systex | 261650ac738db2d7f3028e6a0be512cad96ad2c00e8374c1427c55d543dc507a

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260717-3efbbagz2l
SHA256 261650ac738db2d7f3028e6a0be512cad96ad2c00e8374c1427c55d543dc507a
MD5 31b0356ada1ffa02e115531f88450d02
SHA1 0f4aa7e2c2abdd25de46985ef4a8edb8c7e3d7dc
SHA512 32d0f769160056e99fd4ec56d42ee131724f5ac2e73a62013ab0cdf2ea951d5d289bca07dfb73f0180c3d85b34661ee59174e672c292312046b6d0e4f6cabbe8
SSDEEP 3072:tJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:tghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
1744	CP.exe
2920	oidysqldyq.exe
2428	CP.exe
2264	CP.exe
5848	i_oidysqldyq.exe
3500	qnkidavtnl.sys
1664	CP.exe
2828	kifaysqkid.exe
1240	CP.exe
2496	CP.exe
5280	i_kifaysqkid.exe
1836	smkicausnk.sys
5936	CP.exe
1968	snkfdxvpnh.exe
5920	CP.exe
4980	CP.exe
572	i_snkfdxvpnh.exe
1596	usnkfdxupm.sys
2584	CP.exe
6024	eczurpnhec.exe
5132	CP.exe
5676	CP.exe
6136	i_eczurpnhec.exe
3436	xusmjhczup.sys
5128	CP.exe
5152	rpmhfzxrpj.exe
4664	CP.exe
6100	CP.exe
5884	i_rpmhfzxrpj.exe
3740	trpjhezxro.sys
3196	CP.exe
3040	wrpjebztrm.exe
3892	CP.exe
4120	CP.exe
1288	i_wrpjebztrm.exe
2288	omjebwtrlj.sys
3884	CP.exe
5528	urljdbywro.exe
3292	CP.exe
3768	CP.exe
1120	i_urljdbywro.exe
2876	jgeywqojge.sys
2916	CP.exe
5324	tqljdbvtnl.exe
5596	CP.exe
3920	CP.exe
1584	i_tqljdbvtnl.exe
3948	gdywtoljda.sys
4964	CP.exe
2064	gaytqljdbv.exe
296	CP.exe
824	CP.exe
4576	i_gaytqljdbv.exe
4400	yvqnigaysq.sys
1452	CP.exe
468	vqnidavsnl.exe
5928	CP.exe
4176	CP.exe
2236	i_vqnidavsnl.exe
2988	qkicausnkf.sys
5340	CP.exe
1096	hfdxvpnlfd.exe
4872	CP.exe
5536	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1756162402\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1097409813\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_480966485\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1601937042\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1097409813\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_480966485\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1601937042\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1601937042\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1648_1601937042\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmjhbzxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidysqldyq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snkfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnidavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kigaxspnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urljdbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urljdbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurpnhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdxvpnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kifaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidysqldyq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdxvpnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaysql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kigaxspnic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurpnhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjebztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfzxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmjhbzxr.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1568	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4168	ipconfig.exe
4320	ipconfig.exe
3544	ipconfig.exe
4136	ipconfig.exe
5260	ipconfig.exe
5100	ipconfig.exe
988	ipconfig.exe
2984	ipconfig.exe
5808	ipconfig.exe
2912	ipconfig.exe
5036	ipconfig.exe
5460	ipconfig.exe
1500	ipconfig.exe
2204	ipconfig.exe
5528	ipconfig.exe
5444	ipconfig.exe
4832	ipconfig.exe
5876	ipconfig.exe
3604	ipconfig.exe
3436	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288043319799616"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{2C481696-6CC4-440A-B3FC-03B0AF1E2D54}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe
2920	oidysqldyq.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe
1648	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5848	i_oidysqldyq.exe
Token: SeDebugPrivilege	5280	i_kifaysqkid.exe
Token: SeDebugPrivilege	572	i_snkfdxvpnh.exe
Token: SeDebugPrivilege	6136	i_eczurpnhec.exe
Token: SeDebugPrivilege	5884	i_rpmhfzxrpj.exe
Token: SeDebugPrivilege	1288	i_wrpjebztrm.exe
Token: SeDebugPrivilege	1120	i_urljdbywro.exe
Token: SeDebugPrivilege	1584	i_tqljdbvtnl.exe
Token: SeDebugPrivilege	4576	i_gaytqljdbv.exe
Token: SeDebugPrivilege	2236	i_vqnidavsnl.exe
Token: SeDebugPrivilege	1596	i_hfdxvpnlfd.exe
Token: SeDebugPrivilege	1068	i_pnhfzxspkh.exe
Token: SeDebugPrivilege	252	i_xupnkecxup.exe
Token: SeDebugPrivilege	948	i_wurmjhbzxr.exe
Token: SeDebugPrivilege	6016	i_hbztrmjhbz.exe
Token: SeDebugPrivilege	2940	i_jebwtolgey.exe
Token: SeDebugPrivilege	2320	i_lgdbvtolgd.exe
Token: SeDebugPrivilege	2572	i_wqoigaysql.exe
Token: SeDebugPrivilege	3944	i_kigaxspnic.exe
Token: SeDebugPrivilege	5884	i_kicaxsqkic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5052	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4804 wrote to memory of 2100	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5052 wrote to memory of 5448	5052	iexplore.exe	91
PID 2100 wrote to memory of 1648	2100	iexplore.exe	92
PID 1648 wrote to memory of 4372	1648	msedge.exe	93
PID 1648 wrote to memory of 1568	1648	msedge.exe	94
PID 1648 wrote to memory of 5668	1648	msedge.exe	95
PID 1648 wrote to memory of 5668	1648	msedge.exe	95
PID 1648 wrote to memory of 5668	1648	msedge.exe	95
PID 1648 wrote to memory of 4544	1648	msedge.exe	96
PID 1648 wrote to memory of 4544	1648	msedge.exe	96
PID 1648 wrote to memory of 5092	1648	msedge.exe	98
PID 1648 wrote to memory of 5488	1648	msedge.exe	99
PID 1648 wrote to memory of 5092	1648	msedge.exe	98
PID 1648 wrote to memory of 5092	1648	msedge.exe	98
PID 1648 wrote to memory of 5488	1648	msedge.exe	99
PID 1648 wrote to memory of 5488	1648	msedge.exe	99
PID 1648 wrote to memory of 6052	1648	msedge.exe	100
PID 1648 wrote to memory of 5152	1648	msedge.exe	101
PID 1648 wrote to memory of 4896	1648	msedge.exe	102
PID 1648 wrote to memory of 6052	1648	msedge.exe	100
PID 1648 wrote to memory of 6052	1648	msedge.exe	100
PID 1648 wrote to memory of 5152	1648	msedge.exe	101
PID 1648 wrote to memory of 5152	1648	msedge.exe	101
PID 1648 wrote to memory of 4896	1648	msedge.exe	102
PID 1648 wrote to memory of 4896	1648	msedge.exe	102
PID 1648 wrote to memory of 808	1648	msedge.exe	103
PID 1648 wrote to memory of 808	1648	msedge.exe	103
PID 4804 wrote to memory of 1744	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2920 wrote to memory of 2428	2920	oidysqldyq.exe	108
PID 1648 wrote to memory of 5604	1648	msedge.exe	111
PID 1648 wrote to memory of 5604	1648	msedge.exe	111
PID 1648 wrote to memory of 4644	1648	msedge.exe	112
PID 1648 wrote to memory of 4644	1648	msedge.exe	112
PID 1648 wrote to memory of 5704	1648	msedge.exe	114
PID 1648 wrote to memory of 3488	1648	msedge.exe	115
PID 1648 wrote to memory of 3488	1648	msedge.exe	115
PID 1648 wrote to memory of 1780	1648	msedge.exe	116
PID 1648 wrote to memory of 1780	1648	msedge.exe	116
PID 4804 wrote to memory of 2264	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4804 wrote to memory of 1664	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 1648 wrote to memory of 5432	1648	msedge.exe	126
PID 1648 wrote to memory of 5432	1648	msedge.exe	126
PID 1648 wrote to memory of 5432	1648	msedge.exe	126
PID 2828 wrote to memory of 1240	2828	kifaysqkid.exe	127
PID 1648 wrote to memory of 4788	1648	msedge.exe	130
PID 1648 wrote to memory of 4788	1648	msedge.exe	130
PID 1648 wrote to memory of 4788	1648	msedge.exe	130
PID 4804 wrote to memory of 2496	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4804 wrote to memory of 5936	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	135
PID 1968 wrote to memory of 5920	1968	snkfdxvpnh.exe	137
PID 4804 wrote to memory of 4980	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 4804 wrote to memory of 2584	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 6024 wrote to memory of 5132	6024	eczurpnhec.exe	146
PID 4804 wrote to memory of 5676	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	149
PID 1648 wrote to memory of 1052	1648	msedge.exe	152
PID 1648 wrote to memory of 4912	1648	msedge.exe	153
PID 1648 wrote to memory of 4836	1648	msedge.exe	154
PID 4804 wrote to memory of 5128	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 5152 wrote to memory of 4664	5152	rpmhfzxrpj.exe	159
PID 4804 wrote to memory of 6100	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 4804 wrote to memory of 3196	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 3040 wrote to memory of 3892	3040	wrpjebztrm.exe	168
PID 4804 wrote to memory of 4120	4804	2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe	171

C:\Users\Admin\AppData\Local\Temp\2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_31b0356ada1ffa02e115531f88450d02_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:5448
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffc29dac188,0x7ffc29dac194,0x7ffc29dac1a0
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,16947918715900131968,11700671244035311057,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,2334534012869573179,1313980212157698294,262144 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:2
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2764,i,5643241714047092078,6751142294881979450,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:13
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,2154137689864675856,7745796813471248403,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3520,i,3854539455471485573,15054495980443483552,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4432,i,16443760917433288196,5877519904779441833,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,2488468458079595993,17701597128041380445,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,12977634344260695579,15064598704804207077,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16232567199527087720,10479729357835337510,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,2876187005689449073,2104817485107260881,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,2314633797170315538,12278666340649246967,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:14
      4⤵
      PID:4644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,18153122962991877395,14159123318494583762,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,18153122962991877395,14159123318494583762,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,15250465191939480343,11544786648150842016,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,11290422546084449967,12420156686764737585,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6836,i,7370281130262088344,4544795315031767390,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
      4⤵
      PID:5432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5212,i,360377887728123935,5515647701301711979,2097152 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,1556818297504811586,13943334983688743600,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,12772510667905757716,9770940146811873165,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:4912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,12250847039786327872,4639355138423427396,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1468,i,13320393081215162875,1228312128068077561,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,15770310079507429898,907815551804429197,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
      4⤵
      PID:812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,6691979466857779455,1554112106929523285,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,1178718702618539817,13355371379963487652,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5568,i,7085097122007039033,12444042625764409116,262144 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:10
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3252,i,9887907968988324978,10504421912048018860,524288 --field-trial-handle=2460,i,16273916613392386622,13487356479916349346,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:14
      4⤵
      PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidysqldyq.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1744
- - C:\Temp\oidysqldyq.exe
    C:\Temp\oidysqldyq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2428
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidysqldyq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2264
- - C:\Temp\i_oidysqldyq.exe
    C:\Temp\i_oidysqldyq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kifaysqkid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1664
- - C:\Temp\kifaysqkid.exe
    C:\Temp\kifaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kifaysqkid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2496
- - C:\Temp\i_kifaysqkid.exe
    C:\Temp\i_kifaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5280
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snkfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5936
- - C:\Temp\snkfdxvpnh.exe
    C:\Temp\snkfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snkfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4980
- - C:\Temp\i_snkfdxvpnh.exe
    C:\Temp\i_snkfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eczurpnhec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2584
- - C:\Temp\eczurpnhec.exe
    C:\Temp\eczurpnhec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eczurpnhec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5676
- - C:\Temp\i_eczurpnhec.exe
    C:\Temp\i_eczurpnhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpmhfzxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5128
- - C:\Temp\rpmhfzxrpj.exe
    C:\Temp\rpmhfzxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4664
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpmhfzxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Temp\i_rpmhfzxrpj.exe
    C:\Temp\i_rpmhfzxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjebztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\wrpjebztrm.exe
    C:\Temp\wrpjebztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjebztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4120
- - C:\Temp\i_wrpjebztrm.exe
    C:\Temp\i_wrpjebztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urljdbywro.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3884
- - C:\Temp\urljdbywro.exe
    C:\Temp\urljdbywro.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5876
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urljdbywro.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3768
- - C:\Temp\i_urljdbywro.exe
    C:\Temp\i_urljdbywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2916
- - C:\Temp\tqljdbvtnl.exe
    C:\Temp\tqljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5324
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3920
- - C:\Temp\i_tqljdbvtnl.exe
    C:\Temp\i_tqljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4964
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:824
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnidavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1452
- - C:\Temp\vqnidavsnl.exe
    C:\Temp\vqnidavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnidavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4176
- - C:\Temp\i_vqnidavsnl.exe
    C:\Temp\i_vqnidavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdxvpnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5340
- - C:\Temp\hfdxvpnlfd.exe
    C:\Temp\hfdxvpnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdxvpnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5536
- - C:\Temp\i_hfdxvpnlfd.exe
    C:\Temp\i_hfdxvpnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspkh.exe ups_run
  2⤵
  PID:4224
- - C:\Temp\pnhfzxspkh.exe
    C:\Temp\pnhfzxspkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4744
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspkh.exe ups_ins
  2⤵
  PID:6052
- - C:\Temp\i_pnhfzxspkh.exe
    C:\Temp\i_pnhfzxspkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xupnkecxup.exe ups_run
  2⤵
  PID:2072
- - C:\Temp\xupnkecxup.exe
    C:\Temp\xupnkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xupnkecxup.exe ups_ins
  2⤵
  PID:2716
- - C:\Temp\i_xupnkecxup.exe
    C:\Temp\i_xupnkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wurmjhbzxr.exe ups_run
  2⤵
  PID:4344
- - C:\Temp\wurmjhbzxr.exe
    C:\Temp\wurmjhbzxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wurmjhbzxr.exe ups_ins
  2⤵
  PID:2068
- - C:\Temp\i_wurmjhbzxr.exe
    C:\Temp\i_wurmjhbzxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjhbz.exe ups_run
  2⤵
  PID:4576
- - C:\Temp\hbztrmjhbz.exe
    C:\Temp\hbztrmjhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1860
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjhbz.exe ups_ins
  2⤵
  PID:3148
- - C:\Temp\i_hbztrmjhbz.exe
    C:\Temp\i_hbztrmjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwtolgey.exe ups_run
  2⤵
  PID:4904
- - C:\Temp\jebwtolgey.exe
    C:\Temp\jebwtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwtolgey.exe ups_ins
  2⤵
  PID:3448
- - C:\Temp\i_jebwtolgey.exe
    C:\Temp\i_jebwtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgdbvtolgd.exe ups_run
  2⤵
  PID:1812
- - C:\Temp\lgdbvtolgd.exe
    C:\Temp\lgdbvtolgd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgdbvtolgd.exe ups_ins
  2⤵
  PID:2144
- - C:\Temp\i_lgdbvtolgd.exe
    C:\Temp\i_lgdbvtolgd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigaysql.exe ups_run
  2⤵
  PID:5772
- - C:\Temp\wqoigaysql.exe
    C:\Temp\wqoigaysql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigaysql.exe ups_ins
  2⤵
  PID:1980
- - C:\Temp\i_wqoigaysql.exe
    C:\Temp\i_wqoigaysql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kigaxspnic.exe ups_run
  2⤵
  PID:5356
- - C:\Temp\kigaxspnic.exe
    C:\Temp\kigaxspnic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1672
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kigaxspnic.exe ups_ins
  2⤵
  PID:3916
- - C:\Temp\i_kigaxspnic.exe
    C:\Temp\i_kigaxspnic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxsqkic.exe ups_run
  2⤵
  PID:2484
- - C:\Temp\kicaxsqkic.exe
    C:\Temp\kicaxsqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxsqkic.exe ups_ins
  2⤵
  PID:4940
- - C:\Temp\i_kicaxsqkic.exe
    C:\Temp\i_kicaxsqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3848

C:\Temp\qnkidavtnl.sys
C:\Temp\qnkidavtnl.sys
1⤵
- Executes dropped EXE
PID:3500

C:\Temp\smkicausnk.sys
C:\Temp\smkicausnk.sys
1⤵
- Executes dropped EXE
PID:1836

C:\Temp\usnkfdxupm.sys
C:\Temp\usnkfdxupm.sys
1⤵
- Executes dropped EXE
PID:1596

C:\Temp\xusmjhczup.sys
C:\Temp\xusmjhczup.sys
1⤵
- Executes dropped EXE
PID:3436

C:\Temp\trpjhezxro.sys
C:\Temp\trpjhezxro.sys
1⤵
- Executes dropped EXE
PID:3740

C:\Temp\omjebwtrlj.sys
C:\Temp\omjebwtrlj.sys
1⤵
- Executes dropped EXE
PID:2288

C:\Temp\jgeywqojge.sys
C:\Temp\jgeywqojge.sys
1⤵
- Executes dropped EXE
PID:2876

C:\Temp\gdywtoljda.sys
C:\Temp\gdywtoljda.sys
1⤵
- Executes dropped EXE
PID:3948

C:\Temp\yvqnigaysq.sys
C:\Temp\yvqnigaysq.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\qkicausnkf.sys
C:\Temp\qkicausnkf.sys
1⤵
- Executes dropped EXE
PID:2988

C:\Temp\uspkhfcaus.sys
C:\Temp\uspkhfcaus.sys
1⤵
PID:4400

C:\Temp\ausmkicaus.sys
C:\Temp\ausmkicaus.sys
1⤵
PID:2492

C:\Temp\wuomkeczus.sys
C:\Temp\wuomkeczus.sys
1⤵
PID:3904

C:\Temp\hezwrojhbz.sys
C:\Temp\hezwrojhbz.sys
1⤵
PID:5828

C:\Temp\omgezwqomg.sys
C:\Temp\omgezwqomg.sys
1⤵
PID:660

C:\Temp\omgeyvtolg.sys
C:\Temp\omgeyvtolg.sys
1⤵
PID:4876

C:\Temp\dbvqoigayv.sys
C:\Temp\dbvqoigayv.sys
1⤵
PID:6104

C:\Temp\nifayvpnlf.sys
C:\Temp\nifayvpnlf.sys
1⤵
PID:4796

C:\Temp\vpnhfaxvpn.sys
C:\Temp\vpnhfaxvpn.sys
1⤵
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eczurpnhec.exe

Path C:\Temp\eczurpnhec.exe
Size 230KB
SHA256 4f349034aeddb07c1771da93997ce3dfcae95b20063e6604c65f5a98e4dfec5b
MD5 be180abe12b127bab18693cce76832ec
SHA1 9de0d17523fa1fe12b1ab37dff8c1bc07d1348e0
SHA512 e7a10024d08a7304af2774874d68f0372e34f3f7df996ad61ecb7717d5cf9e0fa4b369855b58273557e3774a86a2482c2f406f027e44096c894c8f0f07be87cb
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eczurpnhec.exe

Path C:\Temp\i_eczurpnhec.exe
Size 230KB
SHA256 21c7dab61fd539b3ce8fe2a2744bb680da0cb26f3ec6b157280cd6ccb862e785
MD5 46deccba41fa29cfbc1523a798682412
SHA1 e88e689cb0be5485f9fcc504dcc749ae1ad90da0
SHA512 11b53211b87b06253b04fbffa98eca0a7bc54a0d0ecfaa9c5a6f8a5174985259a3e544b01fd42611f5b2d2970d942273c379b92905437877ae96fee272ba5721
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T194344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kifaysqkid.exe

Path C:\Temp\i_kifaysqkid.exe
Size 230KB
SHA256 1c1ba468bda7016df11735ece1b04731648ac83cb698fc167f185ed290c3d0aa
MD5 e94bb64e1035fccffcba0d0364a24058
SHA1 d8d75c256b9c0a98b253b6e4f7ca058ce7647a77
SHA512 919835447b77a08bfad1abdefb7033775b366b807a3a9956b5a1734ea8d681d2cabfab1fbdb9066c421b92f7d6be26c5ea627e8a364b9fd6f0d29d564d781e97
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oidysqldyq.exe

Path C:\Temp\i_oidysqldyq.exe
Size 230KB
SHA256 4e5162249a6bfdf691838806634fe80414d9678d114024573e8dec2266d364ee
MD5 d2f356f804ffc117fb718f5ccfd25eaf
SHA1 004895c446a646fdddcabfa9754704ae8f267e29
SHA512 362f2d43db6b1b70bc7cb7ff78d51e4a3dabe7a34bd6d57df37a3bc69b9b95685ef7b478b4e8d05830891299e732b58ae593c92e25e8a2f968f5ae74197fa3f6
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T174344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpmhfzxrpj.exe

Path C:\Temp\i_rpmhfzxrpj.exe
Size 230KB
SHA256 fbccc08f1283717cc910c4a47f4e287f201f67a1fdc85554c89101b9fe1c3824
MD5 3d8459930896396c70b03d13b4878e9b
SHA1 be46b0d99ac08805fd530ab209ba3f6e34b688ec
SHA512 28ce8a5bf6c67408ad172d8cdfdd8024b6e5ad6a7fb748b017bb098eee6c3fb6e75bfecec72a790675fb6cffbc00f844e9bb4f9b6565a35d247ea7d1f6abd727
SSDEEP 3072:IqJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9E:FghLQ0sQmpcF8BzXfwVfAI
TLSH
T116344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snkfdxvpnh.exe

Path C:\Temp\i_snkfdxvpnh.exe
Size 230KB
SHA256 06a45af8ba87e0309ffb876587c8efa7e47c3aca4c5d21c54f2c15056d3345c7
MD5 de817b066151cb79d8be56acef4b48d5
SHA1 817ae7c2bc13e297ead1118d42c7f001fc08be88
SHA512 b3aadf9e67bac14d17ad26af6295acc98aa8937ab45835825cf89a0b2932e334ad23f93c5d35b8cf0260681be2c3d53ec1a78ac455ddef79eefa564001ceaa38
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T138344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjebztrm.exe

Path C:\Temp\i_wrpjebztrm.exe
Size 230KB
SHA256 81e38743069507b5415b24ba0e10685b5ca4929917eccdb70d87809830c0d296
MD5 a14a5a70c1d717cfb779df69890b3a1c
SHA1 06bb191230fb9608ba34ed00ea4241ab25b8bcd4
SHA512 16fd32392adce1b89815583b9a51b58ab59b278c9e5043924a5bb3f935f700d93adc393109b2cd77ab7473fd2d7c47af6271df8bcb72eff3617fd0c7107bfa95
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifaysqkid.exe

Path C:\Temp\kifaysqkid.exe
Size 230KB
SHA256 1d9c678d558842e184bfa0bb0f57c1adc4f0ae1b38eb82f6236d26ab694fdc43
MD5 6e967ba389e90176adcacc1c6bb71e06
SHA1 80f4fa956aae021d5c99bcff1b7be2ab767ea180
SHA512 73bb28af753ba3ee4f0523e468665718a888a3130cbe54f88856e7068ca4bc5d6690a2fe912ac20d7259bad29ecae56711cfc0294da2147b00fa3a804fc65aff
SSDEEP 3072:sJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:sghLQ0sQmpcF8BzXfwVfAI
TLSH
T114344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F7A5E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidysqldyq.exe

Path C:\Temp\oidysqldyq.exe
Size 230KB
SHA256 7af9b15bee261f4197d42cfaa1492d981bed68fc30ea625e71a82a74b81759a7
MD5 bdb619e88650091eee7437fd5ca934e9
SHA1 7f28e223e438b57e19b080d358d2e02990f05b92
SHA512 5c5d59543f25e7e851cb6a86efb2a746e39160ec40c405c052b23c02f7f1b9a63de9b7d2b2e5e07507c0623ec49b4e76a6abed249040cd04e8c91b2737ddf7cc
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnkidavtnl.sys

Path C:\Temp\qnkidavtnl.sys
Size 141KB
SHA256 e0450e5d700d012ed6d0365a6c91f1984fe7a7513cb85cb067f827571dfccb74
MD5 2abc7446e5b5fe76d6951108e9a79192
SHA1 e05da317206996056ad079527c498d2a0f971808
SHA512 b4751c230781d68e7ff1bcf3222db6384048f410977be205696992589a46a55cf4f207363f65af691bea12c216b81d00c6378f96373de69216566ebb86a20d0f
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T1B2E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpmhfzxrpj.exe

Path C:\Temp\rpmhfzxrpj.exe
Size 230KB
SHA256 f19995b09bddaaaa871fcfb24f0a08afcaca4278edb0e1e9a44881e6075e4d40
MD5 5835867941971a287cfa752812f9a2d9
SHA1 5c1a9fcff97107784102374320db29f98c1de80d
SHA512 6c61804b8dbefc048638607600aa492ace7910765bfd1972f3bebc04f4c525b0ad357d21097c704fd17ce6ee190aeddff08ad01ed89422c85e8720864b5a00b8
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkicausnk.sys

Path C:\Temp\smkicausnk.sys
Size 141KB
SHA256 0b989ccdc5c427d0b8add86117a7d10dadf284824553224259e031e5430df78f
MD5 32abf527727332cd58ef47ccb5786c04
SHA1 afd10a48ad1a4e0e31f00b42905994b29cd421a7
SHA512 72b3f577c7a689fa45e7ea12178a067e976bfc09ba1aa7645105547f2dc27eff33695e7dd3671ed6a46dad80f4a3bcad2dff285f1b57e37c54b30d39b4b4d972
SSDEEP 3072:3sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:3sQmpcF8BzXfwV
TLSH
T1D6E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkfdxvpnh.exe

Path C:\Temp\snkfdxvpnh.exe
Size 230KB
SHA256 f2d5a4f62b568ff197d0b22375a3746b49d9490e7ffc570cce9bb38491f6b8eb
MD5 fe02ee1a86f43a0a4db7d8e6628db6fa
SHA1 8b378f2f7ab6bc8c3ac6d77a3ee048a11eb39797
SHA512 52282abb556ae29c2f141dc3971457297314ceced67d521a7d735ee52d904390a4e76a478d80923b01c7d9265b89650798da407ffa52cafe687cfc4cd8c55c5e
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T174344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trpjhezxro.sys

Path C:\Temp\trpjhezxro.sys
Size 141KB
SHA256 f59c8a76518ed71f98c9a114de420457b3dd7d2ef6cdc020bb73b3868229aab2
MD5 e322d59e97c5af1735ea1f6a936acc07
SHA1 3733f4426e5e5ea0e71dc2b19ad5ca5343403bb8
SHA512 9bc307d43b27789fe4540ea6bb082a6c793b3c2a02d3e2b6c9519fe1d4c846e5e7c543d6045dd674a1e1ecf6f9df8cdb1b043a31f256916b982b520e8fc5d3b5
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T1D5E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkfdxupm.sys

Path C:\Temp\usnkfdxupm.sys
Size 141KB
SHA256 4951e6eb73773825dde6ab19f6ddb2703daa2ce08c11a7ce644db19321381b84
MD5 2a0305ea55a73d67a9336b3adceec386
SHA1 576adaf735932a2633a93da628620669e6fc6615
SHA512 582056dcca313178c9e5245a610ee30323eb4cc9ab5d29dea258c4200d73b1260e3e9630685916060dddabd1be335c92a5677216885b95cca600cc140320fadf
SSDEEP 3072:OsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:OsQmpcF8BzXfwV
TLSH
T1C0E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjebztrm.exe

Path C:\Temp\wrpjebztrm.exe
Size 230KB
SHA256 d14d3444e694c77bd8912bb7b473e691cffc9808d879429daba01714917a843f
MD5 baff997ed87aabf75814e268095264a6
SHA1 a744e487584e420903b2a7d4a1ac8a9bcfde60ee
SHA512 9f3e882eb81dbadf47255ad2870fb5f7d3cc8b63b2753835b6d9312b7ed79c27cb7fb2f44f5ba5faa2dec5adfe64dd4f5b06688db6d19467c624533562e50386
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmjhczup.sys

Path C:\Temp\xusmjhczup.sys
Size 141KB
SHA256 9c9a2fe5c4a7eb8f635a850346b083690bc8bac3c0ae9f494ebdd15a83a743cb
MD5 2d425c92b2fc0ba06a3b250b8ba6c092
SHA1 af96d77b6751a47f4529cb67fd15231a36e88dfc
SHA512 7eac1d6e65620afae068142b7700d819ad9a2986ab17db7f8b7717cbd81cfafeafa26d5378766ce1535be63bc95924590b4d0c670cfae374118771c71efe9b45
SSDEEP 3072:NsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:NsQmpcF8BzXfwV
TLSH
T147E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

932792c9-0771-44a4-a5de-b9cac122ee8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\932792c9-0771-44a4-a5de-b9cac122ee8e.tmp
Size 29KB
SHA256 a1a056baee18bbe4658cf901f0cf993e050bc92fd96a3eb81246ff08ca1109cf
MD5 82054c6a1c6aa425afec77bf0cefa228
SHA1 6c67a618b5b85bb4864920ce4afb00a8643964b3
SHA512 f0a55765f6b6812e792a51d3eabbe47c8302e9f6f369fc8ab1d54f37d7f59736c7071a8cbe3fd81092e383183da2feb124c1f951f494dd039128f3b9edb50ddd
SSDEEP 768:ky2SgS7pLuL7evWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVREdSV4Sro7+n:ky2SgqE7evWgd5f/bu1jaGEdU4Jqn
TLSH
T1F9D2DA7B640CCB7F4F804ADDAC197F9E6DA802CB9698C98047FA951C03C6BEB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 66eb85bdff0f6b3662860ed1ffef050cd116e7d7f6e268b4d973a75bb858432a
MD5 772b48ab18735d1181691bebfe88c45b
SHA1 6fe1d53c40de61eedae694efc5c3057265b0cae2
SHA512 533b054b7bf24888f332e4cbee9671e6b93954c36d9338657403d4247a78a998f398da5c3ef1a9de87b752f6110e9408855b78c4ebef89a66a3c9326492351ec
TLSH
T1B8514F94132E0FF3EF368FB345F95BD97FB5984A823B1EE110F0A078495AF295059425
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59eb12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59eb12.TMP
Size 2KB
SHA256 976a8df15ff75b3fb58c7480b6c153e3b4f1b9dc6fdb664434e5fc5b33a462fa
MD5 e0faaef06f3698b30a0d0d5dd78c4638
SHA1 2cb98b4d35b56a3af892b15f348983cf29ecb2f2
SHA512 cab8bc7b931c342d13e3aeb7ccaf2772784a740a79c0b6481b6802a5213e8bf66e5d9bd22f0d7377ca6a53f3aa131342cc595971cf9ff3fa0052506fdba3821a
TLSH
T1B7515094132E0FF3EF368FB348F95BD97FB5984A823B1EE100F0A078499AF295059415
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f0a6fb9-28c9-4f17-8de4-5c1287631706.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2f0a6fb9-28c9-4f17-8de4-5c1287631706.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e0c438dd12e42f1e5ab4d34930a2d488ea0dbd017bc9d57f0b6b23fa8fbfc89a
MD5 59441a0ac7846dc1e60d8c3977188392
SHA1 afee7ea1c115f403b830617943a8220eee859b79
SHA512 3eb31ec4b4ae8e381bb33048fc80f61d9788bb4ebe9fb61ec58a459945fa3b1a4c28d6893c35566a259197cc7471e993f576be0a3ef7f0a1c28d287ab5057e1d
TLSH
T133419EF3C3F8857E891156F4AB186E2BCE1D0915832C3D5AC9E4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dbed9ce2e786c3d3d07839742877351263085f4c925dc10b6dee850a84f6d9e3
MD5 66982b6fed9269df93f6b6c9dfe50d3f
SHA1 32f77aa54fc9969a9f7af810b6166498bfe1d934
SHA512 2c72d211a1bfd98bd939d7782f654f03f108809f95e95f787813c55b1a650dffd301b0f65268955400b5ff8d8df6ad8daa9c2ad8f8e4eefdf92db55972d68523
SSDEEP 192:sxRgR0CQ/flso2JSZrB79dzoA8pi/g6+WNC7B/YZ70KswGMIgtJ:sxRg9Q/flso2J0rB79Qi/58/5U3
TLSH
T1D73284166E28993B9CCBD21DBB55BF53E2F95032A5D41E48ABFC8B0C04E76DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d45dafe37495980832f5576bf3a59b67ec7baf2b39c5a71dccf4dff18671b698
MD5 7bee2d75bf88a013f668f95fafb1b17e
SHA1 2d7f2a3e1e6ecae3d9cf772d75afe0922cb40f0b
SHA512 b16cf15d2ea47d9577a5cb07f72b953ae13947623e075473daf52a874865eba87f797dab84897b9572de7a2cd70d192d43b1aa8a101d24c71ca1631eaa702f2e
SSDEEP 192:sxRHR0CQ/fls52JSZrB79dzoA8p9P/g6+WNCA3fYZ77KswGMIgD4J:sxRH9Q/fls52J0rB79QZ/5xf4UY
TLSH
T17A4297166E28993B9CCAD21DBB55BF53E2F95032A5D01F48ABFC8B0C05E76DD221341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3d1216a502e3cf59937ee0e0c5fba2ea839b63c10f0a37cdee07ffc5fed65ef2
MD5 373f057829ca8fb474fd2ba47a4abffc
SHA1 1d29016a14b3e83db4fdb7225b56973b6157c17b
SHA512 63514c54f10f569d539512cb3655c86e6c6f02ea8b3b68303954b67c4a06528bfe2058b3c1eecebac22e22ee17609ac6ab14130ae7a01436da2eef6f8b83d300
SSDEEP 192:sxRHR0CQ/fls52cSZrB79dzoA8p9P/g6+WNCA3fYZ77bswGMIgD+J:sxRH9Q/fls52c0rB79QZ/5xfHU2
TLSH
T13142A6166E28993B9CCBD219BB55BF53E2F95032A5D11F48ABFC8B0C05E76CD220341B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b8e8eebd0adf8e6658d44cc6f0164a050128dd11c09dcfc89b183c88d441305b
MD5 ece0e21af67246703392e65b2905f1e1
SHA1 8cf297e1cada54249d54652416050dab20d97af8
SHA512 a557843324b45f7c3b8b073fe7e5d2c760fac65951239cbb9220a9dfc9a1f9f944cb0bbddb3ff31aa86793251572bb328388b9f9b3fff32832cba81093e8151a
SSDEEP 96:K4POKs0KVLet5jp9bmtgqUBbKMiUHbALT4VysgKVambEXYkmue2suJ9ek2K2Teqx:I1TK7bEXYkmueVuJkk0Teq58EBaU+x+9
TLSH
T18FC1CED2B03AC24079BE290991B5C626CBC5F0B3745DA4AA3BE810764B67F415EFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a859c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a859c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 4d0d0f1ff687fa9d7c3f6b14dd2fbbf35d56d774d49726de43669408c410c5ab
MD5 3ebea3c611482cb1a901efc5f44b4185
SHA1 3969f0dded84a7320a8c27401eb3ae8ec4ecd9f7
SHA512 aa36bfb99b20d8e0185a903c4da40d91d4fadd8526c1330ff628519a772764375c5b649a7a7dd8ea9af568c799ee6ff6d001b81ad1fab701fbf4b15b58f3d6b6
SSDEEP 768:Bj+9Y3aDka7qR5Aam6aQMGdjWca4Ghf9LIQ:c9Y3aDgrmaME6pLt
TLSH
T1CFD29E315C658D239CA79695F32B37C7BEF011A388C81E44D9D99B0D06D758E270BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0eb7ae63c9f2d2904c15076e02dda63cf3f4a12542664a33a4c83c4ec614b065
MD5 070658604c5e70306fbe634d93650050
SHA1 c283d55655c760388e4788a11e3bcb294d7aeeaa
SHA512 34c93fe784710af43c221002f5cbcf0a342b74d064540797c9ca4f833d10cf7de6e6dbb07844d660d7e09cd0197fafd1a9de1a6e73f8df81b20c98f787a8f6c4
SSDEEP 768:/rv+4UNbdq3ZJyqtAAam6aQMGdjWca4GhfBcPeU/:/bsbc3ZzKmaME6pUH
TLSH
T1BEF2BF31A8689973DDB79A99F21B6B87BEF421A385D40E80C9D95B0D43970CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 76404d4860a93d3ed1671f691043777983ca95263262f2684eb169a697f0d0bc
MD5 fe1ddfdcdcc8b02d63898c78438979d5
SHA1 730ac98743d3dc22b18554f04fc72a25631dc264
SHA512 afb9045ea309906dd8de37fc2dfea0f47b7ece2755dbfdf21d6c970f3a158e02f77e5112db2ec36981edfb7b66cf6cf051c5862acbea308981efbe3a5265129b
SSDEEP 768:4F1j+9/3lwgUQka/7Aam6aQMGdjWca4Ghf9LIQ:19/3YQbmaME6pLt
TLSH
T1B603F6F198D78937DCAE4787A33E6E8699BCC163B4885984BBC85D0CCD821BFD207815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7b18f09c80361a789f543a4e8fb1ece3635745fc0eeafe61c55acc40bda32ecc
MD5 dc948a068880d24cc70328d910dd25f0
SHA1 85e9828c7635ed8c7d484c0f2159fcd03fd60564
SHA512 2ca01eaff9cb2a76dd97081e5ccb7fc3a5f6b8a77a28290b3eb28f53ff9450f0d3515d092e87658665c2b3e3350c4d938fa6d9c476b18a16f4c177f673b6d5f2
SSDEEP 768:irv+4UNbdq3zgWqR0Aam6aQMGdjWca4Ghf9LPeUQ:ibsbc3zEWmaME6pL4
TLSH
T1DFF2BF31A868D9739CB79295F21B7AC3BEB411A388C40E94D9D95B0D43970CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 7e0456aa41a480d69c6276fe767f02fc0fc8908fb49127207f27dade9e310e6c
MD5 1bd3627a9e5c91e09b3a2f21a367c081
SHA1 c6ace307c870970aa312a25cc888e185061e56c8
SHA512 633b5d699f3158dd5ea39c97b2c8dd6c01e96d4a9ae71a4b57134ba4a17ef448433c9c1e267f6f15e091b45d09981e2246770a96f4a254b93eabcf55dc3e25e7
SSDEEP 768:hj+9Y31Dka7qR5Aam6aQMGdjWca4Ghf9LIQ:89Y31DgrmaME6pLt
TLSH
T18ED29E316C658D239CA79695F32B37C7BEF011B388C81E44D9D99B0D06D358E270BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

7232d393-1937-4abb-a022-3520730664cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7232d393-1937-4abb-a022-3520730664cd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1648_234814211\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/660-447-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1596-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1836-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2288-318-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2492-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2876-322-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2988-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3436-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3500-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3740-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3904-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3948-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-412-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4572-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-477-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4876-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-436-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6104-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download