systex | b0c387f6479901103770889aa72dfcaabc74b825e1962c3841646c99744a0216

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260723-ncppmscc66
SHA256 b0c387f6479901103770889aa72dfcaabc74b825e1962c3841646c99744a0216
MD5 0d45d9fd847132aa89a5d025550d605d
SHA1 7d02e6762919103a647ba41307e47c14f483e156
SHA512 45af3c23b0ede577c3d3014bf122ddb82149d8e85d82907cfe62bb27d003ce08d555f7ea853b393e68ba43cb854de31350c36a168f5f25da92ead83b6ded087f
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:KghLQ0sQmpcF8BzXfwVfQI
TLSH
T179344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2360	CP.exe
4836	mkecxrmkcz.exe
2016	CP.exe
2352	CP.exe
2532	i_mkecxrmkcz.exe
1480	xrpjhezxrp.sys
5876	CP.exe
5980	ecwuomjecw.exe
5220	CP.exe
4768	CP.exe
4440	i_ecwuomjecw.exe
3480	trljebzwuo.sys
5276	CP.exe
2984	trmjetolge.exe
4908	CP.exe
4548	CP.exe
3128	i_trmjetolge.exe
1680	trljdbvtol.sys
1012	CP.exe
4340	tomgeywqoj.exe
5564	CP.exe
1152	CP.exe
2532	i_tomgeywqoj.exe
5724	ljdbvtnljg.sys
4844	CP.exe
1332	jdbvtolgdy.exe
3592	CP.exe
1420	CP.exe
2564	i_jdbvtolgdy.exe
2876	ligaysqlav.sys
4800	CP.exe
1368	avtnlfdyvq.exe
3040	CP.exe
2840	CP.exe
1852	i_avtnlfdyvq.exe
3384	vqnlfdxvsq.sys
4712	CP.exe
5696	vpnlfdxnif.exe
256	CP.exe
4104	CP.exe
5904	i_vpnlfdxnif.exe
4352	smkifdxvpn.sys
4076	CP.exe
3404	uspnhfaxsp.exe
4852	CP.exe
1588	CP.exe
5380	i_uspnhfaxsp.exe
1672	fzxrpkhczu.sys
4932	CP.exe
4176	czusmkecwu.exe
1700	CP.exe
6084	CP.exe
4532	i_czusmkecwu.exe
3128	zxusmkecwu.sys
576	CP.exe
3720	omkecwupmh.exe
1216	CP.exe
5820	CP.exe
3284	i_omkecwupmh.exe
5252	zwrpjhbztr.sys
5032	CP.exe
2448	urmjecwuom.exe
4976	CP.exe
4732	CP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1917555444\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxrmkcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmjecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjetolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omkecwupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snhfdxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxrpmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snhfdxvsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxrpmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxrmkcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjetolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmkecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnlidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezurmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezurmkecw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3176	ipconfig.exe
3100	ipconfig.exe
5904	ipconfig.exe
3128	ipconfig.exe
2716	ipconfig.exe
2708	ipconfig.exe
3440	ipconfig.exe
5324	ipconfig.exe
1020	ipconfig.exe
2636	ipconfig.exe
2708	ipconfig.exe
4232	ipconfig.exe
2532	ipconfig.exe
1480	ipconfig.exe
3436	ipconfig.exe
2216	ipconfig.exe
1588	ipconfig.exe
556	ipconfig.exe
4472	ipconfig.exe
2716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292789279087310"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{22ADB17C-B8BD-4D48-8697-B982853AAD42}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe
4836	mkecxrmkcz.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2532	i_mkecxrmkcz.exe
Token: SeDebugPrivilege	4440	i_ecwuomjecw.exe
Token: SeDebugPrivilege	3128	i_trmjetolge.exe
Token: SeDebugPrivilege	2532	i_tomgeywqoj.exe
Token: SeDebugPrivilege	2564	i_jdbvtolgdy.exe
Token: SeDebugPrivilege	1852	i_avtnlfdyvq.exe
Token: SeDebugPrivilege	5904	i_vpnlfdxnif.exe
Token: SeDebugPrivilege	5380	i_uspnhfaxsp.exe
Token: SeDebugPrivilege	4532	i_czusmkecwu.exe
Token: SeDebugPrivilege	3284	i_omkecwupmh.exe
Token: SeDebugPrivilege	2940	i_urmjecwuom.exe
Token: SeDebugPrivilege	5292	i_trljdbwtrl.exe
Token: SeDebugPrivilege	6072	i_yvtrljdbvt.exe
Token: SeDebugPrivilege	4192	i_aysqkidayv.exe
Token: SeDebugPrivilege	1568	i_ysqnlidavs.exe
Token: SeDebugPrivilege	2972	i_snhfdxvsnk.exe
Token: SeDebugPrivilege	4616	i_kicaxrpmkf.exe
Token: SeDebugPrivilege	4388	i_hezurmkecw.exe
Token: SeDebugPrivilege	3732	i_jhezwurmjh.exe
Token: SeDebugPrivilege	5060	i_jgeywrojhb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 1800	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 1112 wrote to memory of 936	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 936 wrote to memory of 4992	936	iexplore.exe	91
PID 1800 wrote to memory of 5440	1800	iexplore.exe	92
PID 5440 wrote to memory of 752	5440	msedge.exe	93
PID 5440 wrote to memory of 4300	5440	msedge.exe	94
PID 5440 wrote to memory of 5536	5440	msedge.exe	95
PID 5440 wrote to memory of 5536	5440	msedge.exe	95
PID 5440 wrote to memory of 5536	5440	msedge.exe	95
PID 5440 wrote to memory of 4784	5440	msedge.exe	96
PID 5440 wrote to memory of 4784	5440	msedge.exe	96
PID 5440 wrote to memory of 3824	5440	msedge.exe	98
PID 5440 wrote to memory of 3824	5440	msedge.exe	98
PID 5440 wrote to memory of 3824	5440	msedge.exe	98
PID 5440 wrote to memory of 5764	5440	msedge.exe	99
PID 5440 wrote to memory of 5764	5440	msedge.exe	99
PID 5440 wrote to memory of 5764	5440	msedge.exe	99
PID 5440 wrote to memory of 5592	5440	msedge.exe	100
PID 5440 wrote to memory of 3752	5440	msedge.exe	101
PID 5440 wrote to memory of 5592	5440	msedge.exe	100
PID 5440 wrote to memory of 5592	5440	msedge.exe	100
PID 5440 wrote to memory of 3752	5440	msedge.exe	101
PID 5440 wrote to memory of 3752	5440	msedge.exe	101
PID 5440 wrote to memory of 1688	5440	msedge.exe	102
PID 5440 wrote to memory of 1688	5440	msedge.exe	102
PID 5440 wrote to memory of 1688	5440	msedge.exe	102
PID 5440 wrote to memory of 5656	5440	msedge.exe	103
PID 5440 wrote to memory of 5656	5440	msedge.exe	103
PID 1112 wrote to memory of 2360	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 4836 wrote to memory of 2016	4836	mkecxrmkcz.exe	108
PID 5440 wrote to memory of 3492	5440	msedge.exe	111
PID 5440 wrote to memory of 1700	5440	msedge.exe	112
PID 5440 wrote to memory of 3492	5440	msedge.exe	111
PID 5440 wrote to memory of 1700	5440	msedge.exe	112
PID 5440 wrote to memory of 3224	5440	msedge.exe	114
PID 5440 wrote to memory of 4232	5440	msedge.exe	115
PID 5440 wrote to memory of 4232	5440	msedge.exe	115
PID 5440 wrote to memory of 5144	5440	msedge.exe	116
PID 5440 wrote to memory of 5144	5440	msedge.exe	116
PID 1112 wrote to memory of 2352	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 1112 wrote to memory of 5876	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 5980 wrote to memory of 5220	5980	ecwuomjecw.exe	125
PID 1112 wrote to memory of 4768	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1112 wrote to memory of 5276	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2984 wrote to memory of 4908	2984	trmjetolge.exe	134
PID 1112 wrote to memory of 4548	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 1112 wrote to memory of 1012	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4340 wrote to memory of 5564	4340	tomgeywqoj.exe	143
PID 1112 wrote to memory of 1152	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5440 wrote to memory of 2364	5440	msedge.exe	149
PID 5440 wrote to memory of 2548	5440	msedge.exe	150
PID 5440 wrote to memory of 2972	5440	msedge.exe	151
PID 1112 wrote to memory of 4844	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 1332 wrote to memory of 3592	1332	jdbvtolgdy.exe	156
PID 1112 wrote to memory of 1420	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 1112 wrote to memory of 4800	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1368 wrote to memory of 3040	1368	avtnlfdyvq.exe	165
PID 1112 wrote to memory of 2840	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 1112 wrote to memory of 4712	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 5696 wrote to memory of 256	5696	vpnlfdxnif.exe	174
PID 1112 wrote to memory of 4104	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 1112 wrote to memory of 4076	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 3404 wrote to memory of 4852	3404	uspnhfaxsp.exe	183
PID 1112 wrote to memory of 1588	1112	2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_0d45d9fd847132aa89a5d025550d605d_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x370,0x7ff99d8ac188,0x7ff99d8ac194,0x7ff99d8ac1a0
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2084,i,5326817160219349667,10942811029772038499,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
      4⤵
      System Time Discovery
      PID:4300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1884,i,1773827017379687470,2006658687572496528,262144 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:2
      4⤵
      PID:5536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,16422474946155745278,14399412167144805098,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,12710610419608524790,10823993869184751601,2097152 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,12719037274361747850,14150806093829319054,2097152 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4348,i,4002930682838130111,17844094602456891056,2097152 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,2742402977118082821,10524941008991560817,2097152 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:3752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,11764969783793251440,8079614864968133792,2097152 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,3294426039042862278,10054265895186443084,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:5656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,9912947189311837327,13681289193105547385,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:3492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,13910735641061336200,3271981121986501902,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:1700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14875881221361537249,10542140407853374779,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14875881221361537249,10542140407853374779,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14521157992945041102,5479598748086796482,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,8287958728507560738,9366069411104652556,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,1885085528862795541,10045159218103026816,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:2364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,10998064347812054085,17298721927132276226,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,16309743213365937539,9867954375650332778,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,7215934904647288486,4517339304467935548,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,16295420767627550764,16731976448863846135,524288 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5876,i,258023061321859813,1221969638661515966,262144 --field-trial-handle=2480,i,14077389665604042996,13202751674726311038,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:10
      4⤵
      PID:4672
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxrmkcz.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2360
- - C:\Temp\mkecxrmkcz.exe
    C:\Temp\mkecxrmkcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxrmkcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\i_mkecxrmkcz.exe
    C:\Temp\i_mkecxrmkcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5876
- - C:\Temp\ecwuomjecw.exe
    C:\Temp\ecwuomjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5980
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_ecwuomjecw.exe
    C:\Temp\i_ecwuomjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trmjetolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\trmjetolge.exe
    C:\Temp\trmjetolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trmjetolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4548
- - C:\Temp\i_trmjetolge.exe
    C:\Temp\i_trmjetolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1012
- - C:\Temp\tomgeywqoj.exe
    C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Temp\i_tomgeywqoj.exe
    C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgdy.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4844
- - C:\Temp\jdbvtolgdy.exe
    C:\Temp\jdbvtolgdy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgdy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1420
- - C:\Temp\i_jdbvtolgdy.exe
    C:\Temp\i_jdbvtolgdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\avtnlfdyvq.exe
    C:\Temp\avtnlfdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\i_avtnlfdyvq.exe
    C:\Temp\i_avtnlfdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfdxnif.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\vpnlfdxnif.exe
    C:\Temp\vpnlfdxnif.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfdxnif.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4104
- - C:\Temp\i_vpnlfdxnif.exe
    C:\Temp\i_vpnlfdxnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspnhfaxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4076
- - C:\Temp\uspnhfaxsp.exe
    C:\Temp\uspnhfaxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspnhfaxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1588
- - C:\Temp\i_uspnhfaxsp.exe
    C:\Temp\i_uspnhfaxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmkecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4932
- - C:\Temp\czusmkecwu.exe
    C:\Temp\czusmkecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmkecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6084
- - C:\Temp\i_czusmkecwu.exe
    C:\Temp\i_czusmkecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omkecwupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:576
- - C:\Temp\omkecwupmh.exe
    C:\Temp\omkecwupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omkecwupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5820
- - C:\Temp\i_omkecwupmh.exe
    C:\Temp\i_omkecwupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmjecwuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5032
- - C:\Temp\urmjecwuom.exe
    C:\Temp\urmjecwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmjecwuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\i_urmjecwuom.exe
    C:\Temp\i_urmjecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtrl.exe ups_run
  2⤵
  PID:3388
- - C:\Temp\trljdbwtrl.exe
    C:\Temp\trljdbwtrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:596
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtrl.exe ups_ins
  2⤵
  PID:4208
- - C:\Temp\i_trljdbwtrl.exe
    C:\Temp\i_trljdbwtrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvtrljdbvt.exe ups_run
  2⤵
  PID:5972
- - C:\Temp\yvtrljdbvt.exe
    C:\Temp\yvtrljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvtrljdbvt.exe ups_ins
  2⤵
  PID:3452
- - C:\Temp\i_yvtrljdbvt.exe
    C:\Temp\i_yvtrljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkidayv.exe ups_run
  2⤵
  PID:4328
- - C:\Temp\aysqkidayv.exe
    C:\Temp\aysqkidayv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2696
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkidayv.exe ups_ins
  2⤵
  PID:5188
- - C:\Temp\i_aysqkidayv.exe
    C:\Temp\i_aysqkidayv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqnlidavs.exe ups_run
  2⤵
  PID:5272
- - C:\Temp\ysqnlidavs.exe
    C:\Temp\ysqnlidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqnlidavs.exe ups_ins
  2⤵
  PID:5572
- - C:\Temp\i_ysqnlidavs.exe
    C:\Temp\i_ysqnlidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snhfdxvsnk.exe ups_run
  2⤵
  PID:2372
- - C:\Temp\snhfdxvsnk.exe
    C:\Temp\snhfdxvsnk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snhfdxvsnk.exe ups_ins
  2⤵
  PID:2988
- - C:\Temp\i_snhfdxvsnk.exe
    C:\Temp\i_snhfdxvsnk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxrpmkf.exe ups_run
  2⤵
  PID:2132
- - C:\Temp\kicaxrpmkf.exe
    C:\Temp\kicaxrpmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxrpmkf.exe ups_ins
  2⤵
  PID:3152
- - C:\Temp\i_kicaxrpmkf.exe
    C:\Temp\i_kicaxrpmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezurmkecw.exe ups_run
  2⤵
  PID:2812
- - C:\Temp\hezurmkecw.exe
    C:\Temp\hezurmkecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezurmkecw.exe ups_ins
  2⤵
  PID:5316
- - C:\Temp\i_hezurmkecw.exe
    C:\Temp\i_hezurmkecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4388
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhezwurmjh.exe ups_run
  2⤵
  PID:8
- - C:\Temp\jhezwurmjh.exe
    C:\Temp\jhezwurmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhezwurmjh.exe ups_ins
  2⤵
  PID:4996
- - C:\Temp\i_jhezwurmjh.exe
    C:\Temp\i_jhezwurmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywrojhb.exe ups_run
  2⤵
  PID:3240
- - C:\Temp\jgeywrojhb.exe
    C:\Temp\jgeywrojhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywrojhb.exe ups_ins
  2⤵
  PID:2388
- - C:\Temp\i_jgeywrojhb.exe
    C:\Temp\i_jgeywrojhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5504

C:\Temp\xrpjhezxrp.sys
C:\Temp\xrpjhezxrp.sys
1⤵
- Executes dropped EXE
PID:1480

C:\Temp\trljebzwuo.sys
C:\Temp\trljebzwuo.sys
1⤵
- Executes dropped EXE
PID:3480

C:\Temp\trljdbvtol.sys
C:\Temp\trljdbvtol.sys
1⤵
- Executes dropped EXE
PID:1680

C:\Temp\ljdbvtnljg.sys
C:\Temp\ljdbvtnljg.sys
1⤵
- Executes dropped EXE
PID:5724

C:\Temp\ligaysqlav.sys
C:\Temp\ligaysqlav.sys
1⤵
- Executes dropped EXE
PID:2876

C:\Temp\vqnlfdxvsq.sys
C:\Temp\vqnlfdxvsq.sys
1⤵
- Executes dropped EXE
PID:3384

C:\Temp\smkifdxvpn.sys
C:\Temp\smkifdxvpn.sys
1⤵
- Executes dropped EXE
PID:4352

C:\Temp\fzxrpkhczu.sys
C:\Temp\fzxrpkhczu.sys
1⤵
- Executes dropped EXE
PID:1672

C:\Temp\zxusmkecwu.sys
C:\Temp\zxusmkecwu.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\zwrpjhbztr.sys
C:\Temp\zwrpjhbztr.sys
1⤵
- Executes dropped EXE
PID:5252

C:\Temp\wtrljebwuo.sys
C:\Temp\wtrljebwuo.sys
1⤵
PID:676

C:\Temp\dbvtqoidbv.sys
C:\Temp\dbvtqoidbv.sys
1⤵
PID:2800

C:\Temp\oigaytqlid.sys
C:\Temp\oigaytqlid.sys
1⤵
PID:2704

C:\Temp\xvtnlidavs.sys
C:\Temp\xvtnlidavs.sys
1⤵
PID:3752

C:\Temp\vsnkicavsn.sys
C:\Temp\vsnkicavsn.sys
1⤵
PID:4312

C:\Temp\pnhfcausmk.sys
C:\Temp\pnhfcausmk.sys
1⤵
PID:676

C:\Temp\smkecxupnh.sys
C:\Temp\smkecxupnh.sys
1⤵
PID:4456

C:\Temp\jhecwuomhe.sys
C:\Temp\jhecwuomhe.sys
1⤵
PID:4748

C:\Temp\hebwtrljhe.sys
C:\Temp\hebwtrljhe.sys
1⤵
PID:1308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

avtnlfdyvq.exe

Path C:\Temp\avtnlfdyvq.exe
Size 230KB
SHA256 dd5a5e247669e8223bc12be35ff4af1097dde0e13ff03c90bd2d89efb236404b
MD5 aa1cc6c867b9964e7d6e2101584b04d9
SHA1 0a94fa87fed603295237de0f56a2d492c6da6efe
SHA512 197da36c8d0e36cb21e98c84dda80d3d769f5ce04f2c0ddfe7431ee37b3ddf0d25386fc1bf42a682145a0e7b1b370df31efadee2dc75a0ffb40579d3c0ee11ad
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:fghLQ0sQmpcF8BzXfwVfQI
TLSH
T1B4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomjecw.exe

Path C:\Temp\ecwuomjecw.exe
Size 230KB
SHA256 18db3f9b4b72a7e6c9e9376aa2aab2242091dfe76c784d1177cc8c70a0014f5f
MD5 de5f800a2692bb440091804690660cc3
SHA1 274e8891f0066c8f6597d63125ae85f7fb61dde9
SHA512 4d211eed09782327984d387cba384303e17d40eb6df42d0bbd1dc3e08479a43d2ebee139b48746f9bb619e399dde2fc042f9c00ff92826d2e7b9ccb9cf63980f
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:XghLQ0sQmpcF8BzXfwVfQI
TLSH
T12B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_avtnlfdyvq.exe

Path C:\Temp\i_avtnlfdyvq.exe
Size 230KB
SHA256 84bfc371c07f84b17575e9915d5338c928df613f8b8869010e68ff61b465593a
MD5 d0916d1d26fe3579d2a15038d2006a3c
SHA1 2831f37b3474f308b5ab1212080c9eb3f443bd76
SHA512 d9107bf8e9a8985bf00d3f204654e866733cea03d360f98eaa5a8ea9494330bb87100f2c0e02cbffcb5e37f157319120ca862589620e835ed32e76776216125d
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:bghLQ0sQmpcF8BzXfwVfQI
TLSH
T1DA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomjecw.exe

Path C:\Temp\i_ecwuomjecw.exe
Size 230KB
SHA256 aad30126d9d96dca92d2bcd432958ffb17b821cdf308efcfdbf5d13ee5c40723
MD5 f4317ee77c6cc3cd8761e8de65d631dc
SHA1 434232a4bfe4bf43a6f1c86e4b83a5c720cd38db
SHA512 4ee67fbd4e67b9ccbd0493562475d9d41f74af4a6d4025fd16eb70f5100a0817310e9431093d17b9d51a0dbf1394e65f06739c8c8a77cfaba86c4d599c8a092b
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:zghLQ0sQmpcF8BzXfwVfQI
TLSH
T112344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jdbvtolgdy.exe

Path C:\Temp\i_jdbvtolgdy.exe
Size 230KB
SHA256 5b59f9412a75c90aca75a5525eab37d8291c0465362f7512ef0f0dee34e8d672
MD5 6ee5cb72f1cdef8cf3e225f279765beb
SHA1 fb4c77e596cb1be195f47fa7211a4e5e0decadf1
SHA512 071848518b3de2ee0462a36e1d3d2116d1c311d4e6463285f904fd112f12e7c7ee10b0dd9fee23c7ea972323b233e149f104ab37dca7b77e7492a0ac0c9c6772
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:9ghLQ0sQmpcF8BzXfwVfQI
TLSH
T15A344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkecxrmkcz.exe

Path C:\Temp\i_mkecxrmkcz.exe
Size 230KB
SHA256 eba87974f88c5c749ec333373c54e065d2fccf5dea49274c5a17dedbd9be2568
MD5 a5b9e80ee05ab4e0b07d9f12bbf0c6f1
SHA1 ecd12f5d76cff51864d704a6bbf076ab4c9cb168
SHA512 417342d1448b9653b5b0a02dadc7a9421b49b901446e5b9280379d7750508ca8a2446cb9051653d200c9156d30201d85cf9dd614abb0d6fddecfce61f80f31f4
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:5ghLQ0sQmpcF8BzXfwVfQI
TLSH
T17A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomgeywqoj.exe

Path C:\Temp\i_tomgeywqoj.exe
Size 230KB
SHA256 53d0e2ddbc425656b7654ae2a6fbf2b93e5ba15236b4b5bdb6f9300f28b44a7b
MD5 4ce99664148509601085e381a67b1813
SHA1 4e5db0aef1cfe84fcfce170358a46cc1f0a79d1e
SHA512 6b55de966c67d95d7d045e0a749b551ea0f9690dece0b528ba4d64775f0408a13a7332d117de37539527d2edba91898ec4e25ff0a26042738255dcd442536676
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:LghLQ0sQmpcF8BzXfwVfQI
TLSH
T15A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trmjetolge.exe

Path C:\Temp\i_trmjetolge.exe
Size 230KB
SHA256 103b3969f13433d4042afa2b100ec4ffaf1c6c9ee7834fe485e58c6d60a0eb2f
MD5 4e936a6500138232670e592d8edae766
SHA1 b24166b4a3520b28ca211631a02fea645358fc9e
SHA512 0e7ef6175267a46effbcfb5ff8da05a88570065f357aea01bd3e53cb51cf889b5e332051b7c8968434e7dcfe81582ebfffded1de99c3a9d337a6d35a65991788
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:yghLQ0sQmpcF8BzXfwVfQI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtolgdy.exe

Path C:\Temp\jdbvtolgdy.exe
Size 230KB
SHA256 cd2494e87fd498155dff32a99a263a8f67461ebf24771a612b3bdcbad41b9bd3
MD5 e645a85889c2a4dc6a56803cc2d1ef80
SHA1 f8cb2576f5e5436f937ef3f9b35a40e6df61e6f0
SHA512 c9bb30acb613021bb46ce38db645b4271363b6ce43aa6274f6dd068344a7bed397eb7f150f2bf506435182945ffaf31566e44e30ab0bfdba54cd50c5200a6d37
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:JghLQ0sQmpcF8BzXfwVfQI
TLSH
T109344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ligaysqlav.sys

Path C:\Temp\ligaysqlav.sys
Size 141KB
SHA256 6e1b4a1e59c4a1ec2c79e02d55c2b76b8844fccca698ee3120d882ee39edafdf
MD5 5b5479f43f841611aae91584df0ce917
SHA1 3e2fdd8daf0a28d59ddafe8e5260350606508e79
SHA512 37164258c3b00d45950377e5a04bb61671cd52dd781eb7d2a1204fe8508bc7251872a8b87686da62dc8052cfd23fa5da62ff2edce74026c754da9c8a9cf978cf
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T1ADE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnljg.sys

Path C:\Temp\ljdbvtnljg.sys
Size 141KB
SHA256 16958b8e5dc9276b85f5830bd6fe496af0facd50d60d533ca0f8e2a7e33af30a
MD5 a5ee9a01c604876293f71dcf6395b57f
SHA1 78c40fa5e2ca4cc17cc7ba26e789ad65a8d6cf6c
SHA512 bdb9c4538e5d15c6b6dbaa3182b7b718801e76a018f3eaa7bf765870150255ed68665639dc7fb99846566daa9ae740438b5edd110f0431ec08d65224604de31c
SSDEEP 3072:psQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:psQmpcF8BzXfwV
TLSH
T1D9E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxrmkcz.exe

Path C:\Temp\mkecxrmkcz.exe
Size 230KB
SHA256 f043b00319da56dd3e52baedae21346764e9e05b2bf344c84ec7585b42721c96
MD5 9d60611b2aafe31aad4d405314a85db4
SHA1 a6c40990d25bc7cf97c317d897483b330ddf9411
SHA512 556b71da0d68200212027a6e0f9576edf6c3056eb61e7c97d529acffb44b3d74c59a1b9e501892ee4c9a3fd0b49509e83de22f0e1c475c33d09a0f4675b851ce
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:rghLQ0sQmpcF8BzXfwVfQI
TLSH
T19A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomgeywqoj.exe

Path C:\Temp\tomgeywqoj.exe
Size 230KB
SHA256 c6cdc147a890884921091eacbe0ba0885fef157fba3b6dcdc555d1744044cb67
MD5 b90c64d0a07d9233dd707b21d08a7b06
SHA1 34a3bd1289b497043ccedda289c241143bb2044e
SHA512 0630cbf61607b676c1cd2c7b368f1b2d82d7cfae9aaeda0f3a99f96acec59e2e153bca896aef8f764a5dd4592a2a0a90e9ccb619f31be8de6f48bd44d27d791c
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:ighLQ0sQmpcF8BzXfwVfQI
TLSH
T161344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.sys

Path C:\Temp\trljdbvtol.sys
Size 141KB
SHA256 05853cd040ee4173c5c41a3d72982c3b8b1995e698df1eed055b6cf19e7769f8
MD5 4a23e79a05f5249d9de41aba709d0768
SHA1 f0700c498f82bb2632f3ae34e8bac74b5486e031
SHA512 0187d547ab6c1123a33287ea9cd4050b2de2df1ef8badf804720cf57deb1124dfe317c0e3113aa0fcf5796bfc3a4c2c5e559e9b4dd582732bd55eb86009f0005
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T10CE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljebzwuo.sys

Path C:\Temp\trljebzwuo.sys
Size 141KB
SHA256 4e0252f64e18617323233d02a766ec39c6321effd21ba84c7dc3bed2847b751c
MD5 c4a3ccb183951e523e1942f22217c0bc
SHA1 f2c3f6adfdc34933d61f0d5f5c3aea4c0f77c6b6
SHA512 222b7c5bb2a62e8da375269d9f1ee3d0a2153991e099aa765bfad1d601306d752664dc2e275246ad3ecd94aa0cf22e8890dfc4c9c785289aa80437e4612f514c
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T1F1E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjetolge.exe

Path C:\Temp\trmjetolge.exe
Size 230KB
SHA256 884e09555193978529594552d685cc45f0674043dca23d59558870ee23f7e9b1
MD5 9d3b345b6440937b564fd9005bea0b3a
SHA1 2c2fcb577c1dd0a7e5ea8c19cc52336e592d1637
SHA512 1195209c8d1ab562a219085679a8a6efdb3bb29a4dde5b07044d72066d1ad0ff1ee2e30655061f252cd88f894c271fb94e4c2417e3b50c2ca82d9cdcd001633c
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkQI9:xghLQ0sQmpcF8BzXfwVfQI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlfdxvsq.sys

Path C:\Temp\vqnlfdxvsq.sys
Size 141KB
SHA256 7cde01751777fa9f2e12a387bffcb3a17dc27eb09f116b0db593eca53a7cba69
MD5 3d36a02012c51d2ce22685e258579b44
SHA1 9e285222572e32b7045c062eab4d4494077de68b
SHA512 5ba9d24d0db8077b9fa9bed0762d3563b8a4f6740003b6c6914406cff25f3486f70c7d549ce659997b9fcdd3f0d3f1ea3dc9b06d4ae0257d2a974eb57ff6a4cd
SSDEEP 3072:QsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:QsQmpcF8BzXfwV
TLSH
T134E38D12B2D19172E8A618BC106AC72196BE79304F76D9C3FBD40BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhezxrp.sys

Path C:\Temp\xrpjhezxrp.sys
Size 141KB
SHA256 ef9ea9569b293962089241170fd5a17935616c2158fa9ae1ba4cc40bc023a68d
MD5 00862f7c6ba759f95328ec552354121b
SHA1 b480ae0d879f21072f29f4dbb89b9d67b01f1530
SHA512 92dce47378efaa6193498388eff4dad1d732bf6cd44eb5e4f684cc370568abfc913db0b4d4c890457be81174b0af580b18234eb5d274463a131e8f6308261879
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T1CDE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 82e3e7f69ad3b847e7ab26b622edb3fdcbcacc423bc66ecb1a05805fe71b6128
MD5 1e9e436af816a0ec7944d1054a22f519
SHA1 03065a972214aafe2ec1333222dd1d12bb8eebe6
SHA512 9dea56cd31c19b91e4258a74358dc4ffbcb9bb59e14a06266f35213630af31d973506e97ef7c5495d7e6385e39c1d397812754fb979e260e5e6e58d212a1e2fa
TLSH
T11251731F676D99D2D71874B140DB27943AF6B225EBC7AE10D0505EB88882F74D0C3C63
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596690.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596690.TMP
Size 2KB
SHA256 01a2f5ae4da808fb471be023c85ec4850bd7730fe1d598d94233874f26be38c9
MD5 50679e8d260fa70ebefa5e75e1b79edb
SHA1 5d4438a92797069ace6b546a7c08afac14baf59b
SHA512 c7a15dd9da7f85ca71a22104f5a5295e01b3908e4febc6298f258663f311b502b1fd2cf51ee04a78c8cdd6c735e4e08504826f2fba8be08a3e068a351daae686
TLSH
T10151741F676D99D2D718747150DB27943AF6B229EBC7AE10D0505EB88882F74D0D3C63
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 83583afa0fbb32799191f089b4fe22834d885779ab3da351eaca8e26976a4183
MD5 24c54a636f01afa638b1e1e3c7e5f66d
SHA1 92802888a139424296e7b33f2e621dc3c8ad2aa5
SHA512 e6e3dfb897791a494bf36219e0d516dcf1de65782db88cfbdd6d6b36501f6d2db6243b12850e010246b17404a3f14fd0b4fdeecd662be31391b92ad3483e326f
TLSH
T1A051BEF3C3E8852D890196F0AA18BE2BDE1D0914832C3D5AC8E4AF1BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3c0d87db5023850b3c0c6cafc723aae540cc87bac11b452ef2772e91d109ac09
MD5 3512549402852a3b687c57987698b96c
SHA1 ab48cd6286d9ca64e02156544abcf0d36dc1146a
SHA512 194ade2ff8e149043d39f917c6bfe4634be42509d91687b4804a7e3c25d9659d29a1c1acdd26bfc5bb45b62a33ff3913d2a64263bb7800288c6f0455648950fa
SSDEEP 192:sxRaRQCy/fUsRUJfZkxzoA8p9H/g6+WNCgHfYD9Q6Sv+GfxIgDpOJ:sxRapy/fUsRUJBXh/5NfuSvbQ
TLSH
T11642B61AAA28597B9CCBD21DBB55BF53E6F95032A1911F48E6FC8B0C00E66DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e87f739259855b29e278818b5545392bab6f89a597e23061372b45c8baa5a305
MD5 b6ceb15bc2ff98a9b80b422aab218228
SHA1 ca5c5fc6b98495c84e34c8c23a7f6be1554f4763
SHA512 af69e71021a9f6cc798cf71b8542c2c0b65ced409d3fddd4d8188cd450a5ef9cecc755e6c0f17cd1ebb1704dbba1d99cfa163c1d475433de8c79cea4b4f82df8
SSDEEP 192:sxRRRQCy/fUsIzKCA94/9zoA8p9H/g6+WNCgHfYD9Y6Sv+GfxIgVOJ:sxRRpy/fUsIzZ8Rh/5NfISvb4
TLSH
T1FC42C7166D28A97B8CC7E21DBB55BF53E6F95032A1D01E48E6FC9B0C04E66DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 20c20c266d148c38349693f467d3b075a9b1dcefaaa16c7ae6e9e94ce8f323a8
MD5 8e53336b2aa68ef2ba1bb50730a499c5
SHA1 806e1a3bda52ba42bebaeb2ef14ea3639ac3f74e
SHA512 689b33fcd674df889e020092875d6d67246a9229adba1f4a7981b87fe067f60dad71e9d3571d22288878ee21d91a94ededd6cd837285a94726002f558c2dff7d
SSDEEP 192:sxRaRQCy/fUsRUzKCA94/9zoA8p9H/g6+WNCgHfYD9Y6Sv+GfxIgDbOJ:sxRapy/fUsRUzZ8Rh/5NfISvbS
TLSH
T14C42B71AA928997B4CCBD21DBB55BF53E6F95032A1D01E48A6FC9B0C04E66DD230741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 e035a30aba126295d543c8edf6e7fcbb09c4621acbc0bc403600f4e2157625a4
MD5 d4e7797428867f26b518fb7866a6fa19
SHA1 df681263b1cb1d9c3ca93e7475eb1e54f8e47c5e
SHA512 b959a0e742f62eb13645af8bdedfd81187d1fb2d1485b926fba004e80267763bb4755725a6b0c712ec53de6bd976fbe334855f0b6c62ffcd6b7502c5262e99b3
SSDEEP 768:azfW5L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw+Yc16bropZh0O:azfW5dE7J0Wg/XfHfu1jaD+Yy6opZh
TLSH
T113D2EA7B240CCE7F4F800ADDAD197E9F6DA802CB9698CD5047FE951C02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b1cb1ad41f3a726e7dbd87ede02a8d3f71ccda4be2eb584d9e86527cd242e8f0
MD5 2561c5d8142c5f6399e6e3463a2aa243
SHA1 96ba77f97fd4dc78d93046aea4e3f150d9486c51
SHA512 3257ef257248763a7e642bac45e5ddd635076a2b511050dd9cc5a991eaded7eebccfac5e6b12d9836c0d0dd094c88e0cd27d39f03beb2c61804398a255188ad0
SSDEEP 96:KREBE+EPErEZE7E/ELWEPEME6gETE5K4EQgEXE5cEfEXEWEJEqEzHE/nuE/nDE/Z:CEBE+EPErEZE7E/EKEPEMErETEzEQgE9
TLSH
T165914941747A4240387D664C95B98C2BD2C2B4A6315CF47B3BA905B24F2EE638EFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3cdd393098b92c41c6822471a202cd9e74661e60936d5ccdc056c63bd0310dcf
MD5 0bc7956265c9a36c2621c6e0714afcc7
SHA1 c50271a2b5ac24a37179d891f247dbc9bcb7ff18
SHA512 1a8719ce6208c1f45233572f51e20f065b82201f0dbd55824208a088cc2ca48534767881b6c05d96b49f72c0c42805ace4dc9021965d00416a38eb0e44fea88c
SSDEEP 768:Rrv+4UNbdS3AJHi0PjrEnjN3Gac1FumeVH1SCx:Rbsbg3orQnjMaiEH1X
TLSH
T17513BE7169B88E738CE7E38571877B537EE4126385D40BA8C9D56B0D0A876EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9eec123a3c381b3a0d830fe180236c14291f4d9a386cfa20c136c883e7bacfc4
MD5 059459144e17f1e4dab02046d0bfa90d
SHA1 000b401837b9405917b26e4cb647ec400ebf676d
SHA512 9a827565b0cd31f73e6643619b1ea9499eedaafa8ddbfacb93a9a5ee4030d12270b2d2bdbbd29871c4ec3406e663b764b9bea72aaf642a982507dce715de51c9
SSDEEP 384:nKZcIN38NxGBhObsJ2WOnlfhCyEGY8FJ6EF/y2rEoajo4cdR8eHhVODjYPNDUMmy:oN3ZJ0njjPJrEnjN3Gac1Fumb9MI
TLSH
T146135AF168E74972C89E934363BE2E526DBCC223B5940658B7D9960CCD435BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b3d8d8329f4fbcaf0e690bfd72cef8482120746541e5d901e98f4b6e90899720
MD5 c3403c304017503a9cd6dccceb608ff6
SHA1 6a97dfc61a9a66532d82116cb02e1eb1649f0a71
SHA512 e0b1917fbd901c12e56a56ff75f0c619f0c0af977da2e17dfd98a02a0033f30d2f9ebdd9efc49e54c618a55b886c4b83da545a1f42b5d5e7e4bc560def7ebf42
SSDEEP 384:nLZcIt38NxGBhObxJ2WZlf8hyEGY8FJ6EFVy2rEoajo4cdR8eHhVODjYPNDUMmZQ:Tt3gJHi0PjrEnjN3Gac1Fumb9MI
TLSH
T195F2BF717D748DB38CEBE34575873B53AEE05363C5E40A98D6D9A70D0983AAC130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 70e25ca19c553b4521a760579557faee14a268d1d3c8945073c6808ea2929b2e
MD5 8692a2376a9443fac5698e43b7257602
SHA1 60fb2c42264f316dcd7267820504826da0bc88ff
SHA512 0df387879d022d94dd00b3ffa65060f09871eeee0282c166ff5f94c370bcf7760666363b8aaa2b3938c72c7efa5134ca2844d032c3773725f62f19cfcc329f8a
SSDEEP 768:rrv+4UNbdS36mi0PqrEnjN3Gac1ZbeVH1SCz:rbsbg3xyQnjMaAEH1V
TLSH
T1C303CF3269B88EB38CE7938571877A037EF4525386D40BE4CADD6B0D06975EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c4f37cd1b76e61e38586655d4afaf0793aaac85cdb4937642a4cc67be3743a57
MD5 934b30a9f2233e570d64d8d878813fdd
SHA1 169741e852e6ddca916f0ea1ae81ea41e5edac3c
SHA512 c2bb60b40f196a0d969ae529a37baa1529501632a342edce9319f6b9907e7d6fd1edc1a3c9e9d99af40d9b1632d4eeb55b7410e49233427c16b7e169bc98613b
SSDEEP 768:Rrv+4UNbdS37Zi0P+rEnjN3Gac1FumeVH1SC8:Rbsbg3DmQnjMaiEH12
TLSH
T1A403BE3169B88E738CEBE385B1877A537FE4126385D40BA8C9D96B0D06875DC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

bb14091f-57ed-49bd-87a0-99bb08dacde5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bb14091f-57ed-49bd-87a0-99bb08dacde5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5440_1738023435\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CP.exe

Path C:\temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/676-362-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/676-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1308-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1480-189-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1672-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1680-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2704-379-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-366-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3128-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3384-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3480-228-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3752-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4748-421-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5252-350-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5724-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download