750e04f220d35a0c9b43fc1cbaf1cb6d641f1dd92fc80529f90a09bcadddf2f0

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260415-rza2jsct2w
SHA256 750e04f220d35a0c9b43fc1cbaf1cb6d641f1dd92fc80529f90a09bcadddf2f0
MD5 200016c72b362437e2e676cf4c34882e
SHA1 eea36cf103c1786de04c79eec726cb81aefda699
SHA512 d8ee1cbb4b7baa7e0987d366738b62b2925e1ae7a1fd2c493a5d766b31f56ce43898138ab3adf3ed53da37c717d3ccea671ed1ee7679f94422a5dd35c6c3eb39
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T1E934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3568	CP.exe
956	zxrpkhcaus.exe
1364	CP.exe
6072	CP.exe
5300	i_zxrpkhcaus.exe
5356	mbzurmhfzw.sys
6020	CP.exe
4844	uomgcwuomh.exe
5116	CP.exe
1092	CP.exe
4012	i_uomgcwuomh.exe
4968	hbztrpjhbz.sys
4660	CP.exe
5192	zwrpjhbzrl.exe
3956	CP.exe
3712	CP.exe
4224	i_zwrpjhbzrl.exe
3796	trljeywroj.sys
5420	CP.exe
2928	bwtolgbytr.exe
3648	CP.exe
2352	CP.exe
4900	i_bwtolgbytr.exe
412	ytqljdbytq.sys
5276	CP.exe
4968	olgeyvtolg.exe
2500	CP.exe
3224	CP.exe
4960	i_olgeyvtolg.exe
756	fdyvqoigay.sys
2420	CP.exe
3288	ytnlfdxvqo.exe
5348	CP.exe
2652	CP.exe
4068	i_ytnlfdxvqo.exe
5076	tnkfdxvpni.sys
2992	CP.exe
4720	lfaxvpnhfa.exe
3364	CP.exe
5632	CP.exe
4336	i_lfaxvpnhfa.exe
3700	pnifaxsqki.sys
3168	CP.exe
4680	axspkicaus.exe
4608	CP.exe
1820	CP.exe
4568	i_axspkicaus.exe
1628	kecxvpkica.sys
3432	CP.exe
4648	xspkhfzxsp.exe
1608	CP.exe
5816	CP.exe
2780	i_xspkhfzxsp.exe
5444	xupmhfzxrp.sys
2516	CP.exe
3416	omhezxrpjh.exe
2084	CP.exe
4400	CP.exe
5756	i_omhezxrpjh.exe
5956	mjecwuomge.sys
2012	CP.exe
1592	bztrmjezwr.exe
2168	CP.exe
3196	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_531164978\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_531164978\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_1635731933\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_1635731933\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_531164978\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_1635731933\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4528_490780919\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_808519075\_locales\gl\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbzrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtolgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkfcxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjeczurmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgcwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeyvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytnlfdxvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgcwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbzrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtolgbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytnlfdxvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkfcxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwupmhezxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxupfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxupfzx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3420	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3264	ipconfig.exe
5580	ipconfig.exe
3380	ipconfig.exe
3448	ipconfig.exe
4236	ipconfig.exe
3796	ipconfig.exe
2080	ipconfig.exe
2440	ipconfig.exe
5976	ipconfig.exe
5464	ipconfig.exe
124	ipconfig.exe
4832	ipconfig.exe
5456	ipconfig.exe
2252	ipconfig.exe
5312	ipconfig.exe
2836	ipconfig.exe
5796	ipconfig.exe
4716	ipconfig.exe
4340	ipconfig.exe
4612	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247631"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3867326476"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207376206683613"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1456842261-3464001825-2855069093-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1456842261-3464001825-2855069093-1000\{99428DBC-A8C8-47C0-97E9-E2237A6521FD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	5300	i_zxrpkhcaus.exe
Token: SeDebugPrivilege	4012	i_uomgcwuomh.exe
Token: SeDebugPrivilege	4224	i_zwrpjhbzrl.exe
Token: SeDebugPrivilege	4900	i_bwtolgbytr.exe
Token: SeDebugPrivilege	4960	i_olgeyvtolg.exe
Token: SeDebugPrivilege	4068	i_ytnlfdxvqo.exe
Token: SeDebugPrivilege	4336	i_lfaxvpnhfa.exe
Token: SeDebugPrivilege	4568	i_axspkicaus.exe
Token: SeDebugPrivilege	2780	i_xspkhfzxsp.exe
Token: SeDebugPrivilege	5756	i_omhezxrpjh.exe
Token: SeDebugPrivilege	4716	i_bztrmjezwr.exe
Token: SeDebugPrivilege	2268	i_rojgbztrlj.exe
Token: SeDebugPrivilege	4480	i_geywqolgey.exe
Token: SeDebugPrivilege	2836	i_qoigaytnlf.exe
Token: SeDebugPrivilege	3424	i_faysnlfdxv.exe
Token: SeDebugPrivilege	1264	i_spkfcxsqki.exe
Token: SeDebugPrivilege	4808	i_nkfdxupfzx.exe
Token: SeDebugPrivilege	1308	i_cwupmhezxr.exe
Token: SeDebugPrivilege	4256	i_pjeczurmke.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3024	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	78
PID 3024 wrote to memory of 4528	3024	iexplore.exe	79
PID 4528 wrote to memory of 4952	4528	msedge.exe	80
PID 4528 wrote to memory of 3420	4528	msedge.exe	82
PID 4528 wrote to memory of 2616	4528	msedge.exe	83
PID 4528 wrote to memory of 2616	4528	msedge.exe	83
PID 4528 wrote to memory of 2616	4528	msedge.exe	83
PID 4528 wrote to memory of 5396	4528	msedge.exe	84
PID 4528 wrote to memory of 5396	4528	msedge.exe	84
PID 4528 wrote to memory of 2464	4528	msedge.exe	86
PID 4528 wrote to memory of 5716	4528	msedge.exe	87
PID 4528 wrote to memory of 5716	4528	msedge.exe	87
PID 4528 wrote to memory of 5716	4528	msedge.exe	87
PID 4528 wrote to memory of 2464	4528	msedge.exe	86
PID 4528 wrote to memory of 2464	4528	msedge.exe	86
PID 4892 wrote to memory of 3568	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 956 wrote to memory of 1364	956	zxrpkhcaus.exe	91
PID 4528 wrote to memory of 5180	4528	msedge.exe	94
PID 4528 wrote to memory of 5180	4528	msedge.exe	94
PID 4528 wrote to memory of 5472	4528	msedge.exe	95
PID 4528 wrote to memory of 5472	4528	msedge.exe	95
PID 4528 wrote to memory of 1636	4528	msedge.exe	96
PID 4528 wrote to memory of 5352	4528	msedge.exe	98
PID 1636 wrote to memory of 2248	1636	msedge.exe	99
PID 4892 wrote to memory of 6072	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	100
PID 4892 wrote to memory of 6020	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 4844 wrote to memory of 5116	4844	uomgcwuomh.exe	108
PID 4892 wrote to memory of 1092	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	111
PID 4892 wrote to memory of 4660	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 5192 wrote to memory of 3956	5192	zwrpjhbzrl.exe	117
PID 4892 wrote to memory of 3712	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 4892 wrote to memory of 5420	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2928 wrote to memory of 3648	2928	bwtolgbytr.exe	126
PID 4892 wrote to memory of 2352	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 4528 wrote to memory of 3264	4528	msedge.exe	131
PID 4528 wrote to memory of 3180	4528	msedge.exe	132
PID 4528 wrote to memory of 5452	4528	msedge.exe	133
PID 4528 wrote to memory of 3812	4528	msedge.exe	134
PID 4528 wrote to memory of 3812	4528	msedge.exe	134
PID 4528 wrote to memory of 1828	4528	msedge.exe	135
PID 4528 wrote to memory of 1828	4528	msedge.exe	135
PID 4892 wrote to memory of 5276	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 4968 wrote to memory of 2500	4968	olgeyvtolg.exe	140
PID 4892 wrote to memory of 3224	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 4892 wrote to memory of 2420	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 3288 wrote to memory of 5348	3288	ytnlfdxvqo.exe	149
PID 4892 wrote to memory of 2652	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 4892 wrote to memory of 2992	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 4720 wrote to memory of 3364	4720	lfaxvpnhfa.exe	158
PID 4892 wrote to memory of 5632	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 4892 wrote to memory of 3168	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4680 wrote to memory of 4608	4680	axspkicaus.exe	167
PID 4892 wrote to memory of 1820	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 4528 wrote to memory of 3440	4528	msedge.exe	172
PID 4528 wrote to memory of 3440	4528	msedge.exe	172
PID 4892 wrote to memory of 3432	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4648 wrote to memory of 1608	4648	xspkhfzxsp.exe	179
PID 4892 wrote to memory of 5816	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 4892 wrote to memory of 2516	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 3416 wrote to memory of 2084	3416	omhezxrpjh.exe	188
PID 4892 wrote to memory of 4400	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 4528 wrote to memory of 3204	4528	msedge.exe	193
PID 4528 wrote to memory of 3204	4528	msedge.exe	193
PID 4892 wrote to memory of 2012	4892	2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_200016c72b362437e2e676cf4c34882e_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffaebafc188,0x7ffaebafc194,0x7ffaebafc1a0
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,7834331848608633918,993481374666130306,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
      4⤵
      System Time Discovery
      PID:3420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,6649542844983235405,16000925831586044442,262144 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:2616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,3429627588509819760,3293554664297461199,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:13
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,4237843338583527147,4268563608587051391,2097152 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,1957767831532444451,14025650268749430206,2097152 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,12355334873237564030,11021396497424683871,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4896,i,18147695184144591604,15477653582781006766,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,3111201826781425572,3148060109787683133,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1116
        5⤵
        
        PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,4047955319177192794,6333484560431983266,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,4047955319177192794,6333484560431983266,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:5352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,5632223697361769031,16391649743676523804,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17169519699203757677,12138659932427647796,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,7339358194180592351,8771396056451203569,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,5609453300187351868,7261060564678962141,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:3812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4263682457343871641,8668277370701988175,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,17305794669485707186,10865607874163607703,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:14
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1436571351859337003,17760598709066783601,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,8084401131891929511,10178039380170146841,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
      4⤵
      PID:448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6036,i,8761915883922815985,6726628777918321146,262144 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,2138299117554787011,3211457784744200261,524288 --field-trial-handle=2316,i,9168598557475570397,17969342008170051959,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhcaus.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3568
- - C:\Temp\zxrpkhcaus.exe
    C:\Temp\zxrpkhcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhcaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6072
- - C:\Temp\i_zxrpkhcaus.exe
    C:\Temp\i_zxrpkhcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgcwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6020
- - C:\Temp\uomgcwuomh.exe
    C:\Temp\uomgcwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgcwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1092
- - C:\Temp\i_uomgcwuomh.exe
    C:\Temp\i_uomgcwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrpjhbzrl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\zwrpjhbzrl.exe
    C:\Temp\zwrpjhbzrl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrpjhbzrl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3712
- - C:\Temp\i_zwrpjhbzrl.exe
    C:\Temp\i_zwrpjhbzrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtolgbytr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\bwtolgbytr.exe
    C:\Temp\bwtolgbytr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3648
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtolgbytr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2352
- - C:\Temp\i_bwtolgbytr.exe
    C:\Temp\i_bwtolgbytr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeyvtolg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\olgeyvtolg.exe
    C:\Temp\olgeyvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeyvtolg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3224
- - C:\Temp\i_olgeyvtolg.exe
    C:\Temp\i_olgeyvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytnlfdxvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2420
- - C:\Temp\ytnlfdxvqo.exe
    C:\Temp\ytnlfdxvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytnlfdxvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2652
- - C:\Temp\i_ytnlfdxvqo.exe
    C:\Temp\i_ytnlfdxvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfaxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2992
- - C:\Temp\lfaxvpnhfa.exe
    C:\Temp\lfaxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5312
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfaxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5632
- - C:\Temp\i_lfaxvpnhfa.exe
    C:\Temp\i_lfaxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkicaus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3168
- - C:\Temp\axspkicaus.exe
    C:\Temp\axspkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkicaus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1820
- - C:\Temp\i_axspkicaus.exe
    C:\Temp\i_axspkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkhfzxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3432
- - C:\Temp\xspkhfzxsp.exe
    C:\Temp\xspkhfzxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkhfzxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5816
- - C:\Temp\i_xspkhfzxsp.exe
    C:\Temp\i_xspkhfzxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2516
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4612
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4400
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2012
- - C:\Temp\bztrmjezwr.exe
    C:\Temp\bztrmjezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3196
- - C:\Temp\i_bztrmjezwr.exe
    C:\Temp\i_bztrmjezwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbztrlj.exe ups_run
  2⤵
  PID:4224
- - C:\Temp\rojgbztrlj.exe
    C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbztrlj.exe ups_ins
  2⤵
  PID:428
- - C:\Temp\i_rojgbztrlj.exe
    C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqolgey.exe ups_run
  2⤵
  PID:4840
- - C:\Temp\geywqolgey.exe
    C:\Temp\geywqolgey.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqolgey.exe ups_ins
  2⤵
  PID:5452
- - C:\Temp\i_geywqolgey.exe
    C:\Temp\i_geywqolgey.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaytnlf.exe ups_run
  2⤵
  PID:3988
- - C:\Temp\qoigaytnlf.exe
    C:\Temp\qoigaytnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3500
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaytnlf.exe ups_ins
  2⤵
  PID:5144
- - C:\Temp\i_qoigaytnlf.exe
    C:\Temp\i_qoigaytnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysnlfdxv.exe ups_run
  2⤵
  PID:996
- - C:\Temp\faysnlfdxv.exe
    C:\Temp\faysnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysnlfdxv.exe ups_ins
  2⤵
  PID:1224
- - C:\Temp\i_faysnlfdxv.exe
    C:\Temp\i_faysnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkfcxsqki.exe ups_run
  2⤵
  PID:3204
- - C:\Temp\spkfcxsqki.exe
    C:\Temp\spkfcxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5976
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4228
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkfcxsqki.exe ups_ins
  2⤵
  PID:5548
- - C:\Temp\i_spkfcxsqki.exe
    C:\Temp\i_spkfcxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxupfzx.exe ups_run
  2⤵
  PID:1184
- - C:\Temp\nkfdxupfzx.exe
    C:\Temp\nkfdxupfzx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxupfzx.exe ups_ins
  2⤵
  PID:5692
- - C:\Temp\i_nkfdxupfzx.exe
    C:\Temp\i_nkfdxupfzx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwupmhezxr.exe ups_run
  2⤵
  PID:4592
- - C:\Temp\cwupmhezxr.exe
    C:\Temp\cwupmhezxr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4540
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwupmhezxr.exe ups_ins
  2⤵
  PID:3324
- - C:\Temp\i_cwupmhezxr.exe
    C:\Temp\i_cwupmhezxr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjeczurmke.exe ups_run
  2⤵
  PID:1524
- - C:\Temp\pjeczurmke.exe
    C:\Temp\pjeczurmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1268
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5580
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjeczurmke.exe ups_ins
  2⤵
  PID:4600
- - C:\Temp\i_pjeczurmke.exe
    C:\Temp\i_pjeczurmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4256
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywr.exe ups_run
  2⤵
  PID:4752
- - C:\Temp\bwtomgeywr.exe
    C:\Temp\bwtomgeywr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5740
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4832

C:\Temp\mbzurmhfzw.sys
C:\Temp\mbzurmhfzw.sys
1⤵
- Executes dropped EXE
PID:5356

C:\Temp\hbztrpjhbz.sys
C:\Temp\hbztrpjhbz.sys
1⤵
- Executes dropped EXE
PID:4968

C:\Temp\trljeywroj.sys
C:\Temp\trljeywroj.sys
1⤵
- Executes dropped EXE
PID:3796

C:\Temp\ytqljdbytq.sys
C:\Temp\ytqljdbytq.sys
1⤵
- Executes dropped EXE
PID:412

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
- Executes dropped EXE
PID:756

C:\Temp\tnkfdxvpni.sys
C:\Temp\tnkfdxvpni.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\pnifaxsqki.sys
C:\Temp\pnifaxsqki.sys
1⤵
- Executes dropped EXE
PID:3700

C:\Temp\kecxvpkica.sys
C:\Temp\kecxvpkica.sys
1⤵
- Executes dropped EXE
PID:1628

C:\Temp\xupmhfzxrp.sys
C:\Temp\xupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:5444

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
- Executes dropped EXE
PID:5956

C:\Temp\gezwrpjhbz.sys
C:\Temp\gezwrpjhbz.sys
1⤵
PID:1428

C:\Temp\tolgeywqoi.sys
C:\Temp\tolgeywqoi.sys
1⤵
PID:5692

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
PID:2532

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
PID:5796

C:\Temp\kidavtnlfa.sys
C:\Temp\kidavtnlfa.sys
1⤵
PID:1676

C:\Temp\usnkfdxvpn.sys
C:\Temp\usnkfdxvpn.sys
1⤵
PID:3896

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
PID:5924

C:\Temp\wuomgezwrp.sys
C:\Temp\wuomgezwrp.sys
1⤵
PID:1792

C:\Temp\rpjhbztjeb.sys
C:\Temp\rpjhbztjeb.sys
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtolgbytr.exe

Path C:\Temp\bwtolgbytr.exe
Size 226KB
SHA256 c1a922725011009dc52efa069beb26c13106224905d9bef07bb985539953d988
MD5 bf8ace7334943f9138e956b34820b3f5
SHA1 41f7d2410840f9c04dc2a19d1c52f36f03bcefd7
SHA512 93fab6e44f8b973e2d8fbe21d59af9068958552efc5f3f2de2a22f252551b2718a27c0e46d2df8115c79ab82dced3ab3ff7deb497fff79ee47416cb3fb089162
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T1DE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdyvqoigay.sys

Path C:\Temp\fdyvqoigay.sys
Size 141KB
SHA256 7dc0d426ff4c6a7f8e7715364b70a3b0c4c8d74ee5ffcffaf73c34cdb720785a
MD5 8455becaf0640da649d939a56d8109b1
SHA1 a1b78b3a6eee4e1db9f839c230f6667a4dbc615b
SHA512 b8f3d04ba4d8dfebed09f4e04a39d86c048051c841fe58224c30a43354e48fc6d1524e06ac423cfce5bcd301a0326571b241809b2f401890c777283b6da18b48
SSDEEP 1536:Ta3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ta3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D6E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrpjhbz.sys

Path C:\Temp\hbztrpjhbz.sys
Size 141KB
SHA256 f1be007cd2958eb4f098dd4b66fd3e2ccdb45b37216a2e1752d7a61b090e3e71
MD5 a55619c7f5c9a7a4698aee5bbbd0cf08
SHA1 7114cc2983c810ddd79d98765af0c269dd6f3121
SHA512 8f03b16368856adb84da0683f6d92ea8f9164b1aedaa0d87e6a61df5cf61089d912cec6f3046519d71591ccee9fda8eb9e46fcaf56af0c4c3ef952ede7c856d2
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T107E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtolgbytr.exe

Path C:\Temp\i_bwtolgbytr.exe
Size 226KB
SHA256 0ac18928668dccb534347496b833783ae0cd1bd381d1ab42ceaa6e96ac26e0a5
MD5 191e557a8aae5d8191a686498348a625
SHA1 8a145211069c0cd04ae950d5650eb0bc9c43696a
SHA512 133cc83582e937e927e3c3402ab92e398759fa108c0fbdef3dd2c2f950d8fbe2e16ff220abeb6fb42a330ee70693cea89df3cd6efcbc5719d8e8914d777f25d4
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T17A34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgeyvtolg.exe

Path C:\Temp\i_olgeyvtolg.exe
Size 226KB
SHA256 95a25bf2eb1be4d96d5274d010d2d721936eb887a204fe661a8eab49cc0df8c8
MD5 969a88ee60b10df6530abf4e63eb2fa7
SHA1 29c7bdbcea7e29da7b7ca799da2c316e20804e0e
SHA512 60595130f7f8817bdfd8164e4c2f7b19db81deb716d2ff7dcd10fa86be67723080e1d964d905d10b033c4a4cc3c3d52072c59bb391244d25793148a84f7c13b8
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T16634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgcwuomh.exe

Path C:\Temp\i_uomgcwuomh.exe
Size 226KB
SHA256 3aa12d261a810ac0261192cdd450f68bc610d7f6411827a5bf87b792acccf3eb
MD5 4e43052c574b9007f74b8a56dea82765
SHA1 507880e34b2d38485791e5709c6ed1b914df8995
SHA512 d82c4872216973429c1ea4437dc40b949b60ec0aca6555df73c2932230f7ca2bce5e912a1d52e3ed88072b0b407410a19178555bc5059cd5d83e8bfb879ef79d
SSDEEP 3072:MGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:TXY4LK+a3lLNngoqRttA7
TLSH
T1DC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytnlfdxvqo.exe

Path C:\Temp\i_ytnlfdxvqo.exe
Size 226KB
SHA256 27baeeb126fd864e56cf8ab206cd36360983895e2986656529a233263ca29563
MD5 c8c74bd4a04fb0d6028a7d75da2825c4
SHA1 954a31bfa7fb86996f1b800565d67054179d1e00
SHA512 c4c31733429b8cd170bd4ff35b43d0eb403ffc60b6893f92ebf7516770f7a07f33dd3342197e1dc2f72aeb49be52054fe64e11691bae5d4efb60587c514dc43f
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T13234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwrpjhbzrl.exe

Path C:\Temp\i_zwrpjhbzrl.exe
Size 226KB
SHA256 b891f888ab40e8b4e952e57e89f7087e63733bcd6b721a3b05ca97bbaeaca520
MD5 c0104119e02bde9720bea559dd4fdbcc
SHA1 96a048088b8a13f901e974dc0050ae1500fe04c5
SHA512 ce80c69fbf499339232b803cc867566d581170b6fa1e94e1656a6b9f940e76a7e00e055d919042c69205a1c9a731936942853b327e24a024b60962d57e563af2
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T1CD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxrpkhcaus.exe

Path C:\Temp\i_zxrpkhcaus.exe
Size 226KB
SHA256 102464bcd6d4fd01b8af872db4a5204ad352b27c69444baa4ff06d88b8837c99
MD5 d4bf655c4ef473018cab683ad9fdcd6c
SHA1 25eff42b4555681c73d14215aabcee54ad030d17
SHA512 0776b0d947e9d6a10bdea1b44aea05d5adfbb7d7700422ab10f143e976863ce2d2c453b4ef5dd8627713c81c9e07db17a04f269d2771122f4ac9ebdafb763d14
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T12334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfaxvpnhfa.exe

Path C:\Temp\lfaxvpnhfa.exe
Size 226KB
SHA256 eeb8c8e97a09ff5e0808771e104d8ebfb0fbecf1684ca7be3baf7edf04813e87
MD5 ca5bb6b58bf60e095905a9080e8487ef
SHA1 3bf39f761c321fa4d258d3dbfc91c549ee830c1f
SHA512 7ad2d1fc3cffc408b3bd691bbd3f5cb0cba5d2b635644164fb37676ce5fe36e34c27426cc070bc2d76c014107c3c886de32cce7797e0de80d771658f9a7ed491
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T12234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbzurmhfzw.sys

Path C:\Temp\mbzurmhfzw.sys
Size 141KB
SHA256 e07b55f187fb8d3664f3ad1c7beab83abbb257dfb71d645132401c762eca9bc9
MD5 7f95d0359653461a0a5964586a9eebc4
SHA1 40efa535376980939dfd97fb85d4f92a64736e6b
SHA512 827a6aaec3c2658c6ec51df014136d4a5deb33af09ca3934d525a5f32db9893d2203283f139f7045eda469f22465c762222659d3b2cab37b0304df71ea851e02
SSDEEP 1536:/a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:/a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C7E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeyvtolg.exe

Path C:\Temp\olgeyvtolg.exe
Size 226KB
SHA256 d0ae0d85492cbf1718e4748760dc8d0039e3c6695e27388569b778d31f85f0ac
MD5 0fc2788ad4bd04cf472f13f494584a8e
SHA1 8695a146efa47d862f94d24aeb7c6484ca700a9c
SHA512 6fd29f59bd2e98352ad01e4f2af371b8e57cb4cf520263f175f5dfbec7c0fdcaabe9da31db45a1af64011e4960433ee3e600bf44b93018efda7d14e3054cfbbf
SSDEEP 3072:BOGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7r:DXY4LK+a3lLNngoqRttA7
TLSH
T12134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnkfdxvpni.sys

Path C:\Temp\tnkfdxvpni.sys
Size 141KB
SHA256 848bba8ee9bd5dc77a0f019d47ec5dd96e9e9c83259fca5789eb402c4e9dfdb8
MD5 e03941d5c59581695304129101bc4481
SHA1 b946054c6e4d025d2bd8535069fe28e7ef9e7401
SHA512 5c8d6c181437c2547dd070e7eddd9b3a7329716b283c3f6d6110014de6ac122e73143181a09ecf42248d6dff32ea7551b6dd990f9e71c948abb956166bf7f596
SSDEEP 1536:na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljeywroj.sys

Path C:\Temp\trljeywroj.sys
Size 141KB
SHA256 ae358898e51cdb768aca77463f2551a39630a21a24dfd24b1b099432a2827a72
MD5 abbccc39e891dc9027f8e1e8e516bcb9
SHA1 6d9e45812ce7e3ec661bb79b2750b4510614fd59
SHA512 89a70306e23a7e8118e4a103b6b40c33ebcfb27936babb5ec54b54d15f6c1dbf60295fb3bb12ae36e5a7b7161d894d50a3889ab17117a27d01bab397227f57ef
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T108E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgcwuomh.exe

Path C:\Temp\uomgcwuomh.exe
Size 226KB
SHA256 cc8051992202d13d233aba6b4a378817a1e14c4a17236e27befb85f3b9fa7585
MD5 3f2e9083872519adaee2f83eea289448
SHA1 c2db678bce80c6efcb5f70c35e207bb9cac1659c
SHA512 5670c3a091b6cdfb31f016fe09efb9bcd4bb61f8c8eb5afa8f3c96640d78f30d3dcf3f24deee1a3b0bb8b14cf7566603598ac7ef2cae7b47716c9f894f968ad2
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T1AC34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytnlfdxvqo.exe

Path C:\Temp\ytnlfdxvqo.exe
Size 226KB
SHA256 53da4ef9e7bcffba4a4bcfbff7172a33280a400e6706a67d8fc0e5d765cac8d5
MD5 e4c2a04b5606dc2effad9cd7e5c96085
SHA1 8da8460308739a3b334656a6e1c5d9025f046443
SHA512 8dbca4a881545d10acb1bbef32a65abc371354130ff476178d009f5282514fcfb8cd5a142899acdb5a89c02d2cbdb135a5e6da06a920b6f8044588fbe4e14648
SSDEEP 3072:PHGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:OXY4LK+a3lLNngoqRttA7
TLSH
T1CD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqljdbytq.sys

Path C:\Temp\ytqljdbytq.sys
Size 141KB
SHA256 c93daba041079e99afdfebbb6c3e7b434aa15fb0963635bbb46fe1cc0e64408b
MD5 f64829bc5c3365fb0223e4dbd7c62d0a
SHA1 55ced662c40c658495481a32614ce4daf56ad16c
SHA512 a3a6e8e5bfcf2534da22c68ea493f319f1511a230b6ae3de8b5acdc0eb6210c5917bed517f5468c1fa30f9ad8a00abed8d1bd371155b4e3ca6e3db394ed4a81c
SSDEEP 1536:3a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:3a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrpjhbzrl.exe

Path C:\Temp\zwrpjhbzrl.exe
Size 226KB
SHA256 1fd5be915711a17e341716c7219a5efca262113b8eb42f4d30c07827a0e35769
MD5 95f0ab1c08bc7fdced29bb28573ada9c
SHA1 3f7027fec838c26652384e7883a14b5447e381b8
SHA512 149e43755d563b9677b72f0f602d53bafc480e456ebfeea831ec332e1a073410114391f4f25fce6dbad7647cae56c4507bc5852d310dd11bcd6d7d453324e779
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T16D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpkhcaus.exe

Path C:\Temp\zxrpkhcaus.exe
Size 226KB
SHA256 296a7d0d75c17741c5c85786221287f7a15571767e93f93392df0f917d9eb710
MD5 eba13349e5036c7f49abc7e99a23b315
SHA1 7a0dfbd2b6bdb8f790ba043778085e40f5359e16
SHA512 941bdd363d9c54c6e5204ba59f9fa3af80144af818e04b3ef082d3ed9c0d732cf43331ca92a28556c2908e4e0e82d71292e43280a692aaa56c27dc20121d315e
SSDEEP 3072:mGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:dXY4LK+a3lLNngoqRttA7
TLSH
T1FA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9cf5acc3a4797f1d8e969ab1970c2330530e33f7dac25d2b42a810961a67ea68
MD5 6bbadb85852ef58796e988ee6bd3abc6
SHA1 f87a8c99cc4052067a5b532f97bd1ccc92f6a0b9
SHA512 a3813b64d663d976b681f2ced98d428dc47f49c99219d4a147277e7c8375b07692a5a14501eee0df77c86f9da6e3205c49e89510005d4f3b21e3afff243fb088
TLSH
T13CD080155FF27C70D014E8F694187B41392DACA68D43A6115471EA7E4C224D48BD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ea750b8ccfa8d7c7a393cdf6c9c8a3be0f2f086fb814bb44905a02c83d9af71f
MD5 697a394c9a3ff43b8925489b648b073c
SHA1 5828315de0bd17378051f664204bff07d8659dea
SHA512 37519d78554ef3947030bf7fc74d2660bf2dc752f04de85daef8079fdce335d2e6ad77071de5a938f7422ad0bdd2acad3963260b61149fc0d91381c007a2514f
TLSH
T173D080115FF27C70D014E8F694187B413A3DA8A68D43A61154B1EA7E4C624D48FD0FE7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 57dfb8b872dc8bb90e0ad59d60d913eb0c3404482cf39cfb1ebbf7348949f2ae
MD5 055825d6e375b4cfba828bfa747ca32e
SHA1 cc1bed9b50dfc03950f6558ba5738df3e4a4d93e
SHA512 8c7aca64f76787643d059b5c336740ddbd976a55211e8ecfaf33718eb4af05f05772e581708011d16e9bfd528eabf6ee3470905e355a5e395454f9234d7a2727
TLSH
T1D6E022AACC21AC3758FD87986059438AE76413672B80894F3A3CD20D8FB172B8587C6C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ff55d92e0429b149aed9e45b1a21afaff747b424c82f79057a499eb37fdbf43b
MD5 1aa10b59f3be9459b32ea6693070d340
SHA1 9c4fa240d450d5bce33a7ce36048f104616bcb3a
SHA512 973f1b7a7b18d5a3d204e8c347806b8109b41824b17a9f3960452591d53b9262b8a499e6dd5039376ca401d546b75b045b08e31934defb003fd77a979911ea03
TLSH
T18241DDF3C3E4856D890196F0BA18BE2BCE2D0955432C7D5A85E4EF1B93E2470E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0c4138030a38927a66236b6e647a37cd2756667cc11fbadff33fd0d4d836d972
MD5 07e48df2745ecb09227a8fa34464960f
SHA1 47e28c70778df314ab69626e5d916f77eead77ce
SHA512 331793fe11e00d0cd896ac0fa2771fc23eeae4157b33c2bc934bcb371a41464df7eea158236bc41d640a29165aa15033851a67ad023bc4e0bdff8d8f2158a80f
SSDEEP 192:sxZyRuyMqZ/K1Ml8UQhcv/f9sqq8jrX4rs+2UILcizodpZt/W6+WNsLZ/Y0lgaq/:sxZyHq2v/f9sqqwsMU3ZH/b2/5vRWNRF
TLSH
T1C4720846AA389D77DCDBD319FA55BB53D6F8156292400E449AFCCB0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 e26f16daea063c53a5f7a513003432f9a51677475e333fa43bf0e592590c0934
MD5 70c39d2973dc0d928bdfd25a8cae1b0a
SHA1 adc52986d421def39d019b4c68016616f528a96f
SHA512 05c4814fa3f6861d4a68dc9969552993e25decb224ee025303f05114b3a28faf5f3f59a84c2e06365afc5cd614d2add2259784bb433e4c7515c15bb00ac08bfc
SSDEEP 192:sxZyRuyMqZ/K1Ml8Mcv/f9sVq8jrG4rs+2UILcizodpZt/W6+WNsLZ/Y0ldaq4QW:sxZyH0v/f9sVqZsMU3ZH/b2/50gWjJ
TLSH
T1BA72F8566A38997B8CDBD309FA55BB53D7F9152292404E449AFCCB0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 4b483d9ce020940be57d90bccd202e12a856380a837eac7d92a7d5c574400400
MD5 0fa87820b6659973352ff9968dfa2783
SHA1 8df797d08fa809c018cfe9fa4f8667b5a177003d
SHA512 54cce6aba05271e986fcfb5bbc023139eb9ed1d6a851fc6e3482e56a1d0b1d5e9d1cdf7924d013b9b75b6b9dd6290173ea04d648d67e942ec381bd29b2a6b717
SSDEEP 768:EZN9b8PT24f7pLuL/CuWRmCCQx68F1+UoAYDCx9Tuqh0VfUC9xbog/OV3j7yZLlr:EZN9b8PT24ZE/CuWRmCCQx6u1jaKj7yn
TLSH
T185031C3B280CCB7F4F804E9CDD26AE8E7DE801CB9698899447FA844C03D66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 f9ffc89148a768bb7826e911e511140482331e63de3cece480ddb78eef81f0f2
MD5 5e6b5e30e32fc45a8b9564985b01a5b2
SHA1 f989f965cb5253982b68948f02d744804984a42a
SHA512 2c6c7547d150c6ff47c8e7362493928cae2c4ace09e0d30571d05cbbed94b349fd455f41e3b29689cfdf8ce3c80e0250d8045476c7f1bfbac1ac0bbddce84fe4
SSDEEP 384:cdOlNbMrgcmS2paFgkI1keB0k1+ojSSjroduZN70:cdOlNXJjSSjroduZN70
TLSH
T12CB26055713B13903ABD258A8594B4AF42C231633018E83B7BB954AE1F67E58DCFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 4e92f28bc4ff900faf267d652f93f2e8587a5daa393b12258dc9bdea7c88044d
MD5 0b4375ee7410e408468c46d7d8ec8a20
SHA1 068dfc3c748f2b8a89ca49226bea25ba2df63b6d
SHA512 222a408544359bf019e7a1fd706ad85a9dbe378d820ac2e5a8671d3eae64b911c426076547b3b14b3bfbdb3f645deedd599001b93416ffc3383f12e33a50de88
SSDEEP 768:EFJccQu3Gwgd1KuRVs5QpgXM84CXRsoFfKl1:OccQu3iRm5ggXXhX2eK1
TLSH
T187E2B3F198D78977E8AE4B97A33D2E4299BCC06375484994F7C84E1CCC861BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2ebce89cf4324ff91c9ca8fa3016311522ddfb71c2fe82734704f33e9caa73e2
MD5 08d0cdeee6fec217566f8b5d5d094034
SHA1 eecff0e8b4b72d9400cef19bb50c4aedaa8d4684
SHA512 0074e927d582fc0d9786e06321842a7c595f512153cb2b6b3e43e5dc9f3c7f4666958751e074d04701186e4f7bc55311c2acfaf088b26dbf9aa8e71fa3c2f6ea
SSDEEP 384:nMiFavqMg38N98TUNTUlIxB4d450KK14fDK7q/JVQpjfxQzY2323Ra4uzrN1k+5F:3Fayv3ywgL2KzKuRVs5Qp323RaF9
TLSH
T171C24B35E898DEABEDEA4FD9E7097613EEE041A3958C4AD4DAD81E0D00971DD1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 94a404675fd313ef5932b3ad5516e7e6acc0f61a6139235093d3c939fd00c5c2
MD5 1abb56ea80a80dd576a04d1af2c89b3e
SHA1 1227af5faf1b500fd892ec875734ea293262d644
SHA512 e55da01a3d6f3a894d1ddc7d64cca3e756d69f6ad2ddfa676caaf6e8c058fd1905e28233c4c1fd7f200b1a61438d539abafb2059a3a2bd8f730f10d7cb4148aa
SSDEEP 384:nDiFavqMg38Nh8TUNTUlIxB4dW8l14fDK7q/JVQpjfxQzY2g2Af+j8VC3Ra4uzr9:uFayv3WwgiyKuRVs5QpgXM8VC3RaF9
TLSH
T106C26C31E898CDA7ECEA9FD9E74A7613EEE001A3998C4AE4DAD41E4D00D71DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ea6d52101bbe7aa89cf016d33792c885f2d0993062c409392c048d547b66cb13
MD5 e23389466d364595637afd4b1c23b89d
SHA1 dfc38d1b054ec5c6d95555f813375db1e578bf73
SHA512 f43bf06afb225f7230b499eb651da5d3b750c95fd39bbfc4372644a0f282ec1f8ff509f607c9a8fc5d95c4923e72a06516a46bcc3435024014e829e1ece09502
SSDEEP 768:4FJccQF3Gwg+1KuRVs5QpgXM82CXRsoFfKl1:KccQF3LRm5ggXXDX2eK1
TLSH
T1EAC25B31E8A9DDA7EDE68FD9E34A7643EEF001A3958C4AE8D9C85E1C008719D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 27a4bf4e160d3f5d71aee732274301dc4cda84e5d7be367be6992e3ec9d92b47
MD5 63285f7373c99da2f1acedb014a96336
SHA1 f9cb7e72d97125ec52f21487b003bb70bb06ed0b
SHA512 2c3b5101bfcbc3c4daba3cc67a4ab45e9ea32ece3195e434b35545404bdad3b1a21911f94e1fff4ee6ee269a6a650472552dbccda4287eda06a181491e3f2171
SSDEEP 384:nRiFavqMg38Nt8TUNTUlIRD4drVo14fDK7q/JVQpjfxQzY2g2Af+j8zCJ9Il9DJw:4Fayv3GwgS1KuRVs5QpgXM8zCgdts
TLSH
T15EC24A31E8A8CDA7ECEB4FC9F71A7613EEE001A3998C4AD8D6D85E1D008719D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 71739ae9df59807de599a7c472a3548b1da691a79c629874397ee89758ee4e41
MD5 bad18f5083d075e90dadeb0a1b1e1cea
SHA1 dfc9013067e7b3cf7e6a90135de289edd27e2008
SHA512 bfdc5e599b800ff9f31943af99cd9c9e3562942a4b5ce6bd54c578b9b2eff477fc6feda05ba3f2e73b799ed0bf3a7e86fce618e9f6039da8233f27a2eb0d4824
SSDEEP 768:rFJccQ+3GwgE1KuRVs5QpgXM82CXRsoFfKl1:nccQ+3FRm5ggXXDX2eK1
TLSH
T1E1C25B31E8A8DDB7EDE68FD9E34A7643EEF001A3958C4AE8D9C85E1C008719D170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8e4a8eedeaf7ef9ba22398a18938a6268ed704925f7b93f5832039d1c15515c8
MD5 8ab18e4bc77d7736203e8db72f0264f1
SHA1 9a8a1938f6da2082a444c734be52a5997e9bb8cf
SHA512 cbbdd2b4a2d47407201be3b31c5ac0c2bf14f3089878ce451ce714f49ff9f1813050cb48920d1ee28ee70c3b1022a17e6674368146074d6f608e2d8196df3e7f
TLSH
T178414FE04C3D2AC1D1BD1A2E748B38FC96DCD72AF4A4353D2825EA840A3A21C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 8b6afa81de2a946c9d457a9a9b2ee4f77b37e26e849c30606108c24d1b9e0e7e
MD5 3f0afa3da8cf2e8a55acbdcedbc0ee7a
SHA1 b0bf48c15076dcca51c6e14d2c4aa6053563b912
SHA512 07b2b7fb6a3134e7be78b0bade823e50adaac364635418bffc942a53ff65e769eec50a6d3612eff688add18118200bce39546946d2ff6bd7de8152a8dd41e10e
TLSH
T1384162D14C3D26D1D4FC1E2E708B78FC96D8D72AF4A4357D5824EAC4063A61D644443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b3e186456e893a79f40999842041bedc30b9c93d34a68a043fae62140ac79228
MD5 eae16bb3e0089d320e6162402adaf053
SHA1 99c018747d850bdc4d545d1245732b0a4ec393bf
SHA512 8b82f4950047441a1e183b698d9c6b2a9c531875b0a306f9d0b8178054aa366b31299ac6f4520373a9c8bf220c4d6359ba28f2054bafbb3169c393b15a579519
TLSH
T1284160D04C3D1AD1D4BD1A2E748B38FC92DCD72AF4A4357D6824EA840A3A61C648443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_1635731933\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_1635731933\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_174806177\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4528_531164978\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-507-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/756-531-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1428-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1428-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1628-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1676-739-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1792-808-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2248-69-0x00000215A7740000-0x00000215A77EF000-memory.dmp

Download

memory/2324-36-0x000001FC8A530000-0x000001FC8A5DF000-memory.dmp

Download

memory/2532-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2836-821-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3700-578-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3796-252-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3896-776-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4968-231-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-564-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-220-0x0000018CC4A00000-0x0000018CC4AAF000-memory.dmp

Download

memory/5356-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5444-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5692-669-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-727-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5924-788-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5924-818-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5956-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download