⤵
PID:6108

C:\Temp\urmhezxrpj.sys
C:\Temp\urmhezxrpj.sys
1⤵
PID:2120

C:\Temp\mjecwtrljg.sys
C:\Temp\mjecwtrljg.sys
1⤵
PID:2116

C:\Temp\ljdbytrljd.sys
C:\Temp\ljdbytrljd.sys
1⤵
PID:5132

C:\Temp\nlgdywqoig.sys
C:\Temp\nlgdywqoig.sys
1⤵
PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cavsnkfdxs.exe

Path C:\Temp\cavsnkfdxs.exe
Size 230KB
SHA256 f9360fc5e4ae9d93bda5a74fa12a9e96809285416bd15bb8d3879fe56069a0c1
MD5 c53c6f5ef243de55e0d748a769c5655d
SHA1 9303010ddad408f1f325a9379c7a8bed41fb6e89
SHA512 1a587465ee6663016f7ed5ee4209c59ca02a7ba2af8d2fb4950b27babc3abc5f6924e69d651ae41c2b6bad398119d1f7eb7a4e5b6d754b4851cf7b45b47e5649
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T15C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtojgbyt.exe

Path C:\Temp\eywtojgbyt.exe
Size 230KB
SHA256 ce2861c7883ffee9ac9b4ae29fb659f55a8cb68b04974e6efe732e1377395234
MD5 bb37d2b622a2b041c53bd7f7411c4e4c
SHA1 23df53c6b71250746a0c0522f1b18b9a541b7d7f
SHA512 5793b43db7319256e0863d22eb2a47b88aa6e2538a29a3eb57148c77212f4fa22139edf54895b76ba3e32995dfee1a7c5f04dd9ebdbec18944cde25a4abb807a
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T1F1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifdx.sys

Path C:\Temp\fdxvqnifdx.sys
Size 141KB
SHA256 54cd2b213bdb3ea4d14882507a585fa62e3aa774bacb1ad05334949396bea32f
MD5 be939bc75d7bc1f3f81c8396dd29bf0a
SHA1 7e6cfeafc91b7e15d28310832bbce97ee50189c1
SHA512 8da76393eddc9e120ef659e7f34cae4879434cde780ef17383efeef463749304ee15e46360cb35ad385f470c4b6b7ab5bdcd39be718738d979c108fcb5efd5bf
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T105E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxspkicau.exe

Path C:\Temp\fzxspkicau.exe
Size 230KB
SHA256 a65e1d8a3de6bd9618185866692de917c1657370b3739d9f2216afc77fc194a3
MD5 9b1b9459f65c2aa8bed9310e3b300d12
SHA1 bf6cc105a2c91778821d4062252146b927ed3b14
SHA512 e9a373e34e4bd60d60b4252ad3f4c7f5ad8b26998772619b9746efee55f54737ec8ff783a4b039b0ab89f35903bc820b55158703f894d1ccccb93b44ba2dee22
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxvpnicau.sys

Path C:\Temp\fzxvpnicau.sys
Size 141KB
SHA256 c219773c5194d245752e5ee4d665393c31733202c5a193e85cfd00d97f537911
MD5 6f50e023004fb97f673ff19c120b34c6
SHA1 e20800da6dd936d3a77e285601562f5e8a6b0b7c
SHA512 1223b6fb15900629de8bb7e5cb246b2877d1e72dc16e78a024aa03f0c5966e6fe3e3f04ea2dc79583d7e80379b3809d06f26e0678d59ad6baaa821aa58d6a133
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T12AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdytqoigay.exe

Path C:\Temp\gdytqoigay.exe
Size 230KB
SHA256 c974ec29a5e7adbdfa150f1a0d9fec9bedfedc4ec6861ea2764adbbca5480960
MD5 ff79041d06cd02c61cc8617d1a74cd4e
SHA1 ba939639fab444eaa566e70954e2b04f2f4d9af1
SHA512 c3b94457a6faa632275a8879079357eaaf87815653753221f49e249142d4f9421e372514fc512863c87da510e1fa59a3271fa0f86a10974f44b0fde35ca342f2
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T16D344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cavsnkfdxs.exe

Path C:\Temp\i_cavsnkfdxs.exe
Size 230KB
SHA256 a5cbf2e6ef9116a8f39b693133d73ec45afbf742a0e90656818f17a04f5d79cc
MD5 0eba4d2bead3a29db3373e1c80cc53c0
SHA1 4e502f31d69e1680701a4c62fa3f30b8f4601ec5
SHA512 868eca05f63df8a3fb77d33e8f78dee00ae7c370b7b01e148c7e075a7780470ccad3c4b03da7d8e9ab157dd06a669a954651af0b7ed0cfdfb7c7f7615aec13e4
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywtojgbyt.exe

Path C:\Temp\i_eywtojgbyt.exe
Size 230KB
SHA256 fcfa8beadfa597299ca4af292ce79d470c1bf88e787e7fce541343fde4b5fac4
MD5 769cf4d01fe6176ca325b43f4060e69d
SHA1 7d4d4e82b7f720227c1b32bba50078517384a855
SHA512 007ab04c5d500a6d3eb2943518815331a9cc9a43165d8b115e8354e100ee562d96f7a08178d357a9266779cd1ed66afab765f43b1ce632d438945ae30c78605f
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:MghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxspkicau.exe

Path C:\Temp\i_fzxspkicau.exe
Size 230KB
SHA256 b1d29967b2c417c7212cb663807004e4bb22818b2c03fe26decf078dfad3b678
MD5 515561233f051fb78115ad1aa9134c2a
SHA1 f2c8890cf155e90e8b09d5352de8bd1edf1ea742
SHA512 33a81d7a614162390f92d728523622e7fd032e024986cd5f19c941d51ac469167041e131ec1172a1e7cbf1e503d79e8dc0abcb83f9a328f01ea109b01c042576
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T19E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdytqoigay.exe

Path C:\Temp\i_gdytqoigay.exe
Size 230KB
SHA256 bad19b7082f0c70dbd85713bfcd4abfe09fea802c8cdc42ef869738a8361f74d
MD5 e49d108e66a85dd5f75a7431e40e3eab
SHA1 a3579f1dbfeb71aa4f2a313ba5acca7b1d09f77d
SHA512 0eb870ac4c33fa55b9f5e0e70f015ec6eac45ec1c619994d7f84404ec8b64afabf443309cfc065d1eccb4de1bef4fe9ad122c22f8ecb83e5136ab5384d04307f
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9z:GghLQ0sQmpcF8BzXfwVfAI
TLSH
T180344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jecurmgezr.exe

Path C:\Temp\i_jecurmgezr.exe
Size 230KB
SHA256 62332a380cd05334e312a501e4437032eb3788332252f808b53719c134399301
MD5 48e4bfa1afcb923d820e9933e1427b31
SHA1 7420ece2dac6eec38eeabaddc9801326f8d865cd
SHA512 34f7cee1396ae689e8f06531cdd4af8800a6a2d17c4e97908f5f6309e0791749821507096d94347296bd31d6e378d3d15abd77ab60b56981013eabef6243c50a
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T19E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqlfdxvqn.exe

Path C:\Temp\i_ysqlfdxvqn.exe
Size 230KB
SHA256 58ffd7c52cfc7d96a677fe56023692ea2c5246de70b7c2d4bbd23396a75b8db6
MD5 b7e8933a61db09ea9ef17d8d06f862b4
SHA1 bc9fd62eb6d82bef20821fef407af43a6c784ebf
SHA512 7531ed5745e41cd511852a8bd7ef7daab9cee641cd41e686159dc3314e311641786f873cd43d9534b04b45995396850465e09fe06946525cba9fd7b0c8183ff7
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecurmgezr.exe

Path C:\Temp\jecurmgezr.exe
Size 230KB
SHA256 01a755cb39c9f0e9daeb4fe32d24dd926116056b6bd4379d6a8a374936a28945
MD5 957bf2c007cfcc43ef6862484474a726
SHA1 40120e62c05d6a5d132d8970b727de24bed2d865
SHA512 557e57c758df6b10f95b7d32857e52909bd401544d582c55bf67d7d002494a13d27e17e3a41dfc66a76307ce0210e80f57b0cc48196095bab3af3c2fe6ff9244
SSDEEP 3072:nJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:nghLQ0sQmpcF8BzXfwVfAI
TLSH
T183344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfaxvpnlfd.sys

Path C:\Temp\lfaxvpnlfd.sys
Size 141KB
SHA256 a694e9bb4a1fac6f11e17f7d335aed6b53ab4db0768e9fdc7f6afa62269ccf6b
MD5 1214a3437496c2336b58b59ae8cf1f96
SHA1 68db455ef25ae376bdcad953b95bf5ddd8c7e7cf
SHA512 94ce9b85a9c36ca94184ef437bdb6f53fabd26b1ff33624c5f52b21ca751d928133934ba076eb2ee1a73b2915f081777f0ee8e637d312847eedc8df78fecb8dd
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T139E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 154b2b4b4462ec38a6e5cc8a701f5baa7d6d7ec3640b75e5c41825f5b4d22665
MD5 ea529721971a23c77abc675447ead83e
SHA1 081fa8a527793a2d7b6f052545c29ca8afdb69b8
SHA512 fce2ca718dbd0a53ab17b48bdb8f8fda172002c51f796b87fe92b188076f9aae3da1a3875fc6af06ecd265cebb5b810d5c451b9cd15485c90a30bf91c388f273
SSDEEP 3072:BsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:BsQmpcF8BzXfwV
TLSH
T1E7E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdywqojg.sys

Path C:\Temp\olgdywqojg.sys
Size 141KB
SHA256 e589c2c49eb1e80835b8c8078a8a7014b6e10ac6ad94593cfa8d4d4e76ce1352
MD5 2e2edbb2fbecb3eb3fa3084af2962573
SHA1 eff71a7187187c45f6fc5c2a22f76887f16640b1
SHA512 766d1e7fff342f0d8a0abeb834cdce45ce21d3db8860720a3b37f6bd4753b13120d5e7fbbd23b4dd3a30d0f89c62a39c7e6cd50df2b3ecce161b853f8a96cafd
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T11DE38D12B2D19172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlfdxvqn.exe

Path C:\Temp\ysqlfdxvqn.exe
Size 230KB
SHA256 098b67f8c2db4a6537865ebe82707a3076e1ace5db2aca4e3643a41fac49b328
MD5 ac28b6f3926dfd6211f30bf4cbb0f909
SHA1 871375c24f693a8c4a0b4519b265e93e42b897a0
SHA512 9259da2d27ec7949f1ba382e7bb974035064adc507ccdf893a3a8881cbfc156c026b1e5f5bc07df8e82c161876707b33f5a459c2c989be4aab8551d6707cc818
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T171344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 add0f78b7e4d8e1d6d9a829aea5df740f0c2e35deb4319b39295facae41cacbd
MD5 46253948852332f6c3d481d4a8f833a3
SHA1 34203159f486f7eb05bd224e96bb0d4bb4139b0b
SHA512 39e8f373930c150cf375c4d23a7083a9cabfe3229f96484d4ea680a42c4556adefeec0a2a2fe2c258672649a2c301d5ffd4dacace1b7af8bee4c4bf3b4a61684
TLSH
T1CF61921433658AD2DF2C5EB117E0A46836FC8E582507AE1968C2ED39EC82F7873D011B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a02e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a02e.TMP
Size 3KB
SHA256 d5411cf549168ca621e0f32bc6e38ffff5cddabbc9819dd8f493719f8dd1b132
MD5 2f8241db00d06664d76bb48931f2aeac
SHA1 084dd149f7afd187f451f8c4623b4663f82be0bc
SHA512 e956b4495c68e9be430b4a76183d9a4821a9e6b9838ad89677780394746cb27f459e5d1309c1e75501abf3e723a12f6fba8bed0ed154d519689717da868bfbb8
TLSH
T15261925433258AD2DF2C5EB117E4A02836FC8E582507AE1968C2EE39EC82F3873D011B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2822b1b37da4b9ec74bd9623352447e715d31140a70a5f79ed5d5ccd63bb3650
MD5 fda47cd7d500c8a3f25f26d5d40fe693
SHA1 18679449bd579f5ba0da6ff38b0bf67f80e70f98
SHA512 8141aaa3edcb495ecaa6a9e36a32d013dc49b3ff3a9a736e646983c9740d299d28bb4c35c80bad49f428465276531c498631f85f87906e434526b2ee182f07c4
TLSH
T198418CF3C3E5866E890156F0AB187E1BCE2D0915432C3D5AC9E4AF5BA3E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ecc71a06f84027c3fcba319777fda16e906aa4ca4abe8dc20631c1cfa99dcc22
MD5 836a2fa112412362c5e8e744d10ad656
SHA1 9aa00a2505f960dc00c4e7a79ecbb017d16dfb90
SHA512 47e9304a2a7476d098d574e48370c2e85a0140304611e24af50b1c1d573a404d3b5561263a9d5c51382a3e86fd68b2050904fd3a24c4e1bc50ba666ff83a0c73
SSDEEP 192:sxR1RKyM/jK1Ml8wC4/fmsMgHc4ZnnzoA8pi/g6+WNIYD9a6SNGMu8tIgtJ:sxR1I84/fmsxHcGnOi/5I2SS8x3
TLSH
T19152EA156A345E7BDCDBD208FA557F93D6F91573A2901E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c8aab5e59b26cc37c0084b8f6aad503b81da880d0dc3491ed7c28a94fe0839f4
MD5 9c638345e847defec062f6d8a3e3e002
SHA1 2289835e0387c813801693a709a22a409b2e1350
SHA512 6d0a5495ed079263e2af265e4eeb24068896da792a90b60f385cc9e682e0070b629ba2caedd08ed45815375cac48b235cd28f77ac43f8f5d1c0eb7cee793ba3b
SSDEEP 192:sxRORKyM/jK1Ml8wC4/fmsRgHr4ZnzzoA8p90/g6+WNC9S/YD9O6SNGMu8tIgDzJ:sxROI84/fmsGHrGnia/5x/kSS8xZ
TLSH
T16C62EB166A245E779CDBD208FA557F93D6F91573A2901E04ABFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4a5783de14078043f57c73f7d432dff4e221e404c9020af7c233e2b3d3613085
MD5 fe7ca2eb138c99c8dccec9b351ab758f
SHA1 1135dd6a2ed17d785a6c5bdb8c8cac355c4e10cb
SHA512 2a79ec9d32ec72070d204a8ec8c25449e412167201611d01d02a4e27549cc69fc7c97fbdb999ea9a2ea7d9aafcb0be04c05bf41aa140ee8ea23120602e1e4206
SSDEEP 192:sxRORKyM/jK1Ml8wC4/fmsRgHc4ZnnzoA8pi/g6+WNIYD9a6SNGMu8tIgDBJ:sxROI84/fmsGHcGnOi/5I2SS8xP
TLSH
T1DD52DA156A345E7BDCDBD208FA55BF93D6F91573A2901E44AAFCCA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 758cbe14d832ecf1537ec9e66c1cbb5a64acb529c9989555c959fc61721bfdf2
MD5 bd67b13369667f35e135cde2157725c5
SHA1 fcc492073dafc5cd8b8f26845f769eb21a3940b8
SHA512 c27425fe7b983e5efcb356c9d67713fcb817ac2ac7adb923b992ae36cefe2ca71491ee2ab60fa3a7ad3c367ea3c699f5ab73ca24947d64f833b633f41083c2b2
SSDEEP 192:sxRORKyM/jK1Ml8UQtC4/fmsRgHr4ZnzzoA8pr0/g6+WNC9S/YD9O6SNGMu8tIgZ:sxROIqM4/fmsGHrGni4/5x/kSS8xZ
TLSH
T1DE62DC166A245E779CDBD208FA55BF93D6F91573A2901E04ABFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8ef2086068b0e31f0fdc21681d939548c790d5951b254ef32e136aed015ffa03
MD5 60b39e5c191470dddb8397a4e5810e68
SHA1 50871eef1b51000657673e6e77d84172757ba817
SHA512 00f3740da27c34ec3ddf18a095a25268035171f909876fdb9c41dd7c0cc63682e40bd8bf946b381c2ca750b0969ca75d7e4e95c9abe4ed2cbbc6d96b250fe7c6
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+OAc1sXro/lFIy:aW5WFdE710Wg/XfCfu1jahOAysE/lt
TLSH
T106E2FC3B280CCB7E4F844A9CED297DDAAD9801CF969CCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d7d57a1814173ba26a4962521a94b3218e6241dfab5cbd9b07ce36f4f1407205
MD5 92bca13c681aa6cad5fef9e23921c18c
SHA1 4217411bf16d75bf79a20a13941af8c630cacff7
SHA512 eb016701fd6aa8faabc18dc242e192d6a7b7cb15ccd96d04de8dc3b3350470ca02f8bea66246337c8511073c1354ac5788981ba38c16dd26ec7941672eb3777c
SSDEEP 768:rrv+4UNbdS3/mi0tLrEnjN3Gac1ZqeVH1SCz:rbsbg3s9QnjMa9EH1V
TLSH
T17F03CF3669B88EB38CEBA385718776037EF4525385940BE4CACD6B0D06975EC230BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 732f75a8c5b335002441534eb3aca907ca31c9a48e4ec822c963e1e67c8297fe
MD5 b239b82ba2b4dc55b83960dfe1c9c662
SHA1 2f184d30d70c9a4dcefada282caa52867ff8dd61
SHA512 ef0e495b86b5a93227f6553c36ff1400e61c3a19b53b022681f96055c2bf19007886914bb9e5763c94357e527559a96b5749951011962d10632201790777b2f8
SSDEEP 768:Grv+4UNbdS3YfiHi0tZoMrEnjN3Gac1Fjc1e:Gbsbg3YcEMQnjMaYcw
TLSH
T11B03BF317569DEB38CFBD285B1477643BEF4126385C10FA4DAD9AB0C15879E9230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d363310ffaa8d8ed9a876e22331978fc4d94663f732c1f056000726bcd83a8a
MD5 0c58199e7e9edcb25c3a8fde7e21c92f
SHA1 5412da3cdd998dd67aeb75c7f01fafff8b443921
SHA512 0b2bbb2d8cf2558b68e86f3d2aa9ec7fab364e829838f7b06ebb1d9986129ffe4668d6eb1b632835c39ebc7b187d931c66049518deae37e8abdaa57427870e14
SSDEEP 384:n7tNn/s3n9SX38NEVwIc7xfFk2WZlf8hyEGhWVFeWnzbly2rEoajo4cdR8eHhVOg:7j+9M3YjiHi0tZo/rEnjN3Gac1FjMja
TLSH
T1E7F2BF7579A5DEB38CEAD28575077782EFE016A345C00E94DAD9AF0D15C36EC130B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 ec5d255e51f50ec54812da935fc769adfbcb1fd49bef662e2d078e8122c9fcd4
MD5 1abb3d163de0995e315568167a2957b2
SHA1 53c7c699e114a3755c6e64670423492ba0ad6413
SHA512 c5dd796a475c92d4718ae3e1e1e783a559e2305a68962650f07ce5c5dc5f418345564b46e94378c1a4ca636a9f6ee00298375c45f1ccd625712193e2c288fe47
SSDEEP 384:nTtNn/s3n9SX38NEcwIc7xfFk2WZlf8hyEGhWVFeWnzbly2rEoajo4cdR8eHhVOg:Tj+9M31jiHi0tZo/rEnjN3Gac1FjMja
TLSH
T159F2BF7579A6DEB38CEAD28576037781EFE016A345C00E94DAD9AB0D15C36EC130B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f9425e0e34a977a8681686c73249b58933a2c2a4533eefa73a517b43b34130b2
MD5 e8cf82262f95fcccead4ddd84253e89f
SHA1 828c625a1a58615229208650bcc6151588adadaa
SHA512 71d52746bc55c5e413e5fa09d237fb46434a7ed877e31da84c2b6a47fbedf662824bc0604ec1bf69fa42ae4c4955066d645972d34a5727db6aa7cbb845d2b3aa
SSDEEP 384:nYtNn/s3n9S438NEcwIc7xdFk24Hft5yEGhWVFeWnzb2y2rEoajo4cdR8eHhVODc:Yj+9T31BiFstZomrEnjN3Gac1FjMja
TLSH
T1AC1317F5A4E79E72C8DE9387633E6E419EBCD15375840994BBC46E0CCC825BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 1e73289e4d3aa33799ecef0f149604c757eba3679ac94e78579cc17f79b91e2e
MD5 43bf64a9f2843a4dcd662288edbacef7
SHA1 40a7b7b6af999f178b6ee4222dc6ac7d64b9f1e6
SHA512 77e68cfa68c41c609479aeaa4a1b10a1b875c334e203594df0fbce107613e233b27312a6d4d245b2ac803aa41f459cb0bb3964a0917a77241b01fbd269d012f6
SSDEEP 768:orv+4UNbdS3iOi0tZojrEnjN3Gac1FjeVH1SC8:obsbg3lEjQnjMaYEH12
TLSH
T1BD03BF3165B8DEB39CEBE385B14776437FB4126385850FA4CAD9AB0D06875D8230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

711e5b49-076d-4bf5-8c1e-3200dc05076a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\711e5b49-076d-4bf5-8c1e-3200dc05076a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5824_1873236954\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1196-479-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1700-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2116-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2120-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2120-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2120-457-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2616-336-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-244-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3308-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4084-369-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4092-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5132-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5204-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-333-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5900-292-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6000-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6108-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download