systex | f0f350b4b60ee724e9a22d8d93232c328ff6248d5199e4d76b2fcc71dbb8c5a6

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260721-erhefaew6j
SHA256 f0f350b4b60ee724e9a22d8d93232c328ff6248d5199e4d76b2fcc71dbb8c5a6
MD5 5b5518e4c9b3975b0165b9794cd1c9b7
SHA1 d58ac2612596f2e55540e68b04111615419ba598
SHA512 77aef5acba0a6d3030402cc74de8fc62a3bfb101521da8dd327d3ccd648e8a0849b78770e531381ee586e89012ed43f03d1a27f23a8c5c4779d6181ca5516475
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T15A344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3948	CP.exe
4532	zurmkcxumk.exe
1304	CP.exe
6076	CP.exe
3412	i_zurmkcxumk.exe
3820	kecwuomhez.sys
2212	CP.exe
3964	trpjhbzxro.exe
2292	CP.exe
3552	CP.exe
4144	i_trpjhbzxro.exe
2044	rpjgeywroj.sys
5368	CP.exe
5892	rljeywrojh.exe
2612	CP.exe
4788	CP.exe
5444	i_rljeywrojh.exe
1504	omgeywrojg.sys
4644	CP.exe
4436	mgeywtqoig.exe
1396	CP.exe
1872	CP.exe
3488	i_mgeywtqoig.exe
2344	tjgbywqoig.sys
1180	CP.exe
4304	dyvqoigays.exe
4728	CP.exe
3828	CP.exe
4104	i_dyvqoigays.exe
4712	yvtnlfdyvt.sys
616	CP.exe
1772	oifaysqnli.exe
1148	CP.exe
3908	CP.exe
1704	i_oifaysqnli.exe
3060	nifdaysqki.sys
5124	CP.exe
3876	kidavpnifa.exe
2940	CP.exe
2396	CP.exe
1812	i_kidavpnifa.exe
3844	pnhfzxspki.sys
2324	CP.exe
3816	nkfcxvpnhf.exe
4816	CP.exe
200	CP.exe
5172	i_nkfcxvpnhf.exe
5348	spczxupmkh.sys
4220	CP.exe
5544	fcaxspjhcz.exe
3736	CP.exe
1992	CP.exe
1172	i_fcaxspjhcz.exe
5092	hezxrpjhcz.sys
4800	CP.exe
3488	urmkecwurm.exe
1068	CP.exe
1864	CP.exe
3724	i_urmkecwurm.exe
5548	zxrpjhbzur.sys
2280	CP.exe
2996	urojgecztr.exe
3336	CP.exe
4692	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1515422377\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1515422377\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1405715595\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1405715595\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1405715595\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_784495484\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_784495484\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1405715595\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5228_1680179044\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpjhbzxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavpnifa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tromjebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkcxumk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpjhbzxro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywtqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urojgecztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljeywrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oifaysqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urojgecztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidavsnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkcxumk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oifaysqnli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcaxspjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidavsnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcaxspjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tromjebzwr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2156	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5348	ipconfig.exe
5016	ipconfig.exe
2980	ipconfig.exe
3268	ipconfig.exe
2812	ipconfig.exe
5504	ipconfig.exe
2808	ipconfig.exe
6000	ipconfig.exe
6048	ipconfig.exe
3320	ipconfig.exe
3644	ipconfig.exe
1692	ipconfig.exe
2380	ipconfig.exe
3632	ipconfig.exe
5256	ipconfig.exe
5976	ipconfig.exe
6004	ipconfig.exe
4284	ipconfig.exe
5420	ipconfig.exe
4244	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290806274722942"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{65BEC2E2-1B01-4880-B47F-4DAF405F3EBF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe
4532	zurmkcxumk.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe
5228	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	i_zurmkcxumk.exe
Token: SeDebugPrivilege	4144	i_trpjhbzxro.exe
Token: SeDebugPrivilege	5444	i_rljeywrojh.exe
Token: SeDebugPrivilege	3488	i_mgeywtqoig.exe
Token: SeDebugPrivilege	4104	i_dyvqoigays.exe
Token: SeDebugPrivilege	1704	i_oifaysqnli.exe
Token: SeDebugPrivilege	1812	i_kidavpnifa.exe
Token: SeDebugPrivilege	5172	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	1172	i_fcaxspjhcz.exe
Token: SeDebugPrivilege	3724	i_urmkecwurm.exe
Token: SeDebugPrivilege	5704	i_urojgecztr.exe
Token: SeDebugPrivilege	2488	i_ywqojgbztr.exe
Token: SeDebugPrivilege	5696	i_oigbytrljd.exe
Token: SeDebugPrivilege	3980	i_dbnlfdyvqo.exe
Token: SeDebugPrivilege	4612	i_lidavsnkig.exe
Token: SeDebugPrivilege	6104	i_davsnlfdxv.exe
Token: SeDebugPrivilege	1420	i_usmkhfzxsp.exe
Token: SeDebugPrivilege	4624	i_czxjhfzxrp.exe
Token: SeDebugPrivilege	3420	i_urmjecwupm.exe
Token: SeDebugPrivilege	1692	i_tromjebzwr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 3152	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4548 wrote to memory of 4932	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 4932 wrote to memory of 5228	4932	iexplore.exe	92
PID 5228 wrote to memory of 4908	5228	msedge.exe	93
PID 5228 wrote to memory of 2156	5228	msedge.exe	94
PID 5228 wrote to memory of 5888	5228	msedge.exe	95
PID 5228 wrote to memory of 5888	5228	msedge.exe	95
PID 5228 wrote to memory of 3832	5228	msedge.exe	96
PID 5228 wrote to memory of 3832	5228	msedge.exe	96
PID 5228 wrote to memory of 3832	5228	msedge.exe	96
PID 5228 wrote to memory of 4820	5228	msedge.exe	98
PID 5228 wrote to memory of 4820	5228	msedge.exe	98
PID 5228 wrote to memory of 3324	5228	msedge.exe	97
PID 5228 wrote to memory of 4820	5228	msedge.exe	98
PID 5228 wrote to memory of 3324	5228	msedge.exe	97
PID 5228 wrote to memory of 3324	5228	msedge.exe	97
PID 5228 wrote to memory of 5312	5228	msedge.exe	99
PID 5228 wrote to memory of 5956	5228	msedge.exe	100
PID 5228 wrote to memory of 5312	5228	msedge.exe	99
PID 5228 wrote to memory of 5312	5228	msedge.exe	99
PID 5228 wrote to memory of 5956	5228	msedge.exe	100
PID 5228 wrote to memory of 5956	5228	msedge.exe	100
PID 5228 wrote to memory of 5296	5228	msedge.exe	102
PID 5228 wrote to memory of 5296	5228	msedge.exe	102
PID 4548 wrote to memory of 3948	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 4532 wrote to memory of 1304	4532	zurmkcxumk.exe	107
PID 5228 wrote to memory of 5960	5228	msedge.exe	109
PID 5228 wrote to memory of 5632	5228	msedge.exe	108
PID 5228 wrote to memory of 5960	5228	msedge.exe	109
PID 5228 wrote to memory of 5632	5228	msedge.exe	108
PID 5228 wrote to memory of 4540	5228	msedge.exe	113
PID 5228 wrote to memory of 5024	5228	msedge.exe	114
PID 5228 wrote to memory of 5024	5228	msedge.exe	114
PID 5228 wrote to memory of 712	5228	msedge.exe	117
PID 5228 wrote to memory of 712	5228	msedge.exe	117
PID 4548 wrote to memory of 6076	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4548 wrote to memory of 2212	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 3964 wrote to memory of 2292	3964	trpjhbzxro.exe	124
PID 4548 wrote to memory of 3552	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4548 wrote to memory of 5368	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5892 wrote to memory of 2612	5892	rljeywrojh.exe	133
PID 4548 wrote to memory of 4788	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4548 wrote to memory of 4644	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4436 wrote to memory of 1396	4436	mgeywtqoig.exe	142
PID 4548 wrote to memory of 1872	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 5228 wrote to memory of 2596	5228	msedge.exe	148
PID 5228 wrote to memory of 4544	5228	msedge.exe	149
PID 5228 wrote to memory of 2848	5228	msedge.exe	150
PID 4548 wrote to memory of 1180	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 4304 wrote to memory of 4728	4304	dyvqoigays.exe	155
PID 4548 wrote to memory of 3828	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4548 wrote to memory of 616	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 1772 wrote to memory of 1148	1772	oifaysqnli.exe	164
PID 4548 wrote to memory of 3908	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4548 wrote to memory of 5124	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 3876 wrote to memory of 2940	3876	kidavpnifa.exe	173
PID 4548 wrote to memory of 2396	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4548 wrote to memory of 2324	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 3816 wrote to memory of 4816	3816	nkfcxvpnhf.exe	182
PID 4548 wrote to memory of 200	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5228 wrote to memory of 5108	5228	msedge.exe	187
PID 5228 wrote to memory of 5108	5228	msedge.exe	187
PID 4548 wrote to memory of 4220	4548	2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 5544 wrote to memory of 3736	5544	fcaxspjhcz.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_5b5518e4c9b3975b0165b9794cd1c9b7_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  PID:3152
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ffc6a4ac188,0x7ffc6a4ac194,0x7ffc6a4ac1a0
      4⤵
      PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,8138078746131160893,7883338787917512794,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
      4⤵
      System Time Discovery
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2144,i,6928107358170010540,13377621905924989842,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:13
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,12591979838716738859,11023859600982268029,262144 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,16761619369926687659,10315069985008289547,2097152 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,2340683580258415248,330564882213249554,2097152 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4692006706052775553,7557710401810485390,2097152 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17289108420889621989,9301080637049053953,2097152 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,3151268597535405057,14774498848189689257,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,12698374602030567392,8910478510584767426,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,5964975567402592109,2870435494517496256,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15732111635074708288,1630349229412863663,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,15732111635074708288,1630349229412863663,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,6855964090865679842,18302549301637828982,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,11022893641090728467,8887616100168503337,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,7275197789418286111,18209508280661944087,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
      4⤵
      PID:2596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,15614734410539484,12149713728027355351,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,4640647251669836785,13845016120385813840,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10812748590595247086,4497002172860204576,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:5108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,9406032661843176282,1212139766322167095,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,2926959610023927178,11019627861568780740,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:3228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,5117182627488937404,5326066946740196711,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6168,i,7716691281420647991,16198173515405442324,262144 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:10
      4⤵
      PID:2816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,14805306233987192477,14990756767546645548,524288 --field-trial-handle=2592,i,8725334080670868600,13293725749821273263,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
      4⤵
      PID:548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkcxumk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3948
- - C:\Temp\zurmkcxumk.exe
    C:\Temp\zurmkcxumk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkcxumk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6076
- - C:\Temp\i_zurmkcxumk.exe
    C:\Temp\i_zurmkcxumk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trpjhbzxro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2212
- - C:\Temp\trpjhbzxro.exe
    C:\Temp\trpjhbzxro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trpjhbzxro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3552
- - C:\Temp\i_trpjhbzxro.exe
    C:\Temp\i_trpjhbzxro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rljeywrojh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5368
- - C:\Temp\rljeywrojh.exe
    C:\Temp\rljeywrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rljeywrojh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\i_rljeywrojh.exe
    C:\Temp\i_rljeywrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywtqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4644
- - C:\Temp\mgeywtqoig.exe
    C:\Temp\mgeywtqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4436
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywtqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\i_mgeywtqoig.exe
    C:\Temp\i_mgeywtqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigays.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1180
- - C:\Temp\dyvqoigays.exe
    C:\Temp\dyvqoigays.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigays.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\i_dyvqoigays.exe
    C:\Temp\i_dyvqoigays.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oifaysqnli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Temp\oifaysqnli.exe
    C:\Temp\oifaysqnli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oifaysqnli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3908
- - C:\Temp\i_oifaysqnli.exe
    C:\Temp\i_oifaysqnli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavpnifa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5124
- - C:\Temp\kidavpnifa.exe
    C:\Temp\kidavpnifa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavpnifa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2396
- - C:\Temp\i_kidavpnifa.exe
    C:\Temp\i_kidavpnifa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2324
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:200
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcaxspjhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4220
- - C:\Temp\fcaxspjhcz.exe
    C:\Temp\fcaxspjhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcaxspjhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1992
- - C:\Temp\i_fcaxspjhcz.exe
    C:\Temp\i_fcaxspjhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmkecwurm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\urmkecwurm.exe
    C:\Temp\urmkecwurm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmkecwurm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1864
- - C:\Temp\i_urmkecwurm.exe
    C:\Temp\i_urmkecwurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urojgecztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2280
- - C:\Temp\urojgecztr.exe
    C:\Temp\urojgecztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3336
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urojgecztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\i_urojgecztr.exe
    C:\Temp\i_urojgecztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqojgbztr.exe ups_run
  2⤵
  PID:824
- - C:\Temp\ywqojgbztr.exe
    C:\Temp\ywqojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqojgbztr.exe ups_ins
  2⤵
  PID:4512
- - C:\Temp\i_ywqojgbztr.exe
    C:\Temp\i_ywqojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  PID:5932
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  PID:5548
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbnlfdyvqo.exe ups_run
  2⤵
  PID:4148
- - C:\Temp\dbnlfdyvqo.exe
    C:\Temp\dbnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbnlfdyvqo.exe ups_ins
  2⤵
  PID:6000
- - C:\Temp\i_dbnlfdyvqo.exe
    C:\Temp\i_dbnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidavsnkig.exe ups_run
  2⤵
  PID:4328
- - C:\Temp\lidavsnkig.exe
    C:\Temp\lidavsnkig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3644
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidavsnkig.exe ups_ins
  2⤵
  PID:1892
- - C:\Temp\i_lidavsnkig.exe
    C:\Temp\i_lidavsnkig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davsnlfdxv.exe ups_run
  2⤵
  PID:1280
- - C:\Temp\davsnlfdxv.exe
    C:\Temp\davsnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davsnlfdxv.exe ups_ins
  2⤵
  PID:3108
- - C:\Temp\i_davsnlfdxv.exe
    C:\Temp\i_davsnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkhfzxsp.exe ups_run
  2⤵
  PID:4420
- - C:\Temp\usmkhfzxsp.exe
    C:\Temp\usmkhfzxsp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkhfzxsp.exe ups_ins
  2⤵
  PID:4360
- - C:\Temp\i_usmkhfzxsp.exe
    C:\Temp\i_usmkhfzxsp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxjhfzxrp.exe ups_run
  2⤵
  PID:4544
- - C:\Temp\czxjhfzxrp.exe
    C:\Temp\czxjhfzxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxjhfzxrp.exe ups_ins
  2⤵
  PID:2776
- - C:\Temp\i_czxjhfzxrp.exe
    C:\Temp\i_czxjhfzxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjecwupm.exe ups_run
  2⤵
  PID:4232
- - C:\Temp\urmjecwupm.exe
    C:\Temp\urmjecwupm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjecwupm.exe ups_ins
  2⤵
  PID:1096
- - C:\Temp\i_urmjecwupm.exe
    C:\Temp\i_urmjecwupm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tromjebzwr.exe ups_run
  2⤵
  PID:3268
- - C:\Temp\tromjebzwr.exe
    C:\Temp\tromjebzwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tromjebzwr.exe ups_ins
  2⤵
  PID:6120
- - C:\Temp\i_tromjebzwr.exe
    C:\Temp\i_tromjebzwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1532

C:\Temp\kecwuomhez.sys
C:\Temp\kecwuomhez.sys
1⤵
- Executes dropped EXE
PID:3820

C:\Temp\rpjgeywroj.sys
C:\Temp\rpjgeywroj.sys
1⤵
- Executes dropped EXE
PID:2044

C:\Temp\omgeywrojg.sys
C:\Temp\omgeywrojg.sys
1⤵
- Executes dropped EXE
PID:1504

C:\Temp\tjgbywqoig.sys
C:\Temp\tjgbywqoig.sys
1⤵
- Executes dropped EXE
PID:2344

C:\Temp\yvtnlfdyvt.sys
C:\Temp\yvtnlfdyvt.sys
1⤵
- Executes dropped EXE
PID:4712

C:\Temp\nifdaysqki.sys
C:\Temp\nifdaysqki.sys
1⤵
- Executes dropped EXE
PID:3060

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
- Executes dropped EXE
PID:3844

C:\Temp\spczxupmkh.sys
C:\Temp\spczxupmkh.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\hezxrpjhcz.sys
C:\Temp\hezxrpjhcz.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
- Executes dropped EXE
PID:5548

C:\Temp\ywtrljeywu.sys
C:\Temp\ywtrljeywu.sys
1⤵
PID:3520

C:\Temp\wrojytqolj.sys
C:\Temp\wrojytqolj.sys
1⤵
PID:1948

C:\Temp\bytqlidbvt.sys
C:\Temp\bytqlidbvt.sys
1⤵
PID:3152

C:\Temp\nigayvtnlf.sys
C:\Temp\nigayvtnlf.sys
1⤵
PID:4100

C:\Temp\faxvpnifay.sys
C:\Temp\faxvpnifay.sys
1⤵
PID:2060

C:\Temp\vsnkfcxvpn.sys
C:\Temp\vsnkfcxvpn.sys
1⤵
PID:6120

C:\Temp\czuspkhfcx.sys
C:\Temp\czuspkhfcx.sys
1⤵
PID:2848

C:\Temp\cwupmhezxr.sys
C:\Temp\cwupmhezxr.sys
1⤵
PID:2420

C:\Temp\romgebztro.sys
C:\Temp\romgebztro.sys
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dyvqoigays.exe

Path C:\Temp\dyvqoigays.exe
Size 230KB
SHA256 954ca1b5d0be84499b4c8390a43ea93fd695690a5e0c72d53458bed1c26c68dd
MD5 1688aa9c2ba66172dc00a1ff9b101959
SHA1 565356a04f7a877d48b19e0cca02e396c4934cfd
SHA512 23ddee567dda5df3dee5568620c64fbcc46b036b47827d0a145e35b4dfcf5c7f072c988cf35813989db428c0b7c90c8a0ea5ca60ecc61080faed8e35863f79c8
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dyvqoigays.exe

Path C:\Temp\i_dyvqoigays.exe
Size 230KB
SHA256 0ee1d7d5291462242b2fee509d0cc814ddc2d093c5159a345de184791189ac1c
MD5 8ab089b6f908151707d5ec0ba1e8c8d2
SHA1 093bad20f7c49db16d582c9d27d08f4fb8188c44
SHA512 7e5197cb1a69537376fee870d5c5b81421bdf959da1ae0f4eb111ff24f530586df4ecbc6d2ffdb8f5d9d16b68b9c5093864fbcf1dfeb17eecd97e21b5b0760ab
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywtqoig.exe

Path C:\Temp\i_mgeywtqoig.exe
Size 230KB
SHA256 6781a4a5a2517379390484c3ebd9241b2a4a2cf498eaca206570ec3a312dff7c
MD5 b206565d0df9bf2011801235a97d6d65
SHA1 5df71223f2f555ad89603a505e26a5d6d351eb92
SHA512 8e6af0112ef14262e771bd07e865b4d45add94d12dba076d1d50fd7adcf68f384b024356b8124ffbb2ff280a15bc5f65f83aae85b3915d46a7460863ccaffdff
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oifaysqnli.exe

Path C:\Temp\i_oifaysqnli.exe
Size 230KB
SHA256 79e4c7443f2e33b9692a180fc0cd47c38f0ff7934f26bbbfddb2bee013f7622c
MD5 645cd89a0edd2e893977beb1e2dce876
SHA1 a7f6c73cc2dad6abb3732b909cd54b24626a1a24
SHA512 39225750dc64c625a59900cedba3f9bc25f6a534f2278b0130b0c3dfd627c1f53fd8b57dead70b8e3607f0bbf645c12c2b3ae8c168b84f8ad186a43481ebe8d9
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rljeywrojh.exe

Path C:\Temp\i_rljeywrojh.exe
Size 230KB
SHA256 775160cd672a8a0ec13c99d4c10aeff18597201e96f160f01a040de33b86c193
MD5 9a4e21d8bfde37c0dec1b55a9cd8d489
SHA1 a3b84dd515d923ba0301c08bb79462c8b887fa2b
SHA512 72b827d8728634be4bb578b896a9458638ddcda83bfd18ef7fdeb4d4d1ce30a3b0f3e79adca557c5dedbbf6358779b8768875f899738fa9bac89e47f60bf9319
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T10E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trpjhbzxro.exe

Path C:\Temp\i_trpjhbzxro.exe
Size 230KB
SHA256 75a3a52e038c28ab87af08398d7b8ed03a9b234f49bb0aacbfb67375ab89dc71
MD5 0a82953cf75cba64f1c410912aaf2852
SHA1 88e5b993167e2f573d8e3ee84e7d55910a4da726
SHA512 e2060e243b3ed9446049da5db862587d26de76455b19ba23abf84d6a7ca2b0d21a648dbc9b8f8d45bbb48c84180db6c2177575be08ba031c52ca2c5a1cbf7ed7
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T12C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkcxumk.exe

Path C:\Temp\i_zurmkcxumk.exe
Size 230KB
SHA256 cf6a79678b8fcc87064950305523fb15ab75a256aaafb36922c16459e71bad3d
MD5 8b4619cb338d1a8101339f2f646f3352
SHA1 13c0662ae95afc9829d2664e1729a2003af020ca
SHA512 bbe66cb3b6c3a38e36e6cc98603a605186849533a045768b5688aada64a14684187f75362a219b5461a8e7720b77ebbb148008fae043d69c99658fbefbe07e35
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwuomhez.sys

Path C:\Temp\kecwuomhez.sys
Size 141KB
SHA256 68996ef7736ea5743e5c851d47639f09a940bdda639d275d1960e9383eb1264f
MD5 2429b8573f7d0588da545b05d17dcb28
SHA1 0c5eaa4b1319ab84ac1c92f4b2109d50493e9712
SHA512 92ac734ea366795a67dd001571d23a474e9c0c5602d26e96f463524122d450f121318e165a2a176f2ed022aa77c83b18015f2b4200d77c1b2463ae4196c4f783
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T1E8E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywtqoig.exe

Path C:\Temp\mgeywtqoig.exe
Size 230KB
SHA256 6b27f46558bac7923fea63c359b972f38340c902b120c13806bf4f88b643a419
MD5 004894d1a332a11ec0f961fc4dda4cdd
SHA1 0b38fbb54c149cd06f69f8cdf9dc8fc8bb9b14fe
SHA512 55a3829d07b3576b625bbe8751fdc354a703f7f6aa4c58c31ba455a9d721f2acf5f11aaec508f7870034af1b1108bbd08f13571bda385084cc6cd96c6efa824c
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T12A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdaysqki.sys

Path C:\Temp\nifdaysqki.sys
Size 141KB
SHA256 e653884385d2bdaf541edb0a70fa3f9469bccc73b024a742fc0b2232acd1d815
MD5 292795b397c19a1f8e258f0541d3a179
SHA1 d0f9a3b88d8c0e59f22bdbfdf4b5a88b438aeef3
SHA512 2f65c9ded8d4a787e3d10d0a366b1e7d5d3930c2bb16c8cda73a0081bcf537e60c50cfeb0162c616a0ab17c68fa361ab44d601b2cf7d9ca059ee57fbd06e4496
SSDEEP 3072:LsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:LsQmpcF8BzXfwV
TLSH
T10FE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oifaysqnli.exe

Path C:\Temp\oifaysqnli.exe
Size 230KB
SHA256 f4ac84de40a3c9ef37fac6006db6373f585be317ba6df2a513d3bed01baf0bf5
MD5 8fed131571530970e97b5f6f285d5b47
SHA1 2fca81877ae45fa0933d6cd71307d8c46f2dc124
SHA512 3ee1c60303f4f82f134f4460aaf5f436712eb0beca9db7e1141109e1e0fe71c260d8779bd75456893bd6aba9c3fd753a3c58787dd55fa064facee124ddbdf420
SSDEEP 3072:eJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:eghLQ0sQmpcF8BzXfwVfAI
TLSH
T140344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywrojg.sys

Path C:\Temp\omgeywrojg.sys
Size 141KB
SHA256 d9236af16816783ba65323b2d000db25d224a6c9aee01631c8b2ed1847cdb9b9
MD5 5f8262a805239e546a2b808186e26225
SHA1 102d5751d96ea532146f262674c20c04010fd110
SHA512 7c3d9029943b0928103665065acab6450b26aa423e1dc93a51890ea42f4772fc6d38be969bcf43ebe320323d25558a04023f6b7f0425775fc7fa04566cb71e90
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T1A1E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljeywrojh.exe

Path C:\Temp\rljeywrojh.exe
Size 230KB
SHA256 c5cc3257657546ba78cb882689d2018ec85a93a579962cca7c77fb6977c4d82a
MD5 a79f4eafad075c1c466d91395d382227
SHA1 6868c474aeecde7f9fe48b585fb6f58a3b486d05
SHA512 7e86535d4189d16caec93f4c5a9d96e19a264a54df3dd67cb559c4b0f3cf67287ff0047835f1a85e33960f42b817329cafe26ff7b062db0970bfed12c40ffc21
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T187344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjgeywroj.sys

Path C:\Temp\rpjgeywroj.sys
Size 141KB
SHA256 824dad2be6fe8d68301fadbf6d85648077dfe0896d4abfc46379f582c990f465
MD5 b5ddba8be497a21584b33ac384afed97
SHA1 7491000702233cdc1035970e7bcafa4eb7f87c7d
SHA512 3c48971a41263d82f8372b333ddc86e93b8d638a3ce4366a9a96ff2dfd0fbb7bea35fe2e2f80020567344283274863306bca6d48359b329ef49544e1f9b8b212
SSDEEP 3072:3sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:3sQmpcF8BzXfwV
TLSH
T1A2E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tjgbywqoig.sys

Path C:\Temp\tjgbywqoig.sys
Size 141KB
SHA256 09aad32a9a2a9af2e6025c7887efcbded03aac33a3c1390bd23e381fc1e01471
MD5 20d97a9568b852dab54bfc27da761f84
SHA1 927822298c5d003948570f6e3fda804418821b09
SHA512 4c9cf2fb647899edfb800a0f0836189d931a985e770e2d8852eb3b3c12254c0fb8ceaf762a4b5b940e5627eddfe7275092cfb6613d75fec1f99e7ea9004d04e3
SSDEEP 3072:AsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:AsQmpcF8BzXfwV
TLSH
T1D3E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhbzxro.exe

Path C:\Temp\trpjhbzxro.exe
Size 230KB
SHA256 3fdadf66ba9f0813dcb602bf34db35b31f5e12ab1a7fece03f8e95fc8c5ac866
MD5 7f874ae270df2ed9d31a0eb52d087621
SHA1 6336091e8cfc85f16379f2cc6f41654f6b8bdf79
SHA512 6b64981fdc8c1c44c695327f64dbe3122d2293acca7c70354a550ee6db85e0f51865432680db8a649dce28975d78ca6193652914b1187c74c6b01e665842c1ef
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T173344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnlfdyvt.sys

Path C:\Temp\yvtnlfdyvt.sys
Size 141KB
SHA256 fa800dafbe696045ab4abba1339ea42ec8bf709cc3b396231d5ac05e1a382286
MD5 00f39206cc57560fff56b2fb24e3863d
SHA1 5a291508d016451e9108bd86f5b6dec1e487917c
SHA512 a4ed83520f1589222601fea2e7d9f63f1bb334c164479982fdf206225161956edcd4efb75ce83108380f766ecc612adae31081446b06fea6221fd22ec371e133
SSDEEP 3072:wsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:wsQmpcF8BzXfwV
TLSH
T12FE38D12B2D19172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkcxumk.exe

Path C:\Temp\zurmkcxumk.exe
Size 230KB
SHA256 7fa1592d2175564a7e23077bbf512303ce37815fce23927ada923f83babd9399
MD5 83226622e80ba4815d01ce7a852754b0
SHA1 a1d06852c5da58ef478ff5574879f579911e9cb2
SHA512 379760102d040885da99d2dbbdae4a0dfdc4db5e1634e4bb99ed3b7db4ac59427f31b913b2e35fd72e0e7d4ebfba2366a8cfafe4f029743236f0982073380d5d
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T18D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 303422a9b0e25781769546c96738c9c951ddf97299922cdf07cdce90bee2f401
MD5 1695398756717e8f3a6296faddc56a2e
SHA1 b0b0455018c12e8b0a9b3c004ac5ecdabaaadcbc
SHA512 912270acc0faf7f30226ca2221f4db55413d94c8a76ecd81510e2d20243cc0c2dde937234ff766277a1160871ccaa258e026f530515a9f1878aa199c80344068
TLSH
T17F513005833A08DFE728947150E1549B37FAE4DD24EB2E1D0293AD7A6AC2F367DE8053
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595c5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595c5f.TMP
Size 3KB
SHA256 c03cae0d2ff64a61ce4284ea2bdb3651a894e90abf32f1a5680b19f0a4846d7a
MD5 bc5f56ba19de5ce01be60a14456b51b1
SHA1 1aff82296322d2a5fec10d55608dd98fa6632615
SHA512 72a2fdc99798079f54ced21687b28a7e5002bf3165bdb5138b8f75b00dbbac14f0ce3197d99dce7db69554d617fdc85c436a16098ae151160917650152a03e31
TLSH
T18A512F01833A08DFE728947150E1549B37FAE4DD24AB2E1D0693AD7A6AC2F367CE9013
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bcf76aca8c9e440dacc89d5962f43ec18f946e68797c3f06e74b55f83b573031
MD5 fa4ab5ea6ad95ec46c64ddebeeda37a6
SHA1 d9a18a53b3cde987d192762c8368e851bce1bbef
SHA512 8a7094bc0bd7b6e4247cf6b6a14c96b621d1b86dcd695825b64c28b6034c7fbd81fd960b57b1fd33263940b33146fac78220a1d4f46738948e11459bcb5b01b0
TLSH
T1C451AFF3C7E8866E890155F0AA187E1BCE1D0955432C3D5AC8E4EF1BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e3707dcb400f29c6c4b302971f171bd1fad955d6388149ec45d8624105338d15
MD5 8f1a843042b133dd76f2e1a4977d0924
SHA1 528310d302d84030117ebcb76fab826262026f3a
SHA512 8a61f159021734e62c2300b0e1945b4602aa16a1a33edf79734f215dbf4b542d1e48c257a01485e73b2087b4303a9992d205c54b454a5fd6a33705da32913ef2
SSDEEP 192:sxRrRhCu/fusEkZpWZtqCzoA8p9v/g6+WNCJW/YD976SQNGYhIgVOJ:sxRrSu/fusEkZpgtqPp/5V/DSQVE
TLSH
T14142C85A6928AD3B9CC7D219BA65BF53E7F95036A1901E58A7FC8A0C04EB6DD130340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bb9788459d6121ec06840d5679c5888ae747df7554e0db927af6eedb5c4d4ca6
MD5 fdcf3d68526c3baf3f60238e9d77a7db
SHA1 2abe60db27a8f95354f76fa4444e93dbe60df12e
SHA512 2a4b97674fe8e454711a3dc74141c485bab4f470253d4572d8e6e37c97737d1fc970eb3869f55dcab69a6722c801bf4086aeaec6ec962958219d6ac2b1fec661
SSDEEP 192:sxRoRhCu/fusxkZpWZtqCzoA8p9v/g6+WNCJW/YD976SQNGYhIgDdOJ:sxRoSu/fusxkZpgtqPp/5V/DSQVA
TLSH
T1E142B85A79289D3B8CC7D219BA65BF53E7F95036A1901E58A7FC9A0C04EB7DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff6bee92f5eabfdf74e78bce17362e04d14d31423fee25a2464c73ce71f0ff50
MD5 81bc4cd6507675e383e87dd37457d383
SHA1 bf9af22d0a2a7fbe85f19b9f84027f88423b3701
SHA512 a85ba9ad9467b44d82f0cccef47e24d68010a0992e63818117d884ed685828e3e59acd32c46492987af63f3e78665f4222d0d4e99fbd253b1861ff40b8158fde
SSDEEP 192:sxRoRhCu/fusxkZhWZtqCzoA8p9v/g6+WNCJW/YD9c6SQNGYhIgDHOJ:sxRoSu/fusxkZhgtqPp/5V/qSQVe
TLSH
T13B42B75A69289D3B9CC7D219BA65BF53E7F95036A1911E58A7FC8A0C00EB6DD230340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e05e048d263ded332e03a9a1f4e2a1a666b83b59ff3b77ec134142dd1b0c479a
MD5 c87e26d79b6d3076729830044e9ccc3d
SHA1 f63f78f7897a4d6871c62a048f7245b1b17d2e23
SHA512 7505b733f4edf3e5ea729a9031d961f8dd013bf3aa3568b96e33dd76beea246285f606f6c9057eed462f80db3f2925d8aaaa682d9ddac7067bd7cc31fb76ecf1
SSDEEP 768:azfWOL7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwrYc16Grop9gmk:azfWOdE7J0Wg/XfHfu1jaHrYy69p9a
TLSH
T1D7D2DA7B240CCE7F4F800A9DAD197EDB6DA802CB9698CD5047FA851C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5550d93-7fbc-4646-9cc7-2148fa01967d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b5550d93-7fbc-4646-9cc7-2148fa01967d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fbbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fbbb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 46b642b78648dfd6c6d0f8ef7dd50a6c6f6b01bca50a4f89bc7be65f3e4e2297
MD5 71abf3435aed36c37582ad18c90628c1
SHA1 5bddcc049d31ccc367657dc9730d5d93c1472fac
SHA512 714578e482649e65a752cf5e89bec39bebbfdec3aae9f18af0f4f879f40c688f5e253ceb6a64d139d77de697f0ec36bb21c66e975cecaf5941ad0f0b64231760
SSDEEP 768:bIF1j+9W3nwgl0sDM+rEnjN3Gac1FVMVcLCO7w/1D:R9W3BTQnjMaKHCt/R
TLSH
T14A1317F594D39A77D8AE9787A33E7E429ABCC163B4844994B7C46D0CCC862BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9b217dbb1bec889b5339418cedff96d47b3003d8a50cea9b7cbfe389281d4f97
MD5 f016c394c9e87a31bed2663b8d631eac
SHA1 5ab1e79996de0d3b39ef72c2439f901489f5a9a3
SHA512 013c041bb4bdaec4130b6506e3a8f38215d1a47c1654d9bf6fe50bdc8acb57a2b316118900a21811019f111d4fd6867643af12628a393a700f33ad8b2605b280
SSDEEP 768:rrv+4UNbdS30mi0DZrEnjN3Gac1ZFeVH1SCz:rbsbg3zlQnjMaGEH1V
TLSH
T14B03CF3669A89EB38CEBE38571437A037FB4125385940BE0CADD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e93a0348358a7b8a4928b62e5c65d8491c202f2d27000d514c03181623ffde98
MD5 8814bbd905225263ed9ab89c8da43d29
SHA1 aa961d8c00537e4ed56c969ad65928d882644801
SHA512 b131e1e01140863963398f34be0034ef10bc9d37ca00647a61989c798a08ee92534d4c5ab70f7a471ca9da266d6928aa50e664d942862da0cc223e0f0b68dfc0
SSDEEP 768:Xj+9J3ZXi0DMTrEnjN3Gac1FVMVcLCO7w/1D:a9J3baQnjMaKHCt/R
TLSH
T1D5F2AF7475669EB38CEAE385B2137B826FE1166384C50EA4DAD97F0D01C779C170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 03c8c218bed0d9721285ae43797bb55a90c2c9d44dbbe319d783134774086dad
MD5 022da8dec1358e87a588f5d0e907e7cd
SHA1 be1c4febf32154d0f4628e8c40f7d5496cb1f7c7
SHA512 54d9e3f0dde2feac41383f15399442cc95f7de2e33f1e75362b44ddf2859c5ed5fea1860390b95479241b9bd4bd78c08d559ee27a96e0166380d009d22a76192
SSDEEP 768:7rv+4UNbdD3bXi0DMRrEnjN3Gac1FVMVcLCO7w/r:7bsb93J0QnjMaKHCt/r
TLSH
T12113B034B4799EB38CFAE285B14376837FB4156345C50FA4DAC97B0D118B6E9270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dcd983e668a97975ed23ff34d5826b901ff035308fe8b4cebe8a386b357b46e4
MD5 841f1155b3a2655554e5f1ef33ff6ace
SHA1 3b5fcc2905c50feb0efb7c7051e2b7074310eaf7
SHA512 81c9f6f694f46ddbba78d236007e98207e7ee450781923e721b950681ad8378c84866dedd7f5325bcbdad7ccef4620440094ad7c821d09fc64aa385e9e28048b
SSDEEP 768:Qj+9J30Xi0DMTrEnjN3Gac1FVMVcLCO7w/1D:v9J3+aQnjMaKHCt/R
TLSH
T1B8F2AF7475669EB38CEAD385B2137B836FE1166384C50EA4DAD97F0D01C779C170782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5228_506658460\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-480-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1504-254-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1948-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2044-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2060-433-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2344-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2420-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2848-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3060-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3152-402-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3520-398-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3820-179-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3844-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4100-422-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4712-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5092-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5348-314-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5548-378-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6120-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download