systex | fac8d70dbcb22a5e71146946380cfe9de7567580100cea38fc2632322be464cc

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260714-w71z6abs2q
SHA256 fac8d70dbcb22a5e71146946380cfe9de7567580100cea38fc2632322be464cc
MD5 c09a6bd104e8476af0bd22792e49a903
SHA1 65892c44de4fb24381dfc88e0498d45de6640d92
SHA512 1d4177f2649c550d20b9fa26daa92144088c249e64961694a9780a99d6d50e65ede47996ba557010aae7bc1d8514f7b93393afca1aa129a675be1d9dd353a4bb
SSDEEP 3072:7JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:7ghLQ0sQmpcF8BzXfwVfAI
TLSH
T152344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5196	CP.exe
3556	mheupjhcxo.exe
2424	CP.exe
1412	CP.exe
4464	i_mheupjhcxo.exe
4640	mjhbztrmge.sys
3388	CP.exe
2976	ebztrpjhbz.exe
3108	CP.exe
4940	CP.exe
2828	i_ebztrpjhbz.exe
5116	dbztrljgby.sys
2528	CP.exe
5560	trljdbvtol.exe
920	CP.exe
4740	CP.exe
5416	i_trljdbvtol.exe
5840	vtnlgdyvqo.sys
2284	CP.exe
4624	qoigdywqli.exe
1936	CP.exe
4996	CP.exe
3148	i_qoigdywqli.exe
5648	gdywqoigay.sys
716	CP.exe
4180	qnigaysnlf.exe
4564	CP.exe
4712	CP.exe
2408	i_qnigaysnlf.exe
1636	dxvpnkidav.sys
1372	CP.exe
1988	vsqkidavsn.exe
5136	CP.exe
3356	CP.exe
5416	i_vsqkidavsn.exe
1656	pkicxusqki.sys
5016	CP.exe
3648	causmkfcxv.exe
3248	CP.exe
2532	CP.exe
3040	i_causmkfcxv.exe
4540	zxupmhfzxr.sys
1468	CP.exe
700	pmhfcxupmh.exe
2548	CP.exe
1148	CP.exe
5732	i_pmhfcxupmh.exe
4596	mjecwupmge.sys
1760	CP.exe
1732	ecwuomgezw.exe
6132	CP.exe
3128	CP.exe
2808	i_ecwuomgezw.exe
4728	wuomhezxro.sys
4296	CP.exe
6108	ebwtomgebw.exe
2344	CP.exe
2768	CP.exe
2580	i_ebwtomgebw.exe
1128	zwrojhbztr.sys
1780	CP.exe
2836	omgeytrljg.exe
2316	CP.exe
1476	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_56102600\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_6415701\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_1909277796\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_417831217\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_6415701\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_1909277796\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_417831217\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_417831217\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4648_417831217\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupnkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqlidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkifdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkidavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkifdys.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwurljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfcxupmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfspkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwurljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mheupjhcxo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdywqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeytrljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupnkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mheupjhcxo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrpjhbz.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4576	ipconfig.exe
5528	ipconfig.exe
5604	ipconfig.exe
6112	ipconfig.exe
3204	ipconfig.exe
5848	ipconfig.exe
1164	ipconfig.exe
4640	ipconfig.exe
5316	ipconfig.exe
4304	ipconfig.exe
2408	ipconfig.exe
2460	ipconfig.exe
5544	ipconfig.exe
4416	ipconfig.exe
2320	ipconfig.exe
6128	ipconfig.exe
3492	ipconfig.exe
4424	ipconfig.exe
4572	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285276807730127"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{15A0E2E5-A75E-468D-8E90-098A25FDCE21}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe
3556	mheupjhcxo.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	i_mheupjhcxo.exe
Token: SeDebugPrivilege	2828	i_ebztrpjhbz.exe
Token: SeDebugPrivilege	5416	i_trljdbvtol.exe
Token: SeDebugPrivilege	3148	i_qoigdywqli.exe
Token: SeDebugPrivilege	2408	i_qnigaysnlf.exe
Token: SeDebugPrivilege	5416	i_vsqkidavsn.exe
Token: SeDebugPrivilege	3040	i_causmkfcxv.exe
Token: SeDebugPrivilege	5732	i_pmhfcxupmh.exe
Token: SeDebugPrivilege	2808	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2580	i_ebwtomgebw.exe
Token: SeDebugPrivilege	3024	i_omgeytrljg.exe
Token: SeDebugPrivilege	1120	i_bytqlidbvt.exe
Token: SeDebugPrivilege	1392	i_igayvqniga.exe
Token: SeDebugPrivilege	2104	i_xvsnkifdys.exe
Token: SeDebugPrivilege	268	i_khfspkecxu.exe
Token: SeDebugPrivilege	2628	i_ecxupnkeca.exe
Token: SeDebugPrivilege	4148	i_bzxrpjhbzu.exe
Token: SeDebugPrivilege	1884	i_ebztomjecw.exe
Token: SeDebugPrivilege	1832	i_gebwurljdb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 4356	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 5180 wrote to memory of 5852	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 4356 wrote to memory of 988	4356	iexplore.exe	89
PID 5852 wrote to memory of 4648	5852	iexplore.exe	90
PID 4648 wrote to memory of 3436	4648	msedge.exe	91
PID 4648 wrote to memory of 1556	4648	msedge.exe	92
PID 4648 wrote to memory of 4436	4648	msedge.exe	93
PID 4648 wrote to memory of 4436	4648	msedge.exe	93
PID 4648 wrote to memory of 4436	4648	msedge.exe	93
PID 4648 wrote to memory of 6024	4648	msedge.exe	94
PID 4648 wrote to memory of 6024	4648	msedge.exe	94
PID 4648 wrote to memory of 3012	4648	msedge.exe	96
PID 4648 wrote to memory of 3012	4648	msedge.exe	96
PID 4648 wrote to memory of 3012	4648	msedge.exe	96
PID 4648 wrote to memory of 5924	4648	msedge.exe	97
PID 4648 wrote to memory of 5924	4648	msedge.exe	97
PID 4648 wrote to memory of 5924	4648	msedge.exe	97
PID 4648 wrote to memory of 828	4648	msedge.exe	98
PID 4648 wrote to memory of 1608	4648	msedge.exe	99
PID 4648 wrote to memory of 828	4648	msedge.exe	98
PID 4648 wrote to memory of 828	4648	msedge.exe	98
PID 4648 wrote to memory of 1608	4648	msedge.exe	99
PID 4648 wrote to memory of 1608	4648	msedge.exe	99
PID 4648 wrote to memory of 3400	4648	msedge.exe	100
PID 4648 wrote to memory of 3400	4648	msedge.exe	100
PID 4648 wrote to memory of 3400	4648	msedge.exe	100
PID 4648 wrote to memory of 4404	4648	msedge.exe	101
PID 4648 wrote to memory of 4404	4648	msedge.exe	101
PID 5180 wrote to memory of 5196	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 3556 wrote to memory of 2424	3556	mheupjhcxo.exe	106
PID 4648 wrote to memory of 2684	4648	msedge.exe	109
PID 4648 wrote to memory of 2684	4648	msedge.exe	109
PID 4648 wrote to memory of 2792	4648	msedge.exe	110
PID 4648 wrote to memory of 2792	4648	msedge.exe	110
PID 4648 wrote to memory of 3864	4648	msedge.exe	112
PID 4648 wrote to memory of 4828	4648	msedge.exe	113
PID 4648 wrote to memory of 4828	4648	msedge.exe	113
PID 4648 wrote to memory of 3704	4648	msedge.exe	114
PID 4648 wrote to memory of 3704	4648	msedge.exe	114
PID 5180 wrote to memory of 1412	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 5180 wrote to memory of 3388	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 2976 wrote to memory of 3108	2976	ebztrpjhbz.exe	123
PID 5180 wrote to memory of 4940	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 5180 wrote to memory of 2528	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 5560 wrote to memory of 920	5560	trljdbvtol.exe	132
PID 5180 wrote to memory of 4740	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 4648 wrote to memory of 3740	4648	msedge.exe	137
PID 4648 wrote to memory of 3740	4648	msedge.exe	137
PID 4648 wrote to memory of 3740	4648	msedge.exe	137
PID 4648 wrote to memory of 3204	4648	msedge.exe	138
PID 4648 wrote to memory of 3204	4648	msedge.exe	138
PID 4648 wrote to memory of 3204	4648	msedge.exe	138
PID 5180 wrote to memory of 2284	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4624 wrote to memory of 1936	4624	qoigdywqli.exe	143
PID 5180 wrote to memory of 4996	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 4648 wrote to memory of 3736	4648	msedge.exe	149
PID 4648 wrote to memory of 2280	4648	msedge.exe	150
PID 4648 wrote to memory of 4824	4648	msedge.exe	151
PID 5180 wrote to memory of 716	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4180 wrote to memory of 4564	4180	qnigaysnlf.exe	156
PID 5180 wrote to memory of 4712	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 5180 wrote to memory of 1372	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1988 wrote to memory of 5136	1988	vsqkidavsn.exe	165
PID 5180 wrote to memory of 3356	5180	2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_c09a6bd104e8476af0bd22792e49a903_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:988
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
      4⤵
      PID:3436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,1904912650262486380,12040073801615618078,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,2379277217740766793,3047766013001489830,262144 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
      4⤵
      PID:4436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10896194639142914246,11506642186157196842,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:13
      4⤵
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,13451522589341129922,5026579484726814048,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,2873268267910913725,7373876000380254793,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
      4⤵
      PID:5924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4288,i,12562815431862132519,14135670582281274511,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,18212778099591015454,1606141799007033681,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:9
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4440,i,1415570605719405931,14074416430862641164,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:1
      4⤵
      PID:3400
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,6029178307156465515,4196486816856169139,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,10275472477606291674,7691309578184154041,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,2867125620679857313,17067867195745497880,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1067199421430754686,9690776662900222365,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,1067199421430754686,9690776662900222365,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:3864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,9483890771442890979,4543765713411874911,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3368306574410851448,16975043358986997677,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:3704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4404,i,9842146264357195195,8716629683033728939,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
      4⤵
      PID:3740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4400,i,10863945867508495688,17151822115288954792,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1132,i,2890583045068613744,15994839552329568806,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
      4⤵
      PID:3736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,17266848555847429239,6261260501451930140,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=1396 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,753702298613391613,580943080633199900,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5564,i,12991383495669252940,4370119203145196389,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:5244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,3011438292875098934,8450307003592217830,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:14
      4⤵
      PID:5324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,5463208624784713982,7912125934115581907,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4416,i,8056357564871685277,10144922115106146248,2097152 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6800,i,2830198352150063585,9347620041906165404,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,3006489675371005265,6679514217222105388,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4748,i,1282754377901439431,10144866386057939153,262144 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:10
      4⤵
      PID:3040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3112,i,15064814474962134141,13690719799197792810,524288 --field-trial-handle=2300,i,351601932256273926,10050359552947952378,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:14
      4⤵
      PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mheupjhcxo.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5196
- - C:\Temp\mheupjhcxo.exe
    C:\Temp\mheupjhcxo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mheupjhcxo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Temp\i_mheupjhcxo.exe
    C:\Temp\i_mheupjhcxo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3388
- - C:\Temp\ebztrpjhbz.exe
    C:\Temp\ebztrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3108
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Temp\i_ebztrpjhbz.exe
    C:\Temp\i_ebztrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4740
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigdywqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2284
- - C:\Temp\qoigdywqli.exe
    C:\Temp\qoigdywqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigdywqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Temp\i_qoigdywqli.exe
    C:\Temp\i_qoigdywqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:716
- - C:\Temp\qnigaysnlf.exe
    C:\Temp\qnigaysnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4180
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\i_qnigaysnlf.exe
    C:\Temp\i_qnigaysnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkidavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Temp\vsqkidavsn.exe
    C:\Temp\vsqkidavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkidavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3356
- - C:\Temp\i_vsqkidavsn.exe
    C:\Temp\i_vsqkidavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkfcxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5016
- - C:\Temp\causmkfcxv.exe
    C:\Temp\causmkfcxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkfcxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2532
- - C:\Temp\i_causmkfcxv.exe
    C:\Temp\i_causmkfcxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfcxupmh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1468
- - C:\Temp\pmhfcxupmh.exe
    C:\Temp\pmhfcxupmh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfcxupmh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1148
- - C:\Temp\i_pmhfcxupmh.exe
    C:\Temp\i_pmhfcxupmh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwuomgezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1760
- - C:\Temp\ecwuomgezw.exe
    C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwuomgezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3128
- - C:\Temp\i_ecwuomgezw.exe
    C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtomgebw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4296
- - C:\Temp\ebwtomgebw.exe
    C:\Temp\ebwtomgebw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtomgebw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2768
- - C:\Temp\i_ebwtomgebw.exe
    C:\Temp\i_ebwtomgebw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeytrljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1780
- - C:\Temp\omgeytrljg.exe
    C:\Temp\omgeytrljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeytrljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1476
- - C:\Temp\i_omgeytrljg.exe
    C:\Temp\i_omgeytrljg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqlidbvt.exe ups_run
  2⤵
  PID:1656
- - C:\Temp\bytqlidbvt.exe
    C:\Temp\bytqlidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5276
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqlidbvt.exe ups_ins
  2⤵
  PID:4828
- - C:\Temp\i_bytqlidbvt.exe
    C:\Temp\i_bytqlidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igayvqniga.exe ups_run
  2⤵
  PID:5936
- - C:\Temp\igayvqniga.exe
    C:\Temp\igayvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igayvqniga.exe ups_ins
  2⤵
  PID:3036
- - C:\Temp\i_igayvqniga.exe
    C:\Temp\i_igayvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkifdys.exe ups_run
  2⤵
  PID:3884
- - C:\Temp\xvsnkifdys.exe
    C:\Temp\xvsnkifdys.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkifdys.exe ups_ins
  2⤵
  PID:4804
- - C:\Temp\i_xvsnkifdys.exe
    C:\Temp\i_xvsnkifdys.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfspkecxu.exe ups_run
  2⤵
  PID:3396
- - C:\Temp\khfspkecxu.exe
    C:\Temp\khfspkecxu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4764
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfspkecxu.exe ups_ins
  2⤵
  PID:5000
- - C:\Temp\i_khfspkecxu.exe
    C:\Temp\i_khfspkecxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupnkeca.exe ups_run
  2⤵
  PID:3972
- - C:\Temp\ecxupnkeca.exe
    C:\Temp\ecxupnkeca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2592
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupnkeca.exe ups_ins
  2⤵
  PID:2580
- - C:\Temp\i_ecxupnkeca.exe
    C:\Temp\i_ecxupnkeca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzxrpjhbzu.exe ups_run
  2⤵
  PID:2492
- - C:\Temp\bzxrpjhbzu.exe
    C:\Temp\bzxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4204
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzxrpjhbzu.exe ups_ins
  2⤵
  PID:3896
- - C:\Temp\i_bzxrpjhbzu.exe
    C:\Temp\i_bzxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztomjecw.exe ups_run
  2⤵
  PID:5748
- - C:\Temp\ebztomjecw.exe
    C:\Temp\ebztomjecw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztomjecw.exe ups_ins
  2⤵
  PID:3772
- - C:\Temp\i_ebztomjecw.exe
    C:\Temp\i_ebztomjecw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebwurljdb.exe ups_run
  2⤵
  PID:4416
- - C:\Temp\gebwurljdb.exe
    C:\Temp\gebwurljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2276
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebwurljdb.exe ups_ins
  2⤵
  PID:4348
- - C:\Temp\i_gebwurljdb.exe
    C:\Temp\i_gebwurljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1832

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4240

C:\Temp\mjhbztrmge.sys
C:\Temp\mjhbztrmge.sys
1⤵
- Executes dropped EXE
PID:4640

C:\Temp\dbztrljgby.sys
C:\Temp\dbztrljgby.sys
1⤵
- Executes dropped EXE
PID:5116

C:\Temp\vtnlgdyvqo.sys
C:\Temp\vtnlgdyvqo.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
- Executes dropped EXE
PID:5648

C:\Temp\dxvpnkidav.sys
C:\Temp\dxvpnkidav.sys
1⤵
- Executes dropped EXE
PID:1636

C:\Temp\pkicxusqki.sys
C:\Temp\pkicxusqki.sys
1⤵
- Executes dropped EXE
PID:1656

C:\Temp\zxupmhfzxr.sys
C:\Temp\zxupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:4540

C:\Temp\mjecwupmge.sys
C:\Temp\mjecwupmge.sys
1⤵
- Executes dropped EXE
PID:4596

C:\Temp\wuomhezxro.sys
C:\Temp\wuomhezxro.sys
1⤵
- Executes dropped EXE
PID:4728

C:\Temp\zwrojhbztr.sys
C:\Temp\zwrojhbztr.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\ljdbvtolgd.sys
C:\Temp\ljdbvtolgd.sys
1⤵
PID:5396

C:\Temp\nlfdyvqoig.sys
C:\Temp\nlfdyvqoig.sys
1⤵
PID:5020

C:\Temp\avsnlfcxvp.sys
C:\Temp\avsnlfcxvp.sys
1⤵
PID:5576

C:\Temp\ifaxvpnhfa.sys
C:\Temp\ifaxvpnhfa.sys
1⤵
PID:2384

C:\Temp\fcxusmkhcz.sys
C:\Temp\fcxusmkhcz.sys
1⤵
PID:5080

C:\Temp\bzxrpmkecw.sys
C:\Temp\bzxrpmkecw.sys
1⤵
PID:704

C:\Temp\pjhbzwrpjz.sys
C:\Temp\pjhbzwrpjz.sys
1⤵
PID:2684

C:\Temp\jgbzwrojdb.sys
C:\Temp\jgbzwrojdb.sys
1⤵
PID:624

C:\Temp\gbztrljdbv.sys
C:\Temp\gbztrljdbv.sys
1⤵
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljgby.sys

Path C:\Temp\dbztrljgby.sys
Size 141KB
SHA256 cbfcd29ae1e849fab34593e8bc71d2ba3156871904d16704eb3c7107483f79ca
MD5 18c41ac62900323cb3ccff7297b4ace6
SHA1 159b58aeb0f8865fcd688765dd9611baf85f038c
SHA512 a60c8c1dcdd7013acd23954a12cccae42bacda0dbf9e3be3fe855302587efc5c127daf3512d183eb8669f19b20314f6fd8b26f97caa1926a2dba3d0acba1c155
SSDEEP 3072:4sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:4sQmpcF8BzXfwV
TLSH
T198E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnkidav.sys

Path C:\Temp\dxvpnkidav.sys
Size 141KB
SHA256 be6346b21be4bf9e995db2265eb034c3c78e7f02a6c08ad4e2125e5c8dafb24c
MD5 bb0ae2a1fb91bca044b16ba5365fa7bc
SHA1 f6109c19d29172537dd5cd597e680e722bee054e
SHA512 bec22386d68d1dba1ad218a1a86898a27426ffe6bc1fc8c94e1c1e5299d76d37b8993eb9b4e8534b031523ade948328ae1fbb139db95064d9571e1e0ad279e54
SSDEEP 3072:LsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:LsQmpcF8BzXfwV
TLSH
T1C1E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrpjhbz.exe

Path C:\Temp\ebztrpjhbz.exe
Size 230KB
SHA256 ba4fb31e1e27f067c822be50e274b475eab61aec2e217b5e2a2cebcebbdcb3cd
MD5 192aad97da316ce846ccd87e18b530fd
SHA1 1056c81dfee795dcb74211fa5d29d119d3a3e3d2
SHA512 e8510e3b8fadf824c9a02e30c56f9569760a7cdb9963ef45f9699926b2a90451cdb35bc5cf884b8686c5def0751b84ef664d044b4a4bd48663fcbfd4e3f163eb
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T12B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.sys

Path C:\Temp\gdywqoigay.sys
Size 141KB
SHA256 4ca8760b3d25adfb57890917edf315302928a6181cef887192473ed616427609
MD5 03fd388235c472eb59da273743536be9
SHA1 9d56a7eec5a5ddce806801fcf09622ff3229925e
SHA512 411333521ae063b16aa16a95750388c8414eb43864be9f799fd90b55b55ce40aba37e157e408a50e6179764b5e7e024dcd83368e43653f7a83317f2139dcbc4f
SSDEEP 3072:msQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:msQmpcF8BzXfwV
TLSH
T16CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebztrpjhbz.exe

Path C:\Temp\i_ebztrpjhbz.exe
Size 230KB
SHA256 1dcb3d208501d467024d393acb0548cec671d2b00c3f434e88188b04c9e19b13
MD5 5010692ba11b936ecfb2afcf54f7223c
SHA1 7b3096b36bbe7071cd6e923942b99ded50bffb23
SHA512 e8fa6224bc0c69aa2abe868ec6db97ab6037941b68d717b3d8dc05c1444477062db38c67ac97ed1ac59eb0cd48135d0b937d04f694ef70de75b37593bd109b0d
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T12A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mheupjhcxo.exe

Path C:\Temp\i_mheupjhcxo.exe
Size 230KB
SHA256 609d5feb6da4e5ba09daa8087c511d8d054aa571403f72779380934113919971
MD5 9da496f6b4c6dbf06a41e720dbd377f6
SHA1 6e194440468fcc8b96b2a3e658db64de31c77525
SHA512 02d3de58e6b6ce2067f3c955ec6f39ecce90f539f9e87077637fca267d4af423650b842acccd2b7c16a54767eba91b0cfae699fa6040fc425cfcd40816cc6cc7
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaysnlf.exe

Path C:\Temp\i_qnigaysnlf.exe
Size 230KB
SHA256 28186a52ae5b57091b01d433ff1d75fcf9ea9d1f6b142ba82064df722a10c7ae
MD5 13e445fd89447d05169a98032e24d141
SHA1 1ce18101a65aa8f572ac9e9592ca84cfe9b1c1c3
SHA512 52254944d66c2a9579c84b69825f21086cd81e331f2fc1d6bc551c67560399c28c08edeab390efc18d2235cfaf30c4d15159ca158fc037991dfc07f17a24ac08
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T13A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigdywqli.exe

Path C:\Temp\i_qoigdywqli.exe
Size 230KB
SHA256 601115f6cd6a28cb9fd8c3ab62ee88ff85f6cb2a8d20b52c06a28cefd5de282b
MD5 a02b2290c7db350d76cb3d501c8279b9
SHA1 d10563945819908389e50770a35ac5843d0dfae1
SHA512 94bb88ad81c31050349bf3a5592363aa887dd6c6981f95011c3c85b213ced3afb30e40b1cb5aef6040d5bd4853e65e09bb695d93033e44d46246f66fad4759f2
SSDEEP 3072:fJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:fghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbvtol.exe

Path C:\Temp\i_trljdbvtol.exe
Size 230KB
SHA256 c173d815d222bce503f9fdb8ea4f1de11e10f1f3b0f2fce81548aa996440c88d
MD5 c925e7e5e492b50ccc3162b2ea0b3be2
SHA1 7ef34b0e3545966ed931fecad41bcbd4fff37d7f
SHA512 de57f1cb4c7f85ee8b876c993dfc6517e46d3bf89c790921df9d4499d1d8346868742ee105b86c797865156051fd508c3cefd82c05002f00028465879f8e457a
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T12B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkidavsn.exe

Path C:\Temp\i_vsqkidavsn.exe
Size 230KB
SHA256 0523087c81b30592d6d70b17df9f7ce5ab0da443e549e859bc5c54cfab3d46aa
MD5 195424347912d553d1fc166f4372e6ab
SHA1 07839c8445a29e0ecbf6e59f74fac616a639dfe1
SHA512 ca9fdb337cd59c4adb3461708f970ccf6e8296fa1d7af8e6a805d24baa96fde0ade5043f5ab630a6bfb0cc55eb337c8a264c779608b99861c8a3fca410d33b30
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mheupjhcxo.exe

Path C:\Temp\mheupjhcxo.exe
Size 230KB
SHA256 5588d36e4a0b949035a69fd8a8a3c1674c8299f854b77c23d61e5b305924ae27
MD5 863e959d201fbbe296ee7fe7d55a5e84
SHA1 ed6b6076e84e3a7b0da70f364a5d7094a05ae034
SHA512 10cff35288ea85a0c2ab0e34ec7e90266f334e1f5116e154baf64e0fa03a95830aec237e0fe897ed9a9e0e8b5352ad722536f443ee654e810e05bcdb7ee23e8b
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbztrmge.sys

Path C:\Temp\mjhbztrmge.sys
Size 141KB
SHA256 d4aaf493da1653ad41946faf640d5b4d161683d724a84a54ef7ee6709a72fc26
MD5 8cea37b0368c1eec6b7349395acebb58
SHA1 524cc52a1a1a3bb54d51d5db450a44b15ee71b68
SHA512 e68e3d01bd3b2e38a7f01f6c5b4b2987d89df99124ff13e91bdfa2f8807735d7500e47fbd1ab729404966c710175372e251195eeb25cc94a28c38e8a03493ef6
SSDEEP 3072:ssQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ssQmpcF8BzXfwV
TLSH
T1B6E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysnlf.exe

Path C:\Temp\qnigaysnlf.exe
Size 230KB
SHA256 816ce0d00a06146bf26c3ab9fbd5bf1442eba06d29875cf6a1f6b8f30de5b60e
MD5 8ce60cb3da7b09b9fdd3eb29b56fa8b4
SHA1 0377286b414b728d9a5f6b12ca0d4839cce743a9
SHA512 9ada1b6040ba3301c165f8a48bdaaebb56655ee81e6486d7a946ec4e8a735dd543998beeb1693a1cfa7ea1fe84852af5bbeb0213734d5718567cd4bf6a6b9c84
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T129344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdywqli.exe

Path C:\Temp\qoigdywqli.exe
Size 230KB
SHA256 c9ca9d0bbd01debb0ef143beb9c0fc4c277c4ce9b99d3f793b30ebfa87195cc6
MD5 435946272c9e0d1184549ead6e525fd8
SHA1 60966f1d9b8baaade8eba9ff3a0740805e587a76
SHA512 d95b1f077f71cf0d443e78b0aec52b213a7b2d97bc08d7f58ff62e90b4e4d7268cd2907741056613afce907fcb3fa968f63c0ce39ab765bf4316ecbc74df4ca7
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.exe

Path C:\Temp\trljdbvtol.exe
Size 230KB
SHA256 889331da7316f0808970c76538c5cd7fff05b2a5c9b6b76afc4a40fdc7aaa935
MD5 546f7d56de5c9209ac0a1c104ef594f2
SHA1 bec9d7001155a74ef5e5e7375908307738daaccc
SHA512 0787ead0a004dc5036cc31c581aaff8f4054feeb7f0d39e428f483718d0a4b59b0fcb5f83942c244a29468b666c744761a2c3e842cd9161e3cd85f72198c5e64
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T102344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkidavsn.exe

Path C:\Temp\vsqkidavsn.exe
Size 230KB
SHA256 c03e74444c3a4dd0fb5c0f04ed27ca2e27cb87652b51c4500c145111e4072771
MD5 6f2020fa59cec6fbf9215c384ce05f55
SHA1 40e0cf3462b831996854c8d6f2215428192a406e
SHA512 6d9f280bdbe2a1baad9f7bdc6cd4752df08668c84b922701e805e981f0d340b5eb1d9c51f57a102acc51945b1ee75969f18331af8fbb33eb2270109b3b07e4a4
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T191344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlgdyvqo.sys

Path C:\Temp\vtnlgdyvqo.sys
Size 141KB
SHA256 9cda12b83e08ada90a067de4e14b19e46d469eb4851fe85f84520e01053f93d6
MD5 0c0e731219e1c3ce0e4fb08713a7b5cf
SHA1 0ea3a64156dace13a710b6059e101dcdf6b7890d
SHA512 32af0be5009da383282cb058a50a88322f0bad3dd4972f48844dead5d4899cb68f31fca10ad47d867566cf574b47cb2dd50ad05a34dc56cc401b384d47cb094a
SSDEEP 3072:asQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:asQmpcF8BzXfwV
TLSH
T1E9E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 348ff74723d2c08b07e7535ae0678a6a3973f3c9325bc848d63b502f41909e9b
MD5 8bc096614b4937f26b04f3f1a2932a1f
SHA1 fe407a17140f987601abdfdbd06da982318a8d6d
SHA512 c0707a286527faf81b90468d2252d136da2e95063e4f3d8ce1cacdde80d0dcf3654d6d566c09bb23da7975482480993c0ad07d75a9490f59158902e842c17bbe
TLSH
T15C61FD5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59792e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59792e.TMP
Size 3KB
SHA256 b15b78e4e3846f379d07bc73c8916b2c7762cd198017b3b6c84d1bec204193f1
MD5 5cba91feb5ef6de4b0cbf540532c447f
SHA1 d9749af445a7ebcb14189c611b1b3bc5a618ad49
SHA512 83fed3a5b00e4bf728e6094f43e2d7351cde20c7109ca017d7c8784eee265b707086dc78f8d0a22c73e4dceabd83bc59b66793c7e6fd1a29ae1ef59f2b8ac9fd
TLSH
T15961FD5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9a1527277dc26883538f408167e15b7024dd2d88af39ba7af3d000278cbce3b4
MD5 4e8c30ddfa3ffb233d325698b89a3006
SHA1 f2049639424131d1b252567bb573876a6a842b9f
SHA512 f61fe72dcca5e090d8da88c4dbe3e2c0cf7cee7b3b1e13d32cf708f9276036818e2a6fd0e3e6100a8d9f3600454b6963f1434dfc3e08fc49144c4ad3b9c43c90
TLSH
T19741C0F3C3E4966EC90196F0AA147E2BCE2D0915832C3D5AC9E4EF5B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8e4c6dbab555256d90376cbfd023aa035b1afea378bfa0484d7749dc84dac099
MD5 9bf3107c5b4830de155ea330821d0179
SHA1 c83f283a573c0604fcab96f458f929cd4483a978
SHA512 51fcfdae759bae2608d0091bca0a3607ac279b5d0351cd56e0c80803bdb52e6cff48488ffb56c9b33eca9a538567c3fbbaf23bf07f296f49a34cd550c0dcd347
SSDEEP 192:sxRwRSyM/jK1Ml8wC2/fnsgtsUZxzoA8pi/g6+WNIYnY3hkG+IgtJ:sxRwE82/fnsIsqsi/5I5RW3
TLSH
T14952EA156A24997B8CDBD30CFA557F93D6F81573E2941E44AAFC8B0C04EAADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8cbc1e8def773242c2552296a1c5975db75238a39059d0886e8915ac93d75bb3
MD5 ce9142e32bc995a2369035691a2d5a33
SHA1 1fcf0a463602593f6e18c1e79698c264918542f3
SHA512 12841ae22a6b52e8ff0be548184320ec67fe41f420cb7a154138e8de2c43b5ba8c8bd074004669b206d877cb9370e87bf54b6c940c79eaf4d90edce0d2e8dc1f
SSDEEP 192:sxRzRSyM/jK1Ml8wC2/fnsktsUZ5zoA8pi/g6+WNC5+/Ynz3hkG+IgD+J:sxRz082/fnsssqEi/5p/mRWG
TLSH
T1C362FA156A34997B8CDBD308FA557F93D6F81573E2941E44AAFC8B0C04EAADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b400ed8f43707109ee1a64a5f6f0558c217951d91bee07ff2086d43e22e3acc5
MD5 a311aaf0b940d56855eb1ec263e876cd
SHA1 47de3c93e86884d0737c1879fd2abb056b724022
SHA512 172e5cba65747319d7580cc9ade56424fae79d29decfdc043a974f4b8bef2b49787fd9aa6fd29b5a4334c761189195aeca8a58ba15433b0e1f8e8b203d7ce526
SSDEEP 192:sxRzRSyM/jK1Ml8UQaC2/fnskttUZ5zoA8prD/g6+WNCw+fYn6nhkG+IgDwJ:sxRz0qd2/fnsstqEv/50fLhWQ
TLSH
T1F562EB156A34997B9CDBD309FA517F93D6F81572A2941E04ABFCCB0C04EAADD211381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d216dae862760f27f2c3c61a6e8d0f9962ddc98dbb449e1c29da14f4bf07f06f
MD5 7b4331554abd6d4a9306bd0b33c62ec6
SHA1 e6969a29c1e1b1325988ebc50a48ecfb167f384f
SHA512 cf30a283b1fc037e2062fd319589a3473ace877916e99827db60c3363af061208e9392cc3d5ed731f405ed03f332978c48f847a6abb3cffaefdf137dec273a29
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5ZOu4YmroS88EQ:wGedPsE7X6WgoufDMu1jaqZOVYdfQ
TLSH
T13DE2EC3B680CCB7E4F844EDCEC29BE9FADA801CB5AD8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ba1966de07ecfa056bdd5b2bcce843a8ac5ff67ad3e7d0da878e5342ac46db31
MD5 1abf6573f37eef242e0651de516f92f0
SHA1 b83f11ecddd4b3aa8f9ace34671e256f09fc2238
SHA512 1c67dc8418acb06f6dcfefbf36b62711357deb30f3848b987cbc8d3e0b4ecbc2b65e080dc4a1b3f5890c93c1bf39b95df41f0de2b937aaf476a59ed3fd7988bd
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfOnnKzX5z:CeTieYgQxAl+eODgc1W+9M+XHklQUuS0
TLSH
T1E4916015317A975039FE794880B6AD1B92C6B4B73214F42B3BE945E20F67E024DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 71b8544e995731ac7c8c3d150d6f790b896f63a42f748ebe1729def2eabad4eb
MD5 dd48469bb9d754c7e2fd987ae48199d5
SHA1 0fba03a0e57f804ca607bf765f388369150626fc
SHA512 99b1fb09d14cce1f1da15bfa550e3ed9522aa93b772af4ba1a4d35236d4805466bb1fc90b6ff72b8e9965fef3a12444a87f86a3db61fc565dfde074c9c52140b
SSDEEP 768:Grv+4UNbds3Yk4IDZIO0CEl8sqNzc4ReyIsPWb9Mg:GbsbS3YWiqtc44bsOb+g
TLSH
T1D713CF32F8288D77ACF69212B0473A937EF8216B85C81E98D6D95F4C0A4B5DD1B1F513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 039de27dc1de267a26a7c274e484d666b5a359ea416e52c0ede09659b35b8792
MD5 da3a7ccbe8713dbb200700aa5b1986ad
SHA1 644401db26bb91d18d0dc9ee04d5e015c170603e
SHA512 2f6f913e4c93d8e22278d0c7417bcf3c25b673b81a300ee1ab81eeb5d9255c65143d1ca57524e169134bdb523b12abc707449c7311fe5ce3c6fe2477d27500a5
SSDEEP 768:/rv+4UNbds3Lk4IDZIO0CEl8sqNzc4ReyIsPWb9Mg:/bsbS3LWiqtc44bsOb+g
TLSH
T1E313CF32F8288D77ACF69212B0473A937EF8216B85C81E98D6DA5F4C0A4B5DD1B1F513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9a1472ee42e2cb818f9afc8871c739e689ec05c4f8ba2ed2944d8314aaecc26b
MD5 e1dbbd4d79602ddda58e4f3abbdd281d
SHA1 917d75ed5366a9e912b877624694f86c6c433803
SHA512 0fc2d1a1b78d3a7fd44edc96f4f8eb11ea1815e60fb15230f2557570688d243f5156c556d0229b27ba9b45b05eba7f3a4c50cc7ec1f27c328ba1989bc5667084
SSDEEP 768:6rv+4UNbds3/iDZIO0CEl8dNzc4ReyIsXoeVH1S5D:6bsbS3QDtc44bs4EH1Y
TLSH
T10103CF32A8689977ACF69785B44B76533EF8612B82C81E94D5DE2F0C4A4B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 8b3e13ff54a0b3e9f510330132cc60a79746484bfb284a3a92ded7b077eda3fb
MD5 8e20539f1f9faded2c5591a57f7f8d03
SHA1 9eddf550a6c4f63fb0e32af20635b4561bc4b3a4
SHA512 115bd35ae5cf5eeea27e41793404913058a4e36219760353c7e3cd64c70659587e5ba22b19278da1fccf4b5d4e951e9f564e54f5ed8bc0484580aca0ceee768a
SSDEEP 768:WF0rv+4UNbd93jwgM+4RZw5O0CEl8sPNzc4ReyIsPWb9Mg:HbsbT3K7iPtc44bsOb+g
TLSH
T18A3338F298D78976E8AE4743B33E2D42AEFCD157B5881984B7955E4CCC461BFC70A802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 d19f61aae7a1520695328d8ca7f9e89da91dc9dd8e2804f96ed9bc4d4fa4046c
MD5 fceb13e5b301dfe891fce16b0e3000a3
SHA1 e2547f8b80cfe0fb06254b5535b955e175b84b44
SHA512 7d93fc7a0a2c0050335954ce5b6259d68523014e8e5ecad8f7830416c03eceee5a6a68f71083028b0f5fbf92c90f01e237a19448d560b6e90ddf2a7675a362b3
SSDEEP 768:Lrv+4UNbds3gZDZIO0CEl8s4Nzc4ReyIsPWeVH1S5s:LbsbS3ii4tc44bsOEH1b
TLSH
T1E603CF32E8688D37BCFA9742B44736937EF8212785880E94D5EA5F0C4A4B1DD175F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

290d505a-f849-4aa4-9aaf-69bcdcb69541.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\290d505a-f849-4aa4-9aaf-69bcdcb69541.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4648_1120077446\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/624-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/704-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1636-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1656-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2384-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2684-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4540-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4596-327-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4640-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4644-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4728-352-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5020-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5080-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5116-236-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5396-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5576-428-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5648-276-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-264-0x0000000000010000-0x0000000000083000-memory.dmp

Download