systex | c707faf71fcec4f15c90489055758e32d07917e50b56bb9ec687ae2863cf6cce

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260716-rf7amsa12t
SHA256 c707faf71fcec4f15c90489055758e32d07917e50b56bb9ec687ae2863cf6cce
MD5 0052e5b4b812baf80c4d97b3d9845ac0
SHA1 f3ec782f6be2a92642099a67172ed5747469bfe5
SHA512 0495d1d3fbf59841004745bde8936622a2d0b83fe1d5192823a310d3d299a21afcdb40c26d17d462d5ab29abeeb6a352b4c228a7747c8fc2ff24bf3d2f59b8cd
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T109344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2672	CP.exe
2960	hbzuomhcwr.exe
1616	CP.exe
3708	CP.exe
5376	i_hbzuomhcwr.exe
3500	urmjecwuom.sys
3148	CP.exe
2804	mgerojgbzt.exe
4132	CP.exe
4380	CP.exe
5464	i_mgerojgbzt.exe
4504	bwtrljgbzt.sys
2992	CP.exe
2340	toljdbwtol.exe
1076	CP.exe
892	CP.exe
1744	i_toljdbwtol.exe
3436	yvtolgdyvq.sys
1720	CP.exe
5316	tnlfdyvtnl.exe
1908	CP.exe
5900	CP.exe
2132	i_tnlfdyvtnl.exe
4468	fdyvqnifay.sys
5924	CP.exe
4324	xvpnlfdavt.exe
1372	CP.exe
5168	CP.exe
4288	i_xvpnlfdavt.exe
1760	kidavsnlfd.sys
2580	CP.exe
5592	spkicausmk.exe
3020	CP.exe
3948	CP.exe
5532	i_spkicausmk.exe
4120	nkfcxvpnkf.sys
260	CP.exe
236	hcaxspkfcx.exe
2140	CP.exe
2516	CP.exe
5636	i_hcaxspkfcx.exe
2424	hcausmkecz.sys
1532	CP.exe
3624	ecauspjhec.exe
2328	CP.exe
3344	CP.exe
1764	i_ecauspjhec.exe
2460	zwuomkecwu.sys
2748	CP.exe
1740	bztrpjhbzt.exe
1744	CP.exe
1456	CP.exe
5556	i_bztrpjhbzt.exe
2220	zurmjebzwu.sys
3520	CP.exe
2544	rmjebwuomg.exe
4172	CP.exe
936	CP.exe
1556	i_rmjebwuomg.exe
5684	zwqomgeywr.sys
4576	CP.exe
4852	bztrljdbwt.exe
5480	CP.exe
3640	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1022200013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1633936190\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_894671875\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_894671875\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1647385526\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1647385526\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1633936190\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1647385526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2060_1647385526\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_toljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecauspjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfcxupnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgerojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcaxspkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzuomhcwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurpmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurpmhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligeyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzuomhcwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgerojgbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	toljdbwtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcaxspkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlfdyvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecauspjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbzwroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywuomgeywu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfdavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfcxupnhf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1172	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3544	ipconfig.exe
5772	ipconfig.exe
2424	ipconfig.exe
5812	ipconfig.exe
4572	ipconfig.exe
4952	ipconfig.exe
1760	ipconfig.exe
3980	ipconfig.exe
1632	ipconfig.exe
556	ipconfig.exe
2224	ipconfig.exe
5852	ipconfig.exe
2800	ipconfig.exe
964	ipconfig.exe
3828	ipconfig.exe
6052	ipconfig.exe
1268	ipconfig.exe
4840	ipconfig.exe
3000	ipconfig.exe
2256	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286845614508558"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{C7FC81B9-41CB-4DEA-9698-D5CC802E2176}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe
2960	hbzuomhcwr.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe
2060	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5376	i_hbzuomhcwr.exe
Token: SeDebugPrivilege	5464	i_mgerojgbzt.exe
Token: SeDebugPrivilege	1744	i_toljdbwtol.exe
Token: SeDebugPrivilege	2132	i_tnlfdyvtnl.exe
Token: SeDebugPrivilege	4288	i_xvpnlfdavt.exe
Token: SeDebugPrivilege	5532	i_spkicausmk.exe
Token: SeDebugPrivilege	5636	i_hcaxspkfcx.exe
Token: SeDebugPrivilege	1764	i_ecauspjhec.exe
Token: SeDebugPrivilege	5556	i_bztrpjhbzt.exe
Token: SeDebugPrivilege	1556	i_rmjebwuomg.exe
Token: SeDebugPrivilege	2112	i_bztrljdbwt.exe
Token: SeDebugPrivilege	3892	i_vtqligeyvq.exe
Token: SeDebugPrivilege	5092	i_yvqnlfdyvq.exe
Token: SeDebugPrivilege	4516	i_vpnlfdxvpn.exe
Token: SeDebugPrivilege	1924	i_ifaxsqkica.exe
Token: SeDebugPrivilege	4860	i_nhfcxupnhf.exe
Token: SeDebugPrivilege	5772	i_heczurpmhb.exe
Token: SeDebugPrivilege	4120	i_rojhbzwroj.exe
Token: SeDebugPrivilege	3364	i_ywuomgeywu.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 4844	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 2056 wrote to memory of 3884	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3884 wrote to memory of 2060	3884	iexplore.exe	89
PID 4844 wrote to memory of 4608	4844	iexplore.exe	90
PID 2060 wrote to memory of 4432	2060	msedge.exe	91
PID 2060 wrote to memory of 1172	2060	msedge.exe	92
PID 2060 wrote to memory of 5380	2060	msedge.exe	93
PID 2060 wrote to memory of 5472	2060	msedge.exe	94
PID 2060 wrote to memory of 5380	2060	msedge.exe	93
PID 2060 wrote to memory of 5380	2060	msedge.exe	93
PID 2060 wrote to memory of 5472	2060	msedge.exe	94
PID 2060 wrote to memory of 1244	2060	msedge.exe	96
PID 2060 wrote to memory of 1244	2060	msedge.exe	96
PID 2060 wrote to memory of 1244	2060	msedge.exe	96
PID 2060 wrote to memory of 4348	2060	msedge.exe	97
PID 2060 wrote to memory of 4348	2060	msedge.exe	97
PID 2060 wrote to memory of 4348	2060	msedge.exe	97
PID 2060 wrote to memory of 5492	2060	msedge.exe	98
PID 2060 wrote to memory of 5492	2060	msedge.exe	98
PID 2060 wrote to memory of 5492	2060	msedge.exe	98
PID 2060 wrote to memory of 3620	2060	msedge.exe	99
PID 2060 wrote to memory of 1612	2060	msedge.exe	100
PID 2060 wrote to memory of 3620	2060	msedge.exe	99
PID 2060 wrote to memory of 3620	2060	msedge.exe	99
PID 2060 wrote to memory of 1612	2060	msedge.exe	100
PID 2060 wrote to memory of 1612	2060	msedge.exe	100
PID 2056 wrote to memory of 2672	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 2960 wrote to memory of 1616	2960	hbzuomhcwr.exe	105
PID 2060 wrote to memory of 5972	2060	msedge.exe	108
PID 2060 wrote to memory of 5972	2060	msedge.exe	108
PID 2060 wrote to memory of 1892	2060	msedge.exe	109
PID 2060 wrote to memory of 1892	2060	msedge.exe	109
PID 2060 wrote to memory of 936	2060	msedge.exe	111
PID 2060 wrote to memory of 1364	2060	msedge.exe	112
PID 2060 wrote to memory of 1364	2060	msedge.exe	112
PID 2056 wrote to memory of 3708	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 2060 wrote to memory of 2312	2060	msedge.exe	117
PID 2060 wrote to memory of 2312	2060	msedge.exe	117
PID 2060 wrote to memory of 2312	2060	msedge.exe	117
PID 2056 wrote to memory of 3148	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2804 wrote to memory of 4132	2804	mgerojgbzt.exe	122
PID 2056 wrote to memory of 4380	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 2056 wrote to memory of 2992	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 2340 wrote to memory of 1076	2340	toljdbwtol.exe	131
PID 2056 wrote to memory of 892	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	134
PID 2060 wrote to memory of 4268	2060	msedge.exe	136
PID 2060 wrote to memory of 4268	2060	msedge.exe	136
PID 2060 wrote to memory of 4268	2060	msedge.exe	136
PID 2056 wrote to memory of 1720	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 5316 wrote to memory of 1908	5316	tnlfdyvtnl.exe	141
PID 2056 wrote to memory of 5900	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 2060 wrote to memory of 3564	2060	msedge.exe	147
PID 2060 wrote to memory of 4172	2060	msedge.exe	148
PID 2060 wrote to memory of 1308	2060	msedge.exe	149
PID 2056 wrote to memory of 5924	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4324 wrote to memory of 1372	4324	xvpnlfdavt.exe	154
PID 2056 wrote to memory of 5168	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 2056 wrote to memory of 2580	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 5592 wrote to memory of 3020	5592	spkicausmk.exe	163
PID 2056 wrote to memory of 3948	2056	2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 2060 wrote to memory of 2460	2060	msedge.exe	168
PID 2060 wrote to memory of 2460	2060	msedge.exe	168
PID 2060 wrote to memory of 3032	2060	msedge.exe	169
PID 2060 wrote to memory of 3032	2060	msedge.exe	169

C:\Users\Admin\AppData\Local\Temp\2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-16_0052e5b4b812baf80c4d97b3d9845ac0_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:4608
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x34c,0x7ffa6a9dc188,0x7ffa6a9dc194,0x7ffa6a9dc1a0
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,1876007045238373508,1040179322308378913,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:11
      4⤵
      System Time Discovery
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,1110922357805004556,10105435014975589527,262144 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
      4⤵
      PID:5380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,394778846460096288,6687167962590018550,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,17107051346224393036,14876699398693471808,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,17589570860986797099,6583568461225065171,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,10434827289610457700,5307777919980309383,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4412,i,12829184631564075842,14284956174161554787,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:3620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4536,i,17187264988668709757,5681569871253487087,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,14217601472839061605,8290167208582135544,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,3343846650065970354,2361476001507115134,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2125414999611819260,599816318899386352,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,2125414999611819260,599816318899386352,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4573228220782158953,2851226671358137790,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6468,i,13519650257038684151,15842538527055363323,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4392,i,9696478077035898613,16190177012992519229,2097152 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,1619158553133790537,3051905117318380957,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:3564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11321448551888190803,18333089146640289763,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:4172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2936733144729220466,14598754520632097168,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
      4⤵
      PID:1308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,17395079802234181134,970088105091343486,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,13091537873845888364,16577844759697250977,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:14
      4⤵
      PID:3032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,6136165555968176028,13289861788343451820,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,2837619863184587106,16285787767628229400,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:14
      4⤵
      PID:1064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,1377871940281920365,8732453754490311627,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,9617317186339751363,5797159725478583322,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6020,i,16296929939032475987,2776985220757756355,262144 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:10
      4⤵
      PID:3920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,7739922899436304278,5570517749075551267,524288 --field-trial-handle=2252,i,11093730272246540602,11848368573462753356,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:14
      4⤵
      PID:1348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzuomhcwr.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672
- - C:\Temp\hbzuomhcwr.exe
    C:\Temp\hbzuomhcwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzuomhcwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3708
- - C:\Temp\i_hbzuomhcwr.exe
    C:\Temp\i_hbzuomhcwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgerojgbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3148
- - C:\Temp\mgerojgbzt.exe
    C:\Temp\mgerojgbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgerojgbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\i_mgerojgbzt.exe
    C:\Temp\i_mgerojgbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\toljdbwtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\toljdbwtol.exe
    C:\Temp\toljdbwtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_toljdbwtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:892
- - C:\Temp\i_toljdbwtol.exe
    C:\Temp\i_toljdbwtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnlfdyvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Temp\tnlfdyvtnl.exe
    C:\Temp\tnlfdyvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnlfdyvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5900
- - C:\Temp\i_tnlfdyvtnl.exe
    C:\Temp\i_tnlfdyvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvpnlfdavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\xvpnlfdavt.exe
    C:\Temp\xvpnlfdavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvpnlfdavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5168
- - C:\Temp\i_xvpnlfdavt.exe
    C:\Temp\i_xvpnlfdavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2580
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcaxspkfcx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:260
- - C:\Temp\hcaxspkfcx.exe
    C:\Temp\hcaxspkfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcaxspkfcx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2516
- - C:\Temp\i_hcaxspkfcx.exe
    C:\Temp\i_hcaxspkfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecauspjhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1532
- - C:\Temp\ecauspjhec.exe
    C:\Temp\ecauspjhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecauspjhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Temp\i_ecauspjhec.exe
    C:\Temp\i_ecauspjhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\bztrpjhbzt.exe
    C:\Temp\bztrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1456
- - C:\Temp\i_bztrpjhbzt.exe
    C:\Temp\i_bztrpjhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjebwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3520
- - C:\Temp\rmjebwuomg.exe
    C:\Temp\rmjebwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2544
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4172
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5852
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjebwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:936
- - C:\Temp\i_rmjebwuomg.exe
    C:\Temp\i_rmjebwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\bztrljdbwt.exe
    C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3640
- - C:\Temp\i_bztrljdbwt.exe
    C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqligeyvq.exe ups_run
  2⤵
  PID:3980
- - C:\Temp\vtqligeyvq.exe
    C:\Temp\vtqligeyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqligeyvq.exe ups_ins
  2⤵
  PID:2220
- - C:\Temp\i_vtqligeyvq.exe
    C:\Temp\i_vtqligeyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlfdyvq.exe ups_run
  2⤵
  PID:1892
- - C:\Temp\yvqnlfdyvq.exe
    C:\Temp\yvqnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlfdyvq.exe ups_ins
  2⤵
  PID:5464
- - C:\Temp\i_yvqnlfdyvq.exe
    C:\Temp\i_yvqnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfdxvpn.exe ups_run
  2⤵
  PID:5776
- - C:\Temp\vpnlfdxvpn.exe
    C:\Temp\vpnlfdxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfdxvpn.exe ups_ins
  2⤵
  PID:2928
- - C:\Temp\i_vpnlfdxvpn.exe
    C:\Temp\i_vpnlfdxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  PID:4588
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  PID:5112
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfcxupnhf.exe ups_run
  2⤵
  PID:1308
- - C:\Temp\nhfcxupnhf.exe
    C:\Temp\nhfcxupnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfcxupnhf.exe ups_ins
  2⤵
  PID:4720
- - C:\Temp\i_nhfcxupnhf.exe
    C:\Temp\i_nhfcxupnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\heczurpmhb.exe ups_run
  2⤵
  PID:4564
- - C:\Temp\heczurpmhb.exe
    C:\Temp\heczurpmhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_heczurpmhb.exe ups_ins
  2⤵
  PID:4148
- - C:\Temp\i_heczurpmhb.exe
    C:\Temp\i_heczurpmhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbzwroj.exe ups_run
  2⤵
  PID:3500
- - C:\Temp\rojhbzwroj.exe
    C:\Temp\rojhbzwroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbzwroj.exe ups_ins
  2⤵
  PID:5332
- - C:\Temp\i_rojhbzwroj.exe
    C:\Temp\i_rojhbzwroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywuomgeywu.exe ups_run
  2⤵
  PID:3740
- - C:\Temp\ywuomgeywu.exe
    C:\Temp\ywuomgeywu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywuomgeywu.exe ups_ins
  2⤵
  PID:972
- - C:\Temp\i_ywuomgeywu.exe
    C:\Temp\i_ywuomgeywu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvtolgeyw.exe ups_run
  2⤵
  PID:5456
- - C:\Temp\dyvtolgeyw.exe
    C:\Temp\dyvtolgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2432

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\bwtrljgbzt.sys
C:\Temp\bwtrljgbzt.sys
1⤵
- Executes dropped EXE
PID:4504

C:\Temp\yvtolgdyvq.sys
C:\Temp\yvtolgdyvq.sys
1⤵
- Executes dropped EXE
PID:3436

C:\Temp\fdyvqnifay.sys
C:\Temp\fdyvqnifay.sys
1⤵
- Executes dropped EXE
PID:4468

C:\Temp\kidavsnlfd.sys
C:\Temp\kidavsnlfd.sys
1⤵
- Executes dropped EXE
PID:1760

C:\Temp\nkfcxvpnkf.sys
C:\Temp\nkfcxvpnkf.sys
1⤵
- Executes dropped EXE
PID:4120

C:\Temp\hcausmkecz.sys
C:\Temp\hcausmkecz.sys
1⤵
- Executes dropped EXE
PID:2424

C:\Temp\zwuomkecwu.sys
C:\Temp\zwuomkecwu.sys
1⤵
- Executes dropped EXE
PID:2460

C:\Temp\zurmjebzwu.sys
C:\Temp\zurmjebzwu.sys
1⤵
- Executes dropped EXE
PID:2220

C:\Temp\zwqomgeywr.sys
C:\Temp\zwqomgeywr.sys
1⤵
- Executes dropped EXE
PID:5684

C:\Temp\yvtolgeywq.sys
C:\Temp\yvtolgeywq.sys
1⤵
PID:5532

C:\Temp\aysqlidayv.sys
C:\Temp\aysqlidayv.sys
1⤵
PID:3364

C:\Temp\axvqnlfdxv.sys
C:\Temp\axvqnlfdxv.sys
1⤵
PID:4148

C:\Temp\fcavsnkica.sys
C:\Temp\fcavsnkica.sys
1⤵
PID:2368

C:\Temp\khfcxupnhf.sys
C:\Temp\khfcxupnhf.sys
1⤵
PID:5944

C:\Temp\eczusmkecz.sys
C:\Temp\eczusmkecz.sys
1⤵
PID:1268

C:\Temp\zxrpjhbztr.sys
C:\Temp\zxrpjhbztr.sys
1⤵
PID:5996

C:\Temp\bwtrmjhbzt.sys
C:\Temp\bwtrmjhbzt.sys
1⤵
PID:4100

C:\Temp\ebvtroigeb.sys
C:\Temp\ebvtroigeb.sys
1⤵
PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrljgbzt.sys

Path C:\Temp\bwtrljgbzt.sys
Size 141KB
SHA256 0fa7dc1b81c1e4ab5077833d4dd0fd7bc2a41a6af789290431f4ecec37ca6543
MD5 f40e3f52cc611d67ab3514a7e25cc3d3
SHA1 b4da0d72045a94d888fbdcdca2929e317f86f764
SHA512 c658b29b07ee10591330e75827ae6d47cc85a17a843111eb03078d7ecbc21d5dda43be45d335f92ab6fb4d528e9bc73fe347157851a865633c576a7685a0c37b
SSDEEP 3072:6sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:6sQmpcF8BzXfwV
TLSH
T187E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqnifay.sys

Path C:\Temp\fdyvqnifay.sys
Size 141KB
SHA256 9c707dd30e1dcf5025551ec9dd19c96c49424ca2051faea6ef4ad211029f0466
MD5 c69a7c86b86b73f3c106b343aee6805c
SHA1 e9beb357176dcefb0999031f1ea4677c1340e5d9
SHA512 ed41dbbe749212f1def9e52e356fc50cc91b569bbbe8107c1f3854f025b5a564bfc21cfc76c353edf36c07e2b5e4fce0bdb75993dd54a3f4ab1e64713a07f07b
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T1EFE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzuomhcwr.exe

Path C:\Temp\hbzuomhcwr.exe
Size 230KB
SHA256 f7fa5212d675024354347c7f90cde6ba6bb6964448ad5b2a3e16ace78deaa7cc
MD5 81060bea9f6860904338bbedf56c0b97
SHA1 1261a72e9b4b42cfaed6917b5955010bd6ddff0b
SHA512 5132abe85338c76c7cabedd46a034ef2cc80f3908cae253f57a231f92a2b77573f9d7bf3c6a8750cab3ba187fb8e6d92bf744dfee7baab120e33fe1ace0f5214
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzuomhcwr.exe

Path C:\Temp\i_hbzuomhcwr.exe
Size 230KB
SHA256 4d05764c83d39bcc1e99209dd1eb6ba52e2864b4eae19b1516546bdf12ba58bc
MD5 4d082cd0b54df2ed799a72f5f1ff124e
SHA1 3051f5635a4c665232f919d549d1811d393a6840
SHA512 9ca248b2a2bf1ae92cecb364052ccff6c745c1bf5a91bba1bb0a55c4a92115f3f1589270b7d8b4243e2ae4b5ca2da89dc917704802eed694028dc6ba11554972
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgerojgbzt.exe

Path C:\Temp\i_mgerojgbzt.exe
Size 230KB
SHA256 6fc500a37b843fad64c33d665715071874ea91bf0ae4878df41e4afb2a4c4063
MD5 3808a2c164f1621b5493f5e502e61afa
SHA1 2fc5baf7747c67f19267e0537e6385f4b9ce44f0
SHA512 e64ecf5c458eb5cd6c0bbb98d8326568483509ff6d2634087dc3fde8deb1983bd0fb8781e004049d96297103cc825373ebf42a9217ab66c49e158a00117e167f
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkicausmk.exe

Path C:\Temp\i_spkicausmk.exe
Size 230KB
SHA256 d17c23a4377e9ac13bc3198e08f89ae14294dbe0af5d224319deee08f2f26336
MD5 bd97c60b00880722b705bc39ad144abe
SHA1 7beab8b69b96c3910fefc3a567e71ac60e4f0255
SHA512 ad5f04bac42b416b9d43d50282258a1d7a44cb549c751884574ad26881b235ab3270e2969443b9bf1e03e55665d04d7f7b9ad26b4f12ff46cbb3c4d970e4d2bd
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:WghLQ0sQmpcF8BzXfwVfAI
TLSH
T124344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlfdyvtnl.exe

Path C:\Temp\i_tnlfdyvtnl.exe
Size 230KB
SHA256 2b007704afaae807774d1489acdbde9e40ee2dbd53c50422b9e0978842dd5166
MD5 70dbccb9ca1aa2131d5971090b0df090
SHA1 087023228c492c4dac9639dae538d0db9b0493af
SHA512 38990dae66895f338e00b5848279f713aecb00959527713c37573178b8a06cb0d510ee4b81b33c8b4081606530c4aa7ee37bb23e1c0c4063b9464c88f3462d83
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T14B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_toljdbwtol.exe

Path C:\Temp\i_toljdbwtol.exe
Size 230KB
SHA256 a27f44d064320efe53716d057ef191d32653402a7e7208504bd69ed9960eb34c
MD5 8664febeee7d63a93fba9f1e51606263
SHA1 e402518e9bbdcd43be7cf4ca7116eb9bb493e9e7
SHA512 13f7985e2ac41801f5aa3b605dfd5cc16229b8a280b6e831fc61e5dad201ab09c6947bc4ad289dfd1561d9a6965d3bf61d6cf7f2b3bbedd04f6ed6adfc754f10
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T160344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnlfdavt.exe

Path C:\Temp\i_xvpnlfdavt.exe
Size 230KB
SHA256 8ffa79523652f3b27973576ba16636b014054216f2125227f637a1fb9099f411
MD5 752931c4594bbcc737b7902777bb1747
SHA1 79d961724f63821bc89445c18e681338c0b910ce
SHA512 4eeee8de8b3525c51be0cc5dbde7f1b5376a63a18ba322a68ad6f47bcca3ca59c9db95522328897d5316acf6b54557b55f00df007888d5d087b09988150676c1
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T168344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kidavsnlfd.sys

Path C:\Temp\kidavsnlfd.sys
Size 141KB
SHA256 951140d92625dc4f33f3ebe68c152222c0286deafe12c978556990d2283733a6
MD5 e583ed24779d2f97bfddf9d98123e1c2
SHA1 424a2893a4c6b262e96e27b47d9acbb33d0f7bba
SHA512 112d6ae80e203214a3a6ef5a9bd904f740f38b5fd71feec7f07ae86cd6562dfd1edb499e7d4341773a7c286c49529516c5852b00ddc159edd35cc04289922851
SSDEEP 3072:rsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:rsQmpcF8BzXfwV
TLSH
T1DEE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgerojgbzt.exe

Path C:\Temp\mgerojgbzt.exe
Size 230KB
SHA256 af42aa97c66da56e93329b91542246a04ab2469ac86f426cbf39e7fd70feb17a
MD5 250535deef2d345ac69044d5401bb93d
SHA1 eddeff61269969147c09ee8d2d7e2905549a7ae6
SHA512 42f1818f915881cbafdc47ecbac1b4c346479ab881521ca5f603562e58412bf95597d9a62411d911cec371712dd84d874bc0bc1d23d216b1c57407b37b1b11a9
SSDEEP 3072:MJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:MghLQ0sQmpcF8BzXfwVfAI
TLSH
T11F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkicausmk.exe

Path C:\Temp\spkicausmk.exe
Size 230KB
SHA256 05d82cd2c2c0ee4f36bad4c66f82be295e6d46d52e605925b8c544f5208221ef
MD5 ca5a745b9c30c2b8c0c315e1a189b10d
SHA1 c014ca003c0ecc517b875fc9d6f0cd55a8d9a96c
SHA512 a4bbd3d8fe13e80e3e335e6f712937e164ef52cdd0b3aee6dabe39f75320f3f7fa61a1694f8c1b5c3d36aff8cab9f47d01aafc6d16364b849bde987e4bcce943
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:HghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvtnl.exe

Path C:\Temp\tnlfdyvtnl.exe
Size 230KB
SHA256 588b20110f9e4d3568f6c55c72f3163d0ca8a9fa51591dd74ce2ea6bb8a6f576
MD5 984f93ab890604109eb88bc2f278b38a
SHA1 c7d4f97e59431266b04e619e2147f1adaba18191
SHA512 d07082fc7f05b47d7db85a67669b8f84087dd978342097e6fca8667e7a78248f54e04f9cc3d5f65e46e3e7e882a409a54374b55b75311caeef937a0cec70b665
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T137344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toljdbwtol.exe

Path C:\Temp\toljdbwtol.exe
Size 230KB
SHA256 653e683739ef762d91c570617c259de991a316e6956e761b6b7a413d66f50531
MD5 8d3460571c7ebaf950609b95cfe83c91
SHA1 3392895f1d940cf45fb46f99453b1a722bbb9d77
SHA512 21ccdfa858a59a9f6c2c0a4f1325964846f5bfe4e4222f8919210a2a8bb5b684e0a85e7db9a4b6e96ffb0b6d22de7e871aabf47e7558ed1d3b5dc2c17e5c917b
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A7344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.sys

Path C:\Temp\urmjecwuom.sys
Size 141KB
SHA256 db068361832a625d0c7ba434585f381723558566de2f695ed34bcedc58d66499
MD5 46cab4f141c87d80fe51535c61ae4274
SHA1 ec1e04ef87d544a410908fbcc03b3f4d3dc9e617
SHA512 63e77255b915332496180e2d1bed8dbcde1f17ad13bb6849bd312ae0f7bab6adeab74375a43ec0a6b3a6d82f773da6cc3e2005cf94bc053c07b81fc5e3adc7c1
SSDEEP 3072:ZsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ZsQmpcF8BzXfwV
TLSH
T1D9E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnlfdavt.exe

Path C:\Temp\xvpnlfdavt.exe
Size 230KB
SHA256 7a37a4e71b3b1a3b703b8e41f850e99a16a566b4c1c0b3c169c456501ebed99e
MD5 60d127f1b38675be43f7f37b85cc1585
SHA1 7ccad832cef639fa5742b5cb8566b454caaac286
SHA512 f0d9f80a0eaa1fe53ec4afaca3d780562f1813bf75329628b197ef0c2b13d90d4437c264b5affb37a808834170926141608b15239105b27153ae809f3791478b
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DF344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A83F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtolgdyvq.sys

Path C:\Temp\yvtolgdyvq.sys
Size 141KB
SHA256 ebd931c3c609763209f427eda5023a7aa967fe3eb7f1a8a976707b6247aaa36e
MD5 da2e857c014c6e6a574937803d0ddc2d
SHA1 5fc3f042f47e7c3c566fd6b91be11464ba3dab2e
SHA512 67b8aa8b9b33ca31b8705160955c15d8926dcde49f5f4b7e1b9da9c09fac21098dee46f04662780aa55c6b1559400b24689e28f5e2bcf64358b2612962f1d9e4
SSDEEP 3072:WsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:WsQmpcF8BzXfwV
TLSH
T1A3E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 57877cd2f250b63d14124695cd0fd16aaa733b691760cb0a29326f7c22cda58c
MD5 1ef278a96c6910fc1b78ad41082c8c4d
SHA1 8dd61f29135ba3851d177164adf91ae6ec615510
SHA512 bfacedb81a36e3de76b1f6e66d4c617aad4cae8a9e19c919aee3679712dd18e433e6eb34efcda8cdd9ab07b5948ac5fbdb1cc82a86901b571e44629141e33652
TLSH
T19A51B795437709C1D73347B2D9F09B663EFAAAEF09472FCD4C7435B4A8A6F685002560
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598052.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598052.TMP
Size 2KB
SHA256 4f2b345cffd3b9a468f1b01d5e0ef6b77ae0fdeb1d30c22c99f383622074eeb6
MD5 ff085317e8c0cc623da74741973bf169
SHA1 d7880a5a06f54b943047e7cfb6fdc9cdc32c724e
SHA512 60a202dccb2cc01aa6d4d21d6808d3031d83d9f1546ac9ac0de32d9b15ce894fb08df1b968da1fa372c9db5c154996270e47f09ef3b032b0bb5ebdea63ffd3c9
TLSH
T10F51B695437709C1D73347B2D9F09B6A3EFAAAEF09472FCD4C7835B4A8A6F685002560
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0de14766ecf569debcb083d783a2b0c0e671f287f6279b0c8f42efaf3722f998
MD5 8593b0a53b7914263b30dcdef1b90f93
SHA1 8997485565d7a39a5523036e8a0474ccefe70638
SHA512 76a8d930b73fc0f522bd8bfb4d3b984c9b1ceb214e61756b57147f410254e98fa46e9b678bd41d49f8096542c615a88243e935ef4c66fd9a13058064eff01a57
TLSH
T10941CEF3C3E8966E890156F0AB147E2BCE1D0915432C3D5AC9E4EF5BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cb7c2d793225db0ace0ad72690cf6716a94f8a2b3185d533596ecbe6e8440aa
MD5 7d484cf7b8a60fd2baed525492dbb062
SHA1 e55e8490abefc217d9bf0cb61c7334f0db969db3
SHA512 a3f4ed0c0bb9dae8b2261ad5614024bdc750343db23358c0a179b6bf41cfd0238d777f77a1c000a58a1c48c0fbed0c4d98ce2fd67f9aa129159dc189da7af9f5
SSDEEP 192:sxRV7ROgCO/fSVsClR8RKCA94/NzoA8pi/g6+WNIYD986SwG1W1EIgtJ:sxRxU3O/fysCb8RZ8Vi/5ISSl3
TLSH
T1F732B6166A28AD3B5CCBE21DBB15BF93D2F9503361D02E18A7FCC60C04E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4da41c2c7dd608f7ca004985230245d1e57a65097399246a26e1f55bf0970a41
MD5 5f025270efc8d60837ee1bbde74a1f08
SHA1 00d8849967c36fa6d095a7737eca5e3c31d24abe
SHA512 c9c40f1783536707ccfd0abfeb9678b92cfdb7c20a0413b04f1d4e6597c717ff9f4156842ced823d33718aaef7365341d218c671134be3c4165127d66013cb72
SSDEEP 192:sxRM7ROgCO/fSVsAlR8RKCA94/NzoA8pi/g6+WNIYD986SwG1W1EIgDBJ:sxRqU3O/fysAb8RZ8Vi/5ISSl/
TLSH
T11832B6166A289D3B5CCBE21DBB55BF93D6F9503361D02E58A7FC960C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f5c8f43458e4a3507e8bdc055ef7babe4b05aa7fd60a585bc4c1c6b5e3f3e126
MD5 5657f95afc5bf0c6cc58acda3eec7b10
SHA1 3deb4e54e6b001c8966ad343e957055237c92ce5
SHA512 39fb4631324f3a910507800176c2c2030d6ab5652eab455bda4e0e4e752bd59f2b349cfc85f38473238f3bc6b5cf79a2910910200477f9630063d8d02f5369a0
SSDEEP 192:sxRM7ROgCO/fSVsAlRiR9ZrQHU6jzoA8p9W/g6+WNCQIk/YD9ms6SwG1W1EIgDzJ:sxRqU3O/fysAbiRze40/57/HSlJ
TLSH
T19442D65669289D7B5CC7E219BB65BF93E2F9503261D12E08A7FCCB0C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 28a5ba8c771385282044be3689b1307722b1d1e0609f8fad0b501818791f350d
MD5 9a3f1ed493310b2b0693a4afda56d9aa
SHA1 fcfaf36a89af8be8e704c371aa2f936c170e4b4d
SHA512 863262abb5c7863056b7759d633e0e6838bc6c4a69a71c3369cb4fdd28cf739bf6993214c866c33eb861cc89a88ec6a01c112d3b890764130b410ca743648f0c
SSDEEP 192:sxRM7ROgCO/fSVsAlRiRKCA94/NzoA8p9q/g6+WNIYD9G6SwG1W1EIgDzJ:sxRqU3O/fysAbiRZ8Vw/5IgSlJ
TLSH
T1AC32A61669289D3B5CCBE21DBB55BF93E2F9503261912E58A7FCD70C04E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9ec14fe20cebc888139a6c123d17d7583eb44fadcfb6f06cb76cc12c39c3c10f
MD5 8220f0273ce3c56d7ccdd4d4266bc891
SHA1 473956698d7637939ad9b1bfd684c2568d86fdbb
SHA512 743bbc49998196b7ac08c8ee791fee878a82b8034dd5a742624a7a2104ed346837ec2d789700aef410c58669374b20c98cac324d1ec8f9edab8d09d8cc159cc1
SSDEEP 768:azfW/L7pLuL7J0Wg/XfHf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOc16YropiBYxk:azfW/dE7J0Wg/XfHfu1jazy6jpiR
TLSH
T1A9C2EA7B240CCE7F4F800ADDAD197EDB6DA802CB969CCD5047FE951C02C6BEA52164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2105b6ef-fde0-4427-92a8-9e626c8e31c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2105b6ef-fde0-4427-92a8-9e626c8e31c7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 5abf846c75ea7ab0fa7c5f03203107575bd039d01f2331496c6fb444387e206e
MD5 b39f4b6f9674c29a9d24c104ab7d3536
SHA1 2635b1d3d5491aef9a2e1ede76850c6e5f6f8b03
SHA512 b6baebe6516f886a17c21061e0be256bce8f7e09d209005f681e5464d0d2582f82d71f444b6c3d3ac108e22d3039b68a4e07a529801d27aab4bfb9c8eb04ca15
SSDEEP 384:nntNn/s3n9SX38NsOZT35+UY2WZlf8hyEGunG77njy2rEoajo4cdR8eHhVODjYPS:nj+9M36TYHi0XBrEnjN3Gac1FyDh
TLSH
T105E2AF3069659D734CEAD389B6433782AFF016A744C50EA4DADCBB0D15C76ED270B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 32051c1477e17894a478b8cc1b3f4511db11fb8159170621b775440977dfad1e
MD5 09127e1e5a9fa332db986e46574d3e14
SHA1 b5a8fa3e99cebe670e157dc03285e5c3655b1146
SHA512 9e6d15c4bcf687cf3cf7a244c64286672d377e09cd92f8c309de3459f2a7528bd4f9f0afa304f46753fd43d092652148d4c54636ba9c999f81a249f3ac858e16
SSDEEP 768:rrv+4UNbdS3Imi0XSrEnjN3Gac1ZGeVH1SCz:rbsbg3fCQnjMapEH1V
TLSH
T1D203CF3269A88EB39CEBE385714376437FB4125385940BA0CADD7B0D12DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 97ac243d792c74ff9b4db79d0d4aef87bdf4ddd15216459e24a83e8e18a6e469
MD5 19ec395b18bd2d9e78f48caad054a0ec
SHA1 838065d74a011d82301decb6bbac210bf930292c
SHA512 0cdb7923964ce782aaaf68e2181dd5e12cb6a8eacd2f61c42076ea8dfb4ef208430db22d7a1b99c75c7ce9df4d4f1c53c52ff7204adba1aae150229bd55fd3d8
SSDEEP 768:/rv+4UNbdS3aRYHi0XqrEnjN3Gac1FyeVH1SCx:/bsbg3/6QnjMaJEH1X
TLSH
T1D113BF3169B88E735CEBE345B18376837FB416A784840FA4D5D9AB0D06875ED230F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 7363c65659e2c30850e3a280743797cdaad44a59856cd94e438d8c2b5fc0d0a3
MD5 308991ad0437c91292d5155a0c9e3365
SHA1 3c0a46d2c716bb332103d9a4d9a9bdca323e7bcf
SHA512 3a354065f438e434bd31a670f721a7dd14de958191c900cc4cff81e6cf458780ea8374f29574b79b9455798dbee0c77ad2e6fef5841b1dd9554f3e1cb616b511
SSDEEP 384:nriF1tNn/s3n9St38Nk8TUNTUlIlOZT35+hY24Hfw5yEGunG77nky2rEoajo4cdW:GF1j+9O3jwgW6Y4sX4rEnjN3Gac1FyDh
TLSH
T19E1308F598D78977D8EE8387A73E6E429ABCC1A374844994B7C85D0CDC821BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 556298d4be909dd3fd112ba2a9f3425eba2f93344af9b41aed70579c7cf6b6ab
MD5 f8bff38803ac4432b22d323ff9539808
SHA1 1a3646f198b2196049546ac6e555fb15224482c1
SHA512 ea8174f7be7ed254344c3567aa7cec7a977a4f636aac3d1ba20e9896c4f73657b1cf09192dcaf5f7c9449ce46f61052757ef5f8dd903725efc7e9ae947e5a110
SSDEEP 384:zNsrv+89zHqlDNP9oidS38NsMZT35+UY2WZlf8hyEGunG77njy2rEoajo4cdR8el:+rv+4UNbdS3wTYHi0XBrEnjN3Gac1FyU
TLSH
T15103BF3079689EB38CEBE285B14376837FB415A344C50EA4DAD9AB0C05875E9270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 41c4f0e1c4d4e16e991bc0db3bc2fdaf7d99143da17944049e3c0d2ce5a516d4
MD5 1d185ebb02d3095fd7818b99196f670e
SHA1 9c1752c51e02d869b0942ea11fa45054466450cc
SHA512 7c12248677cf6431d8f1650a25743a9d1c99212e18bb20e7f34b2743213bae67f8bf4ce1b6149a28cfe6fb3240a1a1df98db5789c1b1b0a0809019eb2689bce8
SSDEEP 768:Xrv+4UNbdS3V0i0XbrEnjN3Gac1FyeVH1SC8:Xbsbg3crQnjMaJEH12
TLSH
T18503CF3169B89E735CEBE385B14376837FB412A384840FA4D9C9AB0D06875EC230F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

526b1894-aae8-4c47-9a40-84703e6a2771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\526b1894-aae8-4c47-9a40-84703e6a2771.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2060_1623085280\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1268-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1760-267-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2220-394-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2220-380-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2368-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2424-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2460-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3364-434-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3436-226-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-149-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4100-511-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4120-317-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4148-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4468-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-196-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5532-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5684-393-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6072-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download