systex | 67ef8ef6fdcf966fab84c44e0457f74de33a421dad9cf295033b471f5d7fd382

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260717-stkt8sat2x
SHA256 67ef8ef6fdcf966fab84c44e0457f74de33a421dad9cf295033b471f5d7fd382
MD5 2c019b83ed995f859ad16a79c3505664
SHA1 e400cb8ad2a9ffa04efe775625b640e5ec03d6d9
SHA512 d30add08de60cb5f30d0f17a031432a3a33aea2cd35836484a0ab7454d197078742832e05e8d8c883cb643c376d9153a80232aee5830cae6840f474563006d7b
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5452	CP.exe
5764	jgbwtoljez.exe
1512	CP.exe
956	CP.exe
2640	i_jgbwtoljez.exe
4584	lgeywqoigb.sys
2040	CP.exe
4176	tnljgbytqo.exe
5216	CP.exe
3328	CP.exe
4192	i_tnljgbytqo.exe
2980	tnlgdbytql.sys
4788	CP.exe
1856	tqoigaytql.exe
5904	CP.exe
4488	CP.exe
5440	i_tqoigaytql.exe
1352	qnifaxvtnl.sys
3828	CP.exe
4456	snlfdaysqn.exe
4816	CP.exe
2832	CP.exe
5412	i_snlfdaysqn.exe
5832	dxnkifaysq.sys
3788	CP.exe
4580	nkfcxvpnhf.exe
408	CP.exe
2932	CP.exe
824	i_nkfcxvpnhf.exe
2776	spnhfaxsqk.sys
4828	CP.exe
5348	vpfzxspkhc.exe
5472	CP.exe
5604	CP.exe
4224	i_vpfzxspkhc.exe
4744	kecwupmhfz.sys
4900	CP.exe
5692	ezwupmhfzx.exe
2008	CP.exe
3832	CP.exe
3080	i_ezwupmhfzx.exe
4344	rmjecwuomh.sys
1872	CP.exe
2032	uomhezxrpj.exe
5380	CP.exe
1528	CP.exe
4932	i_uomhezxrpj.exe
4712	trmjebzwjg.sys
1352	CP.exe
3364	mgezwrojhb.exe
4680	CP.exe
4744	CP.exe
2640	i_mgezwrojhb.exe
696	lgeywtomge.sys
4540	CP.exe
1792	gdbwqomywq.exe
1936	CP.exe
4592	CP.exe
1072	i_gdbwqomywq.exe
2068	gdywqoigdy.sys
5708	CP.exe
4268	dyvqoigayt.exe
2716	CP.exe
3208	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1406764494\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1197908964\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1637880358\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1406764494\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1342463386\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1342463386\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1197908964\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1197908964\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3308_1197908964\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfspkhczxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbwqomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbwqomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfspkhczxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_snlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxupnkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dyvqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgbztrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbwtoljez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbwtoljez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljgbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxupnkeca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jheczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jheczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgbztrljhb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2260	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6092	ipconfig.exe
696	ipconfig.exe
5476	ipconfig.exe
2680	ipconfig.exe
5420	ipconfig.exe
3376	ipconfig.exe
3760	ipconfig.exe
5448	ipconfig.exe
3144	ipconfig.exe
6044	ipconfig.exe
3344	ipconfig.exe
3052	ipconfig.exe
1868	ipconfig.exe
2460	ipconfig.exe
5036	ipconfig.exe
5644	ipconfig.exe
4592	ipconfig.exe
3344	ipconfig.exe
4604	ipconfig.exe
4588	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287755090506574"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{70FE8CE6-BAA0-4EB4-ABBB-11E5323019E8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe
5764	jgbwtoljez.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	i_jgbwtoljez.exe
Token: SeDebugPrivilege	4192	i_tnljgbytqo.exe
Token: SeDebugPrivilege	5440	i_tqoigaytql.exe
Token: SeDebugPrivilege	5412	i_snlfdaysqn.exe
Token: SeDebugPrivilege	824	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	4224	i_vpfzxspkhc.exe
Token: SeDebugPrivilege	3080	i_ezwupmhfzx.exe
Token: SeDebugPrivilege	4932	i_uomhezxrpj.exe
Token: SeDebugPrivilege	2640	i_mgezwrojhb.exe
Token: SeDebugPrivilege	1072	i_gdbwqomywq.exe
Token: SeDebugPrivilege	436	i_dyvqoigayt.exe
Token: SeDebugPrivilege	5632	i_yvqnigaysq.exe
Token: SeDebugPrivilege	4712	i_xvsnkfcaus.exe
Token: SeDebugPrivilege	2272	i_hfspkhczxs.exe
Token: SeDebugPrivilege	2296	i_czxupnkeca.exe
Token: SeDebugPrivilege	2928	i_jheczusmke.exe
Token: SeDebugPrivilege	1448	i_mgbztrljhb.exe
Token: SeDebugPrivilege	4272	i_rojhbztrlj.exe
Token: SeDebugPrivilege	2444	i_qoigaytqoi.exe
Token: SeDebugPrivilege	3644	i_nlfdbytqlj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4644	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4952 wrote to memory of 5052	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5052 wrote to memory of 3308	5052	iexplore.exe	91
PID 4644 wrote to memory of 4572	4644	iexplore.exe	92
PID 3308 wrote to memory of 5720	3308	msedge.exe	93
PID 3308 wrote to memory of 2260	3308	msedge.exe	94
PID 3308 wrote to memory of 5060	3308	msedge.exe	95
PID 3308 wrote to memory of 5060	3308	msedge.exe	95
PID 3308 wrote to memory of 384	3308	msedge.exe	96
PID 3308 wrote to memory of 5060	3308	msedge.exe	95
PID 3308 wrote to memory of 384	3308	msedge.exe	96
PID 3308 wrote to memory of 3004	3308	msedge.exe	98
PID 3308 wrote to memory of 3004	3308	msedge.exe	98
PID 3308 wrote to memory of 3004	3308	msedge.exe	98
PID 3308 wrote to memory of 792	3308	msedge.exe	99
PID 3308 wrote to memory of 792	3308	msedge.exe	99
PID 3308 wrote to memory of 792	3308	msedge.exe	99
PID 3308 wrote to memory of 5580	3308	msedge.exe	100
PID 3308 wrote to memory of 4080	3308	msedge.exe	101
PID 3308 wrote to memory of 5580	3308	msedge.exe	100
PID 3308 wrote to memory of 5580	3308	msedge.exe	100
PID 3308 wrote to memory of 2452	3308	msedge.exe	102
PID 3308 wrote to memory of 4080	3308	msedge.exe	101
PID 3308 wrote to memory of 4080	3308	msedge.exe	101
PID 3308 wrote to memory of 2452	3308	msedge.exe	102
PID 3308 wrote to memory of 2452	3308	msedge.exe	102
PID 3308 wrote to memory of 5572	3308	msedge.exe	103
PID 3308 wrote to memory of 5572	3308	msedge.exe	103
PID 3308 wrote to memory of 5500	3308	msedge.exe	105
PID 3308 wrote to memory of 704	3308	msedge.exe	106
PID 3308 wrote to memory of 5500	3308	msedge.exe	105
PID 3308 wrote to memory of 704	3308	msedge.exe	106
PID 3308 wrote to memory of 4340	3308	msedge.exe	108
PID 4952 wrote to memory of 5452	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 3308 wrote to memory of 4968	3308	msedge.exe	113
PID 3308 wrote to memory of 4968	3308	msedge.exe	113
PID 5764 wrote to memory of 1512	5764	jgbwtoljez.exe	115
PID 3308 wrote to memory of 5036	3308	msedge.exe	118
PID 3308 wrote to memory of 5036	3308	msedge.exe	118
PID 4952 wrote to memory of 956	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4952 wrote to memory of 2040	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 4176 wrote to memory of 5216	4176	tnljgbytqo.exe	125
PID 4952 wrote to memory of 3328	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4952 wrote to memory of 4788	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 1856 wrote to memory of 5904	1856	tqoigaytql.exe	134
PID 4952 wrote to memory of 4488	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4952 wrote to memory of 3828	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4456 wrote to memory of 4816	4456	snlfdaysqn.exe	143
PID 4952 wrote to memory of 2832	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 3308 wrote to memory of 1936	3308	msedge.exe	149
PID 3308 wrote to memory of 3760	3308	msedge.exe	150
PID 3308 wrote to memory of 3792	3308	msedge.exe	151
PID 4952 wrote to memory of 3788	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 4580 wrote to memory of 408	4580	nkfcxvpnhf.exe	156
PID 3308 wrote to memory of 5188	3308	msedge.exe	159
PID 3308 wrote to memory of 5188	3308	msedge.exe	159
PID 4952 wrote to memory of 2932	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4952 wrote to memory of 4828	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	164
PID 5348 wrote to memory of 5472	5348	vpfzxspkhc.exe	166
PID 4952 wrote to memory of 5604	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 4952 wrote to memory of 4900	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	173
PID 5692 wrote to memory of 2008	5692	ezwupmhfzx.exe	175
PID 4952 wrote to memory of 3832	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 4952 wrote to memory of 1872	4952	2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2c019b83ed995f859ad16a79c3505664_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:4572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x390,0x7ff8bc19c188,0x7ff8bc19c194,0x7ff8bc19c1a0
      4⤵
      PID:5720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,13646232704452279798,9505669343538273524,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:2260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1976,i,12615323101927616619,2223463840252451421,262144 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2652,i,11184673992713045939,5532963161739386679,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:13
      4⤵
      PID:384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,297800971871772956,3156361835330224130,2097152 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:1
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,7196105559886505244,7219722175633606409,2097152 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4384,i,2687092502191325005,99326523629852837,2097152 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,5612366509899462834,10795624293351302611,2097152 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4468,i,9178971272644835468,8244715527245138938,2097152 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1907318777276418590,14069100675678865374,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:14
      4⤵
      PID:5572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,8390764212110823250,1290858791176327085,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,17057925281892273907,5783698544109211514,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,13224369537794388814,1717393885987391779,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,13224369537794388814,1717393885987391779,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6412,i,12924197365241700451,17790726691269527783,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6744,i,10511889290805245378,105113230936531797,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,5291395939555422205,11784053365908340103,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=1412 /prefetch:14
      4⤵
      PID:1936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,17713956986208477897,16738475203015926007,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:3760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,10083660368023040778,17522963135554163333,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=740 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1500,i,16163739759303760756,14093575938596115185,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=1488 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1408,i,2621991002397457040,6398122847956940672,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6868,i,6147860842302085483,6987123077656860936,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8947513831494419599,12962566932082178025,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,14696236379234960687,6976784523059360567,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,13321206591573916128,13627631017043302858,262144 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:10
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9257095165580075319,310171008383341747,524288 --field-trial-handle=2552,i,11282463727477257281,5805454638326149217,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
      4⤵
      PID:4356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbwtoljez.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5452
- - C:\Temp\jgbwtoljez.exe
    C:\Temp\jgbwtoljez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbwtoljez.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Temp\i_jgbwtoljez.exe
    C:\Temp\i_jgbwtoljez.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnljgbytqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2040
- - C:\Temp\tnljgbytqo.exe
    C:\Temp\tnljgbytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5216
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2460
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnljgbytqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\i_tnljgbytqo.exe
    C:\Temp\i_tnljgbytqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqoigaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4788
- - C:\Temp\tqoigaytql.exe
    C:\Temp\tqoigaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqoigaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4488
- - C:\Temp\i_tqoigaytql.exe
    C:\Temp\i_tqoigaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\snlfdaysqn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3828
- - C:\Temp\snlfdaysqn.exe
    C:\Temp\snlfdaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_snlfdaysqn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2832
- - C:\Temp\i_snlfdaysqn.exe
    C:\Temp\i_snlfdaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfcxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3788
- - C:\Temp\nkfcxvpnhf.exe
    C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2932
- - C:\Temp\i_nkfcxvpnhf.exe
    C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpfzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4828
- - C:\Temp\vpfzxspkhc.exe
    C:\Temp\vpfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpfzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5604
- - C:\Temp\i_vpfzxspkhc.exe
    C:\Temp\i_vpfzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwupmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4900
- - C:\Temp\ezwupmhfzx.exe
    C:\Temp\ezwupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwupmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3832
- - C:\Temp\i_ezwupmhfzx.exe
    C:\Temp\i_ezwupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomhezxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1872
- - C:\Temp\uomhezxrpj.exe
    C:\Temp\uomhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomhezxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1528
- - C:\Temp\i_uomhezxrpj.exe
    C:\Temp\i_uomhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrojhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1352
- - C:\Temp\mgezwrojhb.exe
    C:\Temp\mgezwrojhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrojhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4744
- - C:\Temp\i_mgezwrojhb.exe
    C:\Temp\i_mgezwrojhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbwqomywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4540
- - C:\Temp\gdbwqomywq.exe
    C:\Temp\gdbwqomywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1792
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbwqomywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\i_gdbwqomywq.exe
    C:\Temp\i_gdbwqomywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dyvqoigayt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5708
- - C:\Temp\dyvqoigayt.exe
    C:\Temp\dyvqoigayt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4268
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dyvqoigayt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3208
- - C:\Temp\i_dyvqoigayt.exe
    C:\Temp\i_dyvqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigaysq.exe ups_run
  2⤵
  PID:5204
- - C:\Temp\yvqnigaysq.exe
    C:\Temp\yvqnigaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigaysq.exe ups_ins
  2⤵
  PID:5128
- - C:\Temp\i_yvqnigaysq.exe
    C:\Temp\i_yvqnigaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkfcaus.exe ups_run
  2⤵
  PID:4084
- - C:\Temp\xvsnkfcaus.exe
    C:\Temp\xvsnkfcaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkfcaus.exe ups_ins
  2⤵
  PID:5332
- - C:\Temp\i_xvsnkfcaus.exe
    C:\Temp\i_xvsnkfcaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfspkhczxs.exe ups_run
  2⤵
  PID:3896
- - C:\Temp\hfspkhczxs.exe
    C:\Temp\hfspkhczxs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5748
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2264
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfspkhczxs.exe ups_ins
  2⤵
  PID:4524
- - C:\Temp\i_hfspkhczxs.exe
    C:\Temp\i_hfspkhczxs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czxupnkeca.exe ups_run
  2⤵
  PID:5616
- - C:\Temp\czxupnkeca.exe
    C:\Temp\czxupnkeca.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czxupnkeca.exe ups_ins
  2⤵
  PID:1404
- - C:\Temp\i_czxupnkeca.exe
    C:\Temp\i_czxupnkeca.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jheczusmke.exe ups_run
  2⤵
  PID:4668
- - C:\Temp\jheczusmke.exe
    C:\Temp\jheczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jheczusmke.exe ups_ins
  2⤵
  PID:4712
- - C:\Temp\i_jheczusmke.exe
    C:\Temp\i_jheczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgbztrljhb.exe ups_run
  2⤵
  PID:1676
- - C:\Temp\mgbztrljhb.exe
    C:\Temp\mgbztrljhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3440
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgbztrljhb.exe ups_ins
  2⤵
  PID:4732
- - C:\Temp\i_mgbztrljhb.exe
    C:\Temp\i_mgbztrljhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbztrlj.exe ups_run
  2⤵
  PID:1108
- - C:\Temp\rojhbztrlj.exe
    C:\Temp\rojhbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2272
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbztrlj.exe ups_ins
  2⤵
  PID:1788
- - C:\Temp\i_rojhbztrlj.exe
    C:\Temp\i_rojhbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytqoi.exe ups_run
  2⤵
  PID:2432
- - C:\Temp\qoigaytqoi.exe
    C:\Temp\qoigaytqoi.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5412
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4380
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytqoi.exe ups_ins
  2⤵
  PID:996
- - C:\Temp\i_qoigaytqoi.exe
    C:\Temp\i_qoigaytqoi.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlfdbytqlj.exe ups_run
  2⤵
  PID:3576
- - C:\Temp\nlfdbytqlj.exe
    C:\Temp\nlfdbytqlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlfdbytqlj.exe ups_ins
  2⤵
  PID:2872
- - C:\Temp\i_nlfdbytqlj.exe
    C:\Temp\i_nlfdbytqlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5188

C:\Temp\lgeywqoigb.sys
C:\Temp\lgeywqoigb.sys
1⤵
- Executes dropped EXE
PID:4584

C:\Temp\tnlgdbytql.sys
C:\Temp\tnlgdbytql.sys
1⤵
- Executes dropped EXE
PID:2980

C:\Temp\qnifaxvtnl.sys
C:\Temp\qnifaxvtnl.sys
1⤵
- Executes dropped EXE
PID:1352

C:\Temp\dxnkifaysq.sys
C:\Temp\dxnkifaysq.sys
1⤵
- Executes dropped EXE
PID:5832

C:\Temp\spnhfaxsqk.sys
C:\Temp\spnhfaxsqk.sys
1⤵
- Executes dropped EXE
PID:2776

C:\Temp\kecwupmhfz.sys
C:\Temp\kecwupmhfz.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Temp\rmjecwuomh.sys
C:\Temp\rmjecwuomh.sys
1⤵
- Executes dropped EXE
PID:4344

C:\Temp\trmjebzwjg.sys
C:\Temp\trmjebzwjg.sys
1⤵
- Executes dropped EXE
PID:4712

C:\Temp\lgeywtomge.sys
C:\Temp\lgeywtomge.sys
1⤵
- Executes dropped EXE
PID:696

C:\Temp\gdywqoigdy.sys
C:\Temp\gdywqoigdy.sys
1⤵
- Executes dropped EXE
PID:2068

C:\Temp\gdxvtqliga.sys
C:\Temp\gdxvtqliga.sys
1⤵
PID:1420

C:\Temp\avsnkifaxv.sys
C:\Temp\avsnkifaxv.sys
1⤵
PID:2068

C:\Temp\nhfaxspkhc.sys
C:\Temp\nhfaxspkhc.sys
1⤵
PID:236

C:\Temp\hfzxrpkhca.sys
C:\Temp\hfzxrpkhca.sys
1⤵
PID:4344

C:\Temp\hecwusmkhf.sys
C:\Temp\hecwusmkhf.sys
1⤵
PID:4832

C:\Temp\wurmkecwuo.sys
C:\Temp\wurmkecwuo.sys
1⤵
PID:1376

C:\Temp\uomjebwuom.sys
C:\Temp\uomjebwuom.sys
1⤵
PID:2892

C:\Temp\trojgbytql.sys
C:\Temp\trojgbytql.sys
1⤵
PID:5632

C:\Temp\qoigayvqli.sys
C:\Temp\qoigayvqli.sys
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxnkifaysq.sys

Path C:\Temp\dxnkifaysq.sys
Size 141KB
SHA256 a46805290874059bcb99e7d0828899332f60241fdc716076b872cb61cf2079cb
MD5 6035d8d4ca69ccbe4b117166f56dabec
SHA1 ff6835f9bdd0aacf69f627bf8924f36dcf7f00b8
SHA512 c78afc0aad8c95bf6de00254a11cb5aafa2ca5fc1e5964057c83647c457e2f441f9f509c428cbed492900f09149109b3489806b3f3b122f77a98cef407c977f4
SSDEEP 3072:lsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:lsQmpcF8BzXfwV
TLSH
T1E7E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbwtoljez.exe

Path C:\Temp\i_jgbwtoljez.exe
Size 230KB
SHA256 7596f60c68bce20826f7b2bde137d95cdb6c8191b79d6a18b9d125dea1824201
MD5 13797b21c0b4b52c05020e88fa186823
SHA1 260b2a3a40cc016ce11c9db518c2b8d86eed067a
SHA512 4d33a9076658e09ac9f3010b15e889aacda8ee70212c614aa995244d574da709dd1ccbea55af412086e3e3c681a220fd67499703b77a363d5a2779079705e9a6
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T194344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfcxvpnhf.exe

Path C:\Temp\i_nkfcxvpnhf.exe
Size 230KB
SHA256 a999cb5bceb5ccf47c0941a4ac7b0d0d31f4b3602884a10cdf503d51ff604f41
MD5 3ae1b9e292ae24b2927ab2510f1a9fcc
SHA1 d02ab547dedb88c5b5e27064bf30a97227995346
SHA512 eab8993f015c60e90e8b3375dfe487dc17d9d4faee19ae93efea91afd94f4e8408eab3da2de5937c3dcccebe8209fa4b3c824724d73a1f3b56a3635d03d34ede
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T10B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_snlfdaysqn.exe

Path C:\Temp\i_snlfdaysqn.exe
Size 230KB
SHA256 3c6a77723a7e13ee1017a2af91a568385703526c8c115d9c8596f0b3f976f11f
MD5 c4cd3bbbaa7a85f62f04d9fa6ea3ad32
SHA1 a9e4030809260f0e2333b2da9a4a1814e4e99bf1
SHA512 55b119a74a0eac8959998ee95d74c13225cd716521ae353bfc38d5f6dc3de6a7c56cbea514b0e0bf92bfd21826ec8e750ec3acbbc80a9585ae40daabfb76e5ad
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T195344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnljgbytqo.exe

Path C:\Temp\i_tnljgbytqo.exe
Size 230KB
SHA256 163ab1eecfe8ac65b0e51d2bbcf4fe092695b33f3847843ed7a3b4850f59585d
MD5 c2c3de94aff07d9b4c3f03b1a669c855
SHA1 5b6341969b9eb607f6ace50d2f3125352d3012f8
SHA512 37406033a8f87923ed5dcb7c04bc8440a189d7ff744263f03741fd7c09accc7da8d17dcbe88ec1371eca5e454cc03bf70c37a0c8c10aeb4416dbf40ab144fb95
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T136344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqoigaytql.exe

Path C:\Temp\i_tqoigaytql.exe
Size 230KB
SHA256 d36d899cd8ea74f4d17a6eefc1ec798ce152ecaaa002b98fcca8988259ae951e
MD5 71ce694b8078d7e5c0af2778a7866627
SHA1 d6f8027ac3ad6729e8bff43e8f7f1c27a07b3362
SHA512 6bd6cf2a9837d585791f2529a2812a83dc144bea4e0d283561109d0cd155913c438541f4143b57be63f6abb9f5d66bead7c20de380817f4c1a9f5219f91e53b4
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpfzxspkhc.exe

Path C:\Temp\i_vpfzxspkhc.exe
Size 230KB
SHA256 40343a7c6f4377f29cb2ae7e101d43dcf36a23378d3467968243eb508ad10f2c
MD5 54ebefd5a4065d1c62f8d3a07a972f02
SHA1 a59cf52711991a259d3eae32a40172c17f07cb74
SHA512 2f909383cbf52ebc83671b3b4433ed20c3cd29d085ca796de856ae6586d4ab02639c56b8aef0ce1d8af411122a7899c9e1a26e3dea0b095e3eef9eadc38bfd45
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T121344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbwtoljez.exe

Path C:\Temp\jgbwtoljez.exe
Size 230KB
SHA256 e6fca86647fbed5738b8a12e2e5fa3f6b18129eea1f5c5b10f5b688e209b96cd
MD5 f8cd23a779bc46a05d9888839fe2cc5e
SHA1 d590ae16f42ec2e1a19e8bffe46c8c55299c527d
SHA512 206af32f77098e01af29b00d6d9c720d146a0d81394921b08a7bbe383bcdbfc3b83c6d2e2a2fbb3a3ecb1cc51f87f6690cf1446ea1405a084d1dee73f53c475f
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.sys

Path C:\Temp\lgeywqoigb.sys
Size 141KB
SHA256 d6fda84cdccc7a48b976517c1e86c776436b1a6e5e5b2317e7e31c3eab67e551
MD5 2fd84facd852513afab7870cfa892d84
SHA1 ba60e38b8a9d151fa655df502f7321fd36a22c07
SHA512 8c571f283c70fcc8044afc78c64e1702a36d28631cef57e0f303a5e033f09549590647d46042396ba3d84b0987b8ff4a16b50900159ae045eac84fc56edd8ad8
SSDEEP 3072:7sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:7sQmpcF8BzXfwV
TLSH
T1E0E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfcxvpnhf.exe

Path C:\Temp\nkfcxvpnhf.exe
Size 230KB
SHA256 2b453e80b3aea3be6e326beee2dc30ae367fc422b192896d966f0737c64e9def
MD5 9a8626baa0a0e79ee456d215bf87d379
SHA1 a8f7655ec8c6fce4cf67bf59cc3905dec83be2a9
SHA512 e23053e2291dc64ede3d8ebd5c84381303cfee2f83ce3d7d55fc73c2f1136f078758fecf1fc3aec53bda1db4bd96b33a19214788f5796658e8bddc67892a9728
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T123344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaxvtnl.sys

Path C:\Temp\qnifaxvtnl.sys
Size 141KB
SHA256 56dc1d8b92e87a2b631bca4af6142dcd748661779ac8439942a557002a3f4a02
MD5 d201d2731c6dcb0416e228544b1d0bb0
SHA1 b87a543aaf9c2d133bbb1305d26a93bc4f869b2c
SHA512 8fa54075a2364e408dc7574c6ee5e9783fd69bfadd8682e146d419bca0961f45e5da849e45050227df96cda91ca0582a7dd7de6a700f5b7337f997bc99af2079
SSDEEP 3072:6sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:6sQmpcF8BzXfwV
TLSH
T165E38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snlfdaysqn.exe

Path C:\Temp\snlfdaysqn.exe
Size 230KB
SHA256 819e781d14daca42ab5371bebb9df006a17a2dfbcdfc93f4ca3fe2f6fd090fd2
MD5 3f23e0755618723dc8c22067f866a79e
SHA1 9fe5bd2eca0c7b12affd7d2b100bc02c50bbf217
SHA512 a7d11755673ba90094b2e0fef801c6e6b3eeb999ecd8a4932251df77edcd9ca960141a9dae7a30c6d5eea106d239b1f323fe80efed7f1a84eb629e44be7335f3
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T11B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfaxsqk.sys

Path C:\Temp\spnhfaxsqk.sys
Size 141KB
SHA256 a35981b66f0fdeacce0efc53395d62ec14c30d3bb653f990a910133e55448197
MD5 fc41c5191b25a7b92415346384eb1673
SHA1 9c70c47bfdb011c3031f4b02e585ecec07dc2634
SHA512 c008ee20a384f09596768b53ed060a829494de2671dd006affe16dcfa509170e13bbf3397d624cdc629d358e0ccc5e80a137a22d871d0c912c24a443dd9c6a35
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T16EE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdbytql.sys

Path C:\Temp\tnlgdbytql.sys
Size 141KB
SHA256 a1c141c4af645cc9b0bb163dc7d90b92f722dccd3c1916b9be5218349c07eae1
MD5 d718c76ee5a1b7b385f0ccb62be86c98
SHA1 893c8de039495374052cdb405bc7205b0750e4c0
SHA512 e9268dff202cc45c0982bea79e8fe1fa68d4ca339310d26e5ee47f302e22985b158217ff75ebcda76687378e3b8a6f0bf938c2837ee70aaa4abbc6f83e8dd508
SSDEEP 3072:RsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:RsQmpcF8BzXfwV
TLSH
T183E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljgbytqo.exe

Path C:\Temp\tnljgbytqo.exe
Size 230KB
SHA256 40f569efb9e9fb6668a8472d6fa31c83a8762fc5c91df966490c21948d42b6d7
MD5 36881d7ebedd41e26245bd463d9ff60c
SHA1 183eebee058a67e3e4ed7a0c09709a2903d6f73b
SHA512 b927a3c06fb521c3dd5a4894e2749a70b645f9c9f066ff96450a609aeae7d985e1e6b586ad1a259903c9fa9de65a2bea18f1f14bd154893e9700abeb1ddeee66
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T198344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqoigaytql.exe

Path C:\Temp\tqoigaytql.exe
Size 230KB
SHA256 d9ef593fc36becffc16b89dcd30f561fcd26fdbbb8f43cf867319a07130acf50
MD5 dcb631b9aed22af44257aca684550f40
SHA1 3a1ab2d677532ef3df698fc8a81d48f33ff77abe
SHA512 dcd2366ada0f4aef3f27b0811079309c1dbbf69f7133a27df2d8a266b66e62d45d48a781d7617c9cac5b5570d14fadf8ce843a877cc2160208212c59f9122056
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:oghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpfzxspkhc.exe

Path C:\Temp\vpfzxspkhc.exe
Size 230KB
SHA256 c2fda1aaf74f150a987d99081049543f635e94203db1bddcf83e47dc6f369504
MD5 764f4af41c29315727a90455b1265510
SHA1 777fe671d51b758be0b0c41ac4aa00ab85b3ec4f
SHA512 ebf35527c2ba834e5fe0b99418c1529f823214d8ccc0c44364751ad42673c68e5b6ea1e340fabf4eb211994c705885db50e773086fbc7db54cbea098d2b28c99
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T116344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 89054cac1da8e4dc02e797580a49094af9dc8b0a00204ac8927aaf957d11c1bd
MD5 3d5de50e96562b67ae0b4697dd025a8c
SHA1 007097ee805abd46444f7d5ef7fbec1a58fc44b6
SHA512 c4d2031ae816a221eeb353410933f5fd589a34e79499f9fc1264f6ad9c91e1dffcb7f87adf84ceee2ba9c40d7a0a77ef0314e98583a7db8fd97e3563f0bd1e6e
TLSH
T106613D18B31AD9F3F725C9BA68E0D0D97BF064D001871A20F4703FB82816F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a86b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59a86b.TMP
Size 3KB
SHA256 3267732d4253751527db5f22cca98c1eab370071ab547ab00ac969da676394c8
MD5 a6bc4f84b4f12190a3d47f10437dbecc
SHA1 37b7db7b416fce6d25d9b4b78b407139e3dc102d
SHA512 4a87d80f9340b8a4866959ac754279b636ec5f47a0ba87e1502e36b219b66d4cda092f5c4f4149b9fff0e88e29d627be912441d4eb75cbcf460a3ed858daea6f
TLSH
T1FB613C18B31AD9F3FB25C9BA68E0D0D97BF064D4058B1A21F4743FB82816F6410E07A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2a489338-31e2-4cf5-be0a-bcba696bb71d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2a489338-31e2-4cf5-be0a-bcba696bb71d.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ca67441c63e4d8aa6a18daedb85d3bfb5f4f05a3981dce879207d0e4c1f97705
MD5 b4a12e61f43948b70beeb94b1477f8e8
SHA1 5178eee7b18a1e34294d2e3c1c7f36f8ea899265
SHA512 bbda8a70c974a9b91d438118bbdbb1ffa3ce601a93167b93bf5a550823c351016dd261f2f5c3b68ec1dffce63b5f845c60b07f40f6828bab68bf6f12a79da362
TLSH
T16A519CF3C2E8C56E990156F0AA18BE1BCE1D0915432C3D9AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 15f06113beed66818d504aeeac94ce4919b0935a6c50ca8bc023bceb31e073ba
MD5 cf5a3e44fc260dabdc03b6d02ee522d7
SHA1 c3c978161668150926fae2fdc56a81690ef65e0c
SHA512 f6b1267485aa5fe0ddc397ce8c749bdb37aface16878e3df6ca77a0541ff32423683e3be10174e513e01d64be0c8f5fbb4144dddb669bf8f365bf865660c267a
SSDEEP 192:sxRZRpCp/f4sMhanPZ6xjHzoD8p9z/g6+WNCuVfY3JL9GAIgVpZJ:sxRZKp/f4sMhoR6DV/5NfivrD
TLSH
T10942A7166928A93B9CC7D219BE55BF53E6F95032A1D41E48E7FC8A0C04F66DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 26fb9728aec8aed43ce3c5f8522d87919cdf7a2c04b4d8b9b762c28b73dea0e7
MD5 b152d29fba2a5f50405b6721c9d6ec2a
SHA1 47eed9ea681f7ce9c2b87783cde6d45d09adffc5
SHA512 f14518a7c14ecd89722cb5a327a332ebeb9846ce6e05f63ee4d51ed7fffa660c690daa66ae812bd7bcb521c6c59329add455ca68d981d76f9d379e97344fde3f
SSDEEP 192:sxReRpCp/f4sbhfnPZ6xjHzoD8p9z/g6+WNCuVfY3p9GAIgDFpZJ:sxReKp/f4sbhvR6DV/5NfafD
TLSH
T16F42C716A928A93B9CC7D219BE557F53E6F95072A1D41E4CA7FCCB0C04F66DD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bccdfd911449f467bcf18ae080f1e334bea8e141466b85227dc5820d5cfaf768
MD5 fd7fb188388d08361ca8a1d2d69e0f25
SHA1 bbe9576434fb2288fba05a44ab69e318d5a51dc0
SHA512 a4beb32cc866ba169925585d22d45f00f4195cb7615841135cd529c9cd40a6a3d402632e1b1c874f3501a99da486832634aafe8e1680962b3a26863312e80fa0
SSDEEP 192:sxReRpCp/f4sbhanPZ6xjHzoD8p9z/g6+WNCuVfY3JL9GAIgDHpZJ:sxReKp/f4sbhoR6DV/5NfivND
TLSH
T14142B816A928A93B5CC7D319BE55BF53E6F91072A1D41E4CE7FC8A0C04F66DD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d6a8195b63f79918c9174900d5203d2a419d361e347ab155447606ada65000ad
MD5 c514bdeae7e54433dcaf4327a23f4396
SHA1 cb352753dfbeb3caddc3912424c48a21d38cc1ed
SHA512 91a77a66ab3fa37220dd57acbe4d85cc126a9314bf9a6ec88c2cf7ee173b72f2884f854e6e971c535c34e4006775293938f43c63c5943446454467abca17255d
SSDEEP 768:GTEbRo7pLuL7lkWg0CfKs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpZgMWcTroyLii7:GTEbRUE7lkWg0CfKsu1jaSZgFcg8l7
TLSH
T1B9D2DA7B640DCB7E4F804A9DEC19BE9B6D6802CB9698CD4047FE941C02C6BFA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8ca552e84330075b48afa84bdd8dc51227ea45f2b13ec84d78c103bacd4beecf
MD5 1cebca8b681f548d0d0081738eb560dc
SHA1 13c92b074208494a41e4e338e61f0d3e54b42665
SHA512 e82ed6e945934aac75a1a2f9ca33183dcc9232c2b9b309a7199ff6b2e24b5ebfbd0779afcf4a43da1d7421eb8f8655c6ccd8a5910cd7f9bdf9db1aec14e10c2b
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH3gPr31lpWRekgJpK4ggHpcvHG5FaHzc5Q:C1i7PF/DWrwfX9mgpct1o7zsH3gPr310
TLSH
T1C2912457313B0240397DAE4D86B9D86A96C1B8633159B42F3BE855A20F66E03DCFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 028e9d0cfe42671202e3a3030b1a6c33d90e4961e8d629652f778195b3de2c10
MD5 f279826215ffac23883a9001339f93a0
SHA1 4fa83336a3158ead7a637ee9e10e0f009278d4c0
SHA512 5c66672bfb35afb19d0f6528cbf1aeeb39f882ae6379318b19ae91f5d9172d97cc7235a19ce49556a8559e96c8ef271992878db48dd7ea2ea6c3746484f26cb3
SSDEEP 768:Mj+9a3RhFXc+wfZOOfffffEvShCQRYb9Mi:L9a3bwf9fnfsvSUb+i
TLSH
T13CF2AF35AC796A739DE28798770A3F53BEE55137C5C41A48CEDC9F0C06836AD131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ad406b29a338e97016e69955c542dc2991fdf94f64df1c6640d45c227d41d61d
MD5 f924f7e19429280fed2ae22af0d706ae
SHA1 00061958326c525364c1a1935034f65b3883894f
SHA512 5ec6d5f44c4f60b17f1742e35411ef7633e29a4389a176ac0b4d6b410eaf3226da42287afe81d43c7eebc554a8c129c53e815161c5cd7ee9c7ca6b468b9275d1
SSDEEP 768:Rrv+4UNbd43eJkc+wfZOOffgvShCQts2bwWV:RbsbO3egwf9fIvSQ0wO
TLSH
T14E03CF32E86899339DE79248764ABB637EB86173C8C54744DACD4B0D029369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6ea377789e982f514593ec7561c77e03e6a227fbc026da06b6cac4d67beccf1f
MD5 b0dcc99a37798971fa6a04f6926aefce
SHA1 a996dbe7f59bb40a6b83717fc9cafc95fc766399
SHA512 66a83d598460f8f4a95443c6219892e7af4eed2a9e7d9f23324c1b84ab58e26874712b1b921775cbc1af8d1a50c91e703496b0b43686b6e288a3912e70a5646e
SSDEEP 768:4j+9a3whFXc+wfZOOfffffEvShCQRYb9Mi:n9a3owf9fnfsvSUb+i
TLSH
T18DF2AF35AC796A738DE28798770A3F53BEE55137C5C81A48CEDC9F0C05836AD131B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 c305a2c903c68fc461a2309de1faf5da6efa42070a41da7ef1e48e9ba778e70a
MD5 81840d5ddaa2c69e75cb88b63f3cf991
SHA1 a4bb67edd3f53d5d119b13b18ac31d7b76f78e43
SHA512 58839e6051328414048695943e065b23246f7b60f13538262247c5f366ecbe2fa457159ae9faf11b1a6a4aaed0fcbcb9cac50f71be32d9ffe5d096efd3808d4f
SSDEEP 768:brv+4UNbd43ztFXc+wfZOOfffff3vShCQRYoHu/:bbsbO3Zwf9fnf/vSUMi
TLSH
T17F03BF32E878A9739EF29794B60A7B537FE85123C5C50A58CED85F0C02935AE130BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9cccbc6b5510294d7df8753f3b02a675626476b93b92119db980f1b7ba587c57
MD5 e62ae35f0047d340ca08a45337116209
SHA1 9295be0663731c34d7fb0e3a4df30ef7c666db79
SHA512 1cb4a1ebbb5e7f0229bdc333d10a9cba06d208eae6d2211f42975ffee08bdbacb2433085d5930a5f838f8451b55cc1cf3184402dba624f8d034a09c46b78ef06
SSDEEP 768:eF1j+9n3kwgzCFfgtfZOOffffffvShCQRYb9Mi:b9n3kf9fnfnvSUb+i
TLSH
T1801329F598D79677D9AE4787673D2E02ADFCD163B5885984BBC84D0CCC821BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 47ea44adb8a9f16294d97783491d4581cba605f46867fd49eb2e2935eb4f29bd
MD5 c796cd046f4a33e76a19d0b2d1935c90
SHA1 9594802550bc4fe7c79d5e0c137429579188205d
SHA512 3ae730f95280cef999c609d7b5cea349cf800e2abcf04d89184df104681543ea03aa3440f82dd583a9a5ba642679d73174307f87680513e0cf7a916c389b538d
SSDEEP 768:brv+4UNbd4365c+wfZOOfffffYvShCQRY2bwW2:bbsbO3iwf9fnfAvSU0w5
TLSH
T1E503BF36E97869739EF39688760A7B53BFB85123C4C50644DAD94F0D028369F231BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

a6787b91-4b9d-4739-be42-5ea3158affa8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a6787b91-4b9d-4739-be42-5ea3158affa8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_672642674\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-412-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/696-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/752-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1352-261-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1420-388-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-408-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-368-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2776-289-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2892-469-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2980-233-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4344-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4344-432-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4584-186-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4712-324-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-320-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4744-315-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4832-443-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5632-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5832-273-0x0000000000010000-0x0000000000083000-memory.dmp

Download