702ea0bf6fbee3ab68f82c999f0106b9b21ca2bb13dcbf4304ec8101b46f2e9f

Analysis

max time kernel
148s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
21/04/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260421-e5b5kshw6l
SHA256 702ea0bf6fbee3ab68f82c999f0106b9b21ca2bb13dcbf4304ec8101b46f2e9f
MD5 d0a2867c77159dcdb391af1623a52791
SHA1 608d5fe0fb336c05fbf11dd0a8d6e1dddd6fb64b
SHA512 340695eb6c7829850213b7c685e8fd35e1d395e1dc5123b81183a886eeffe215feb05b452f9667abf5b44b46c7cc6616f2b13eb9e36ac307ef4f3fdb5ce8c4f5
SSDEEP 3072:rGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:qXY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4672	CP.exe
2836	khcausmkfc.exe
5180	CP.exe
3884	CP.exe
244	i_khcausmkfc.exe
3544	bzurmkecwu.sys
5152	CP.exe
4892	wrpjhfzxrp.exe
5528	CP.exe
3968	CP.exe
3360	i_wrpjhfzxrp.exe
4836	ecwuomgezw.sys
3972	CP.exe
5828	ojhbztrmje.exe
5344	CP.exe
5040	CP.exe
4960	i_ojhbztrmje.exe
3432	wuomgezwro.sys
3480	CP.exe
1732	ljebwtomge.exe
480	CP.exe
5480	CP.exe
4984	i_ljebwtomge.exe
5276	ljdywqoigb.sys
5304	CP.exe
2052	bytrljdywq.exe
4852	CP.exe
4780	CP.exe
5632	i_bytrljdywq.exe
4376	vtnlfdyvqo.sys
1512	CP.exe
4964	nigaysqlid.exe
2768	CP.exe
2320	CP.exe
2104	i_nigaysqlid.exe
1128	vqoigbvtni.sys
5392	CP.exe
1424	axsqkicavs.exe
3688	CP.exe
5320	CP.exe
3584	i_axsqkicavs.exe
3348	nifaysqkid.sys
3988	CP.exe
3872	aysqkicavs.exe
5488	CP.exe
4560	CP.exe
5292	i_aysqkicavs.exe
752	zxspkhcaus.sys
3100	CP.exe
2424	spkicausmk.exe
5680	CP.exe
5176	CP.exe
2224	i_spkicausmk.exe
1660	rpjhfzurmk.sys
5412	CP.exe
1652	jhczusmkec.exe
5704	CP.exe
1892	CP.exe
232	i_jhczusmkec.exe
2188	wuomhezxrp.sys
5144	CP.exe
2140	ezwrpjhbzt.exe
1032	CP.exe
4240	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1299906925\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1859694865\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1369699451\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1299906925\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1859694865\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1299906925\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1369699451\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\en_CA\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1174735131\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1859694865\_metadata\verified_contents.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqljgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczusmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqljgbytrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrojhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfauspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhezxrp.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6072	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1652	ipconfig.exe
2500	ipconfig.exe
5352	ipconfig.exe
4348	ipconfig.exe
4940	ipconfig.exe
6104	ipconfig.exe
2340	ipconfig.exe
4532	ipconfig.exe
4820	ipconfig.exe
1396	ipconfig.exe
5976	ipconfig.exe
5576	ipconfig.exe
5216	ipconfig.exe
1224	ipconfig.exe
2000	ipconfig.exe
5364	ipconfig.exe
4940	ipconfig.exe
4496	ipconfig.exe
3948	ipconfig.exe
4292	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2611771503"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31248791"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134212194706803172"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{8B787678-8392-4E54-899B-26CABD3F1C8B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5864	msedge.exe
5864	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
6040	msedge.exe
6040	msedge.exe
6040	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	244	i_khcausmkfc.exe
Token: SeDebugPrivilege	3360	i_wrpjhfzxrp.exe
Token: SeDebugPrivilege	4960	i_ojhbztrmje.exe
Token: SeDebugPrivilege	4984	i_ljebwtomge.exe
Token: SeDebugPrivilege	5632	i_bytrljdywq.exe
Token: SeDebugPrivilege	2104	i_nigaysqlid.exe
Token: SeDebugPrivilege	3584	i_axsqkicavs.exe
Token: SeDebugPrivilege	5292	i_aysqkicavs.exe
Token: SeDebugPrivilege	2224	i_spkicausmk.exe
Token: SeDebugPrivilege	232	i_jhczusmkec.exe
Token: SeDebugPrivilege	4416	i_ezwrpjhbzt.exe
Token: SeDebugPrivilege	3660	i_bywrojhbzt.exe
Token: SeDebugPrivilege	1656	i_wqljgbytrl.exe
Token: SeDebugPrivilege	2440	i_oigaytqlid.exe
Token: SeDebugPrivilege	4320	i_idavsnlfdy.exe
Token: SeDebugPrivilege	4944	i_dxvqnifays.exe
Token: SeDebugPrivilege	2056	i_pnhfauspki.exe
Token: SeDebugPrivilege	3760	i_khcwupmhfz.exe
Token: SeDebugPrivilege	5464	i_wupmhezxrp.exe
Token: SeDebugPrivilege	712	i_wrpjhbztrm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3404	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 3404 wrote to memory of 6040	3404	iexplore.exe	80
PID 6040 wrote to memory of 4160	6040	msedge.exe	81
PID 6040 wrote to memory of 6072	6040	msedge.exe	82
PID 6040 wrote to memory of 5792	6040	msedge.exe	83
PID 6040 wrote to memory of 5792	6040	msedge.exe	83
PID 6040 wrote to memory of 5792	6040	msedge.exe	83
PID 6040 wrote to memory of 2308	6040	msedge.exe	84
PID 6040 wrote to memory of 2308	6040	msedge.exe	84
PID 6040 wrote to memory of 3756	6040	msedge.exe	86
PID 6040 wrote to memory of 3756	6040	msedge.exe	86
PID 6040 wrote to memory of 3756	6040	msedge.exe	86
PID 6040 wrote to memory of 4188	6040	msedge.exe	87
PID 6040 wrote to memory of 4188	6040	msedge.exe	87
PID 6040 wrote to memory of 4188	6040	msedge.exe	87
PID 3408 wrote to memory of 4672	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 2836 wrote to memory of 5180	2836	khcausmkfc.exe	92
PID 6040 wrote to memory of 5084	6040	msedge.exe	95
PID 6040 wrote to memory of 4076	6040	msedge.exe	96
PID 6040 wrote to memory of 5084	6040	msedge.exe	95
PID 6040 wrote to memory of 4076	6040	msedge.exe	96
PID 6040 wrote to memory of 4320	6040	msedge.exe	98
PID 6040 wrote to memory of 3388	6040	msedge.exe	99
PID 3388 wrote to memory of 4184	3388	msedge.exe	100
PID 3408 wrote to memory of 3884	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	101
PID 3408 wrote to memory of 5152	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 4892 wrote to memory of 5528	4892	wrpjhfzxrp.exe	109
PID 3408 wrote to memory of 3968	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	112
PID 3408 wrote to memory of 3972	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 5828 wrote to memory of 5344	5828	ojhbztrmje.exe	118
PID 3408 wrote to memory of 5040	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	121
PID 3408 wrote to memory of 3480	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	125
PID 1732 wrote to memory of 480	1732	ljebwtomge.exe	127
PID 3408 wrote to memory of 5480	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	130
PID 6040 wrote to memory of 1408	6040	msedge.exe	132
PID 6040 wrote to memory of 1860	6040	msedge.exe	133
PID 6040 wrote to memory of 6132	6040	msedge.exe	134
PID 6040 wrote to memory of 4024	6040	msedge.exe	137
PID 6040 wrote to memory of 4024	6040	msedge.exe	137
PID 6040 wrote to memory of 228	6040	msedge.exe	138
PID 6040 wrote to memory of 228	6040	msedge.exe	138
PID 3408 wrote to memory of 5304	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	139
PID 2052 wrote to memory of 4852	2052	bytrljdywq.exe	141
PID 3408 wrote to memory of 4780	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	144
PID 3408 wrote to memory of 1512	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	148
PID 4964 wrote to memory of 2768	4964	nigaysqlid.exe	150
PID 3408 wrote to memory of 2320	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3408 wrote to memory of 5392	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	157
PID 1424 wrote to memory of 3688	1424	axsqkicavs.exe	159
PID 3408 wrote to memory of 5320	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 3408 wrote to memory of 3988	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	166
PID 3872 wrote to memory of 5488	3872	aysqkicavs.exe	168
PID 3408 wrote to memory of 4560	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 6040 wrote to memory of 4012	6040	msedge.exe	173
PID 6040 wrote to memory of 4012	6040	msedge.exe	173
PID 3408 wrote to memory of 3100	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 2424 wrote to memory of 5680	2424	spkicausmk.exe	180
PID 3408 wrote to memory of 5176	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 3408 wrote to memory of 5412	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	187
PID 1652 wrote to memory of 5704	1652	jhczusmkec.exe	189
PID 3408 wrote to memory of 1892	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	192
PID 6040 wrote to memory of 3044	6040	msedge.exe	194
PID 6040 wrote to memory of 3044	6040	msedge.exe	194
PID 3408 wrote to memory of 5144	3408	2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_d0a2867c77159dcdb391af1623a52791_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x308,0x7fffab06c188,0x7fffab06c194,0x7fffab06c1a0
      4⤵
      PID:4160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10670373762793679333,2977702475987011138,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
      4⤵
      System Time Discovery
      PID:6072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,9426254556035518481,10093724916720585122,262144 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      PID:5792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,5691135224902920557,2398875291253307835,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:13
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7980115388010213025,528858967161987366,2097152 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:3756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7222769963552417497,17772503851823112323,2097152 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:4188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,761015576761272598,14180285481445241715,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,12811318850328696437,17493534139412756131,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
      4⤵
      PID:4076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,3035427156573767631,1329739109477558331,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,3035427156573767631,1329739109477558331,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,15926000533267203933,8015303910943404873,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1112
        5⤵
        
        PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4475537497912443325,10509370514690281133,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,14585915009186767338,14285898648689426585,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,9448678126226905874,16924949045521246861,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,2484873097248262977,875982218286844015,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:4024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,16863690157185674693,8005207686156674851,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:228
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,3985348637750856516,14709655476120410434,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:14
      4⤵
      PID:4012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,3322935127657605865,8136988016716324592,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
      4⤵
      PID:3044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,16327676374806436032,7841517215665445302,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:2480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,1046885328520142183,16469272748415044957,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5092,i,9440544676834618648,6218778723227971242,262144 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14154898308509360184,7492908922420482190,524288 --field-trial-handle=2060,i,8256811120971080237,10437180018442337665,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcausmkfc.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4672
- - C:\Temp\khcausmkfc.exe
    C:\Temp\khcausmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcausmkfc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3884
- - C:\Temp\i_khcausmkfc.exe
    C:\Temp\i_khcausmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5152
- - C:\Temp\wrpjhfzxrp.exe
    C:\Temp\wrpjhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5528
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3968
- - C:\Temp\i_wrpjhfzxrp.exe
    C:\Temp\i_wrpjhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3972
- - C:\Temp\ojhbztrmje.exe
    C:\Temp\ojhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\i_ojhbztrmje.exe
    C:\Temp\i_ojhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebwtomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3480
- - C:\Temp\ljebwtomge.exe
    C:\Temp\ljebwtomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebwtomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5480
- - C:\Temp\i_ljebwtomge.exe
    C:\Temp\i_ljebwtomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytrljdywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5304
- - C:\Temp\bytrljdywq.exe
    C:\Temp\bytrljdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytrljdywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4780
- - C:\Temp\i_bytrljdywq.exe
    C:\Temp\i_bytrljdywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5632
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nigaysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1512
- - C:\Temp\nigaysqlid.exe
    C:\Temp\nigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nigaysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2320
- - C:\Temp\i_nigaysqlid.exe
    C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axsqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5392
- - C:\Temp\axsqkicavs.exe
    C:\Temp\axsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axsqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5320
- - C:\Temp\i_axsqkicavs.exe
    C:\Temp\i_axsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3988
- - C:\Temp\aysqkicavs.exe
    C:\Temp\aysqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4560
- - C:\Temp\i_aysqkicavs.exe
    C:\Temp\i_aysqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\spkicausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3100
- - C:\Temp\spkicausmk.exe
    C:\Temp\spkicausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_spkicausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5176
- - C:\Temp\i_spkicausmk.exe
    C:\Temp\i_spkicausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczusmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5412
- - C:\Temp\jhczusmkec.exe
    C:\Temp\jhczusmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczusmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1892
- - C:\Temp\i_jhczusmkec.exe
    C:\Temp\i_jhczusmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5144
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1032
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwrpjhbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4240
- - C:\Temp\i_ezwrpjhbzt.exe
    C:\Temp\i_ezwrpjhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywrojhbzt.exe ups_run
  2⤵
  PID:3928
- - C:\Temp\bywrojhbzt.exe
    C:\Temp\bywrojhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywrojhbzt.exe ups_ins
  2⤵
  PID:5664
- - C:\Temp\i_bywrojhbzt.exe
    C:\Temp\i_bywrojhbzt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqljgbytrl.exe ups_run
  2⤵
  PID:4604
- - C:\Temp\wqljgbytrl.exe
    C:\Temp\wqljgbytrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqljgbytrl.exe ups_ins
  2⤵
  PID:3604
- - C:\Temp\i_wqljgbytrl.exe
    C:\Temp\i_wqljgbytrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigaytqlid.exe ups_run
  2⤵
  PID:3344
- - C:\Temp\oigaytqlid.exe
    C:\Temp\oigaytqlid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5420
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigaytqlid.exe ups_ins
  2⤵
  PID:5380
- - C:\Temp\i_oigaytqlid.exe
    C:\Temp\i_oigaytqlid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idavsnlfdy.exe ups_run
  2⤵
  PID:3260
- - C:\Temp\idavsnlfdy.exe
    C:\Temp\idavsnlfdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idavsnlfdy.exe ups_ins
  2⤵
  PID:5852
- - C:\Temp\i_idavsnlfdy.exe
    C:\Temp\i_idavsnlfdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxvqnifays.exe ups_run
  2⤵
  PID:1836
- - C:\Temp\dxvqnifays.exe
    C:\Temp\dxvqnifays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxvqnifays.exe ups_ins
  2⤵
  PID:4212
- - C:\Temp\i_dxvqnifays.exe
    C:\Temp\i_dxvqnifays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfauspki.exe ups_run
  2⤵
  PID:4132
- - C:\Temp\pnhfauspki.exe
    C:\Temp\pnhfauspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1360
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6068
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfauspki.exe ups_ins
  2⤵
  PID:2556
- - C:\Temp\i_pnhfauspki.exe
    C:\Temp\i_pnhfauspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khcwupmhfz.exe ups_run
  2⤵
  PID:5900
- - C:\Temp\khcwupmhfz.exe
    C:\Temp\khcwupmhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khcwupmhfz.exe ups_ins
  2⤵
  PID:780
- - C:\Temp\i_khcwupmhfz.exe
    C:\Temp\i_khcwupmhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wupmhezxrp.exe ups_run
  2⤵
  PID:4828
- - C:\Temp\wupmhezxrp.exe
    C:\Temp\wupmhezxrp.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wupmhezxrp.exe ups_ins
  2⤵
  PID:1764
- - C:\Temp\i_wupmhezxrp.exe
    C:\Temp\i_wupmhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrpjhbztrm.exe ups_run
  2⤵
  PID:6060
- - C:\Temp\wrpjhbztrm.exe
    C:\Temp\wrpjhbztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrpjhbztrm.exe ups_ins
  2⤵
  PID:4880
- - C:\Temp\i_wrpjhbztrm.exe
    C:\Temp\i_wrpjhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2544

C:\Temp\bzurmkecwu.sys
C:\Temp\bzurmkecwu.sys
1⤵
- Executes dropped EXE
PID:3544

C:\Temp\ecwuomgezw.sys
C:\Temp\ecwuomgezw.sys
1⤵
- Executes dropped EXE
PID:4836

C:\Temp\wuomgezwro.sys
C:\Temp\wuomgezwro.sys
1⤵
- Executes dropped EXE
PID:3432

C:\Temp\ljdywqoigb.sys
C:\Temp\ljdywqoigb.sys
1⤵
- Executes dropped EXE
PID:5276

C:\Temp\vtnlfdyvqo.sys
C:\Temp\vtnlfdyvqo.sys
1⤵
- Executes dropped EXE
PID:4376

C:\Temp\vqoigbvtni.sys
C:\Temp\vqoigbvtni.sys
1⤵
- Executes dropped EXE
PID:1128

C:\Temp\nifaysqkid.sys
C:\Temp\nifaysqkid.sys
1⤵
- Executes dropped EXE
PID:3348

C:\Temp\zxspkhcaus.sys
C:\Temp\zxspkhcaus.sys
1⤵
- Executes dropped EXE
PID:752

C:\Temp\rpjhfzurmk.sys
C:\Temp\rpjhfzurmk.sys
1⤵
- Executes dropped EXE
PID:1660

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
- Executes dropped EXE
PID:2188

C:\Temp\ojhbztrlje.sys
C:\Temp\ojhbztrlje.sys
1⤵
PID:2464

C:\Temp\dbwtrlgeyw.sys
C:\Temp\dbwtrlgeyw.sys
1⤵
PID:6132

C:\Temp\vtnlgdywqo.sys
C:\Temp\vtnlgdywqo.sys
1⤵
PID:3664

C:\Temp\bvqoigaysq.sys
C:\Temp\bvqoigaysq.sys
1⤵
PID:928

C:\Temp\qkicavsnlf.sys
C:\Temp\qkicavsnlf.sys
1⤵
PID:4868

C:\Temp\cavsnkfdxv.sys
C:\Temp\cavsnkfdxv.sys
1⤵
PID:2540

C:\Temp\rpnhfzxrpk.sys
C:\Temp\rpnhfzxrpk.sys
1⤵
PID:5400

C:\Temp\pjhczusmke.sys
C:\Temp\pjhczusmke.sys
1⤵
PID:5248

C:\Temp\jecwuomgez.sys
C:\Temp\jecwuomgez.sys
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axsqkicavs.exe

Path C:\Temp\axsqkicavs.exe
Size 226KB
SHA256 53f1ea668acb360e6071463aa1bcb570a0e2b69a74aacd379218cf7d08784a7f
MD5 d784302d31a97d5ebb483c2038b9e8e1
SHA1 a134695e84b1476d1e93ba06fd030e469eee5c47
SHA512 28b29bc43b176cc8b4bb67fde408dab48911c85677748d3f44bf144bcf1769acacb7ce0d76c35483b3f062b2f2314ad76b5fd527f994381cffa235d366537cec
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T1E034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytrljdywq.exe

Path C:\Temp\bytrljdywq.exe
Size 226KB
SHA256 0b187a442687b49456cb97f4b44f18425582fa6d72a42ce5d2154125aa642285
MD5 264d548191d1110104dea23c2fe0df17
SHA1 3a7ecfe543e18f6e596ceb8e0a83e6661fab7666
SHA512 f9dbfddba3413e1906adf88624776073c39865aaa8e6188dbcb8779b34a7d06dd23dfe960b990c98539a54e0640bc38be03427e4109fe510359d6be1d7ddd839
SSDEEP 3072:QGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:3XY4LK+a3lLNngoqRttA7
TLSH
T14934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzurmkecwu.sys

Path C:\Temp\bzurmkecwu.sys
Size 141KB
SHA256 9cdda3aa492f28bdec0fbbf17fee1eac382eb835e36a64a978604847bdc1c622
MD5 9d06d7d3c55090f4b48c7223df1bc74b
SHA1 e8a35f4e60084e259b6190cb94480f26572b201f
SHA512 ce70fb93dff029e71bf2b9a32ead33f2e72eceff4cc8d89246b017803dee619ad54285f7d80a351abbfc34b07418a7dc36f56cf4803010933e8a0626969147fb
SSDEEP 1536:Ya3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ya3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1F3E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.sys

Path C:\Temp\ecwuomgezw.sys
Size 141KB
SHA256 8c7d72eac90aa71d78350091b67c910d7ef6437598c866f2710285cb2ea4fc68
MD5 11eb9ca5994ff98f65dd65e41993f805
SHA1 f45cc214d215ea638ef7a82d55572c262b4fefc5
SHA512 29b2c343565e8452cca6f3acbad507125f9835ecf3eca2bf0253be7b66a3ea98cb8303d71c2f8c1c941251f0f45af00b385a60a014e5a0f3d1dca47ee039d813
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BDE37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytrljdywq.exe

Path C:\Temp\i_bytrljdywq.exe
Size 226KB
SHA256 2c0fa26a4b4906303417af28eb2f9c87475b855c350bf2ebe51c0a37eb6186b5
MD5 f49a9a471c3f5f8b7f6321d2e8db013d
SHA1 14b3d74cd4c5056d5af3ad9e04778266aaeda2bb
SHA512 a028c8ecf3c07fac63e6ef7cbc995067adbda3009c184054afa7f1ecc6274866d1c60441115edbbe4f80b2b010fcb6a0f19bd44ee78d04c48e62e12bef208a42
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_khcausmkfc.exe

Path C:\Temp\i_khcausmkfc.exe
Size 226KB
SHA256 9b27db272710f6ad36297bc17f7b8a02f571138f40d63f95dcd65328b64cb197
MD5 88f371fb8d2505a62cf7c9d8f7b6618d
SHA1 2eba59c714b4a370bf008bf5bfb5623574413604
SHA512 6204f75a776be6942fde604d73e974270222de12e5fca059589563ae4ac65e1eb573b37823b0f838aaa3fbddab8122247401ec323e85a278650ae22109955a69
SSDEEP 3072:CGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:pXY4LK+a3lLNngoqRttA7
TLSH
T14334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljebwtomge.exe

Path C:\Temp\i_ljebwtomge.exe
Size 226KB
SHA256 13276de82491de74f5ac0f00ec2392f0e24adb52e251c87e46686793e4789f4f
MD5 cc4daa96704913c8e59bafaf49f23861
SHA1 68df35603a270bf7d02a10926b9ccba41fdea9f1
SHA512 a424236305d596a863ec4035059de1f4dcca9c48af855e21b16e02f043298cca07f2c5144b0026d8d754316c85c2ae8c8f2ed968d336da734cafc5ff32ebe09a
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nigaysqlid.exe

Path C:\Temp\i_nigaysqlid.exe
Size 226KB
SHA256 bcbd1b3525c2ccc69aa4b676eb0587322554b2d11fcd54867d54fe859f5ac3f3
MD5 7dfbc33d29f86e80e0c51fa9d2e9dbcc
SHA1 09a2f1d25aab125eecbe5f6e7318ece1a61bdb9a
SHA512 3aab8f0f335a109ca8dcc982a7dc15c6881814951f9c3dfabcb06860a143095ab0d16961fc46f811ab7dd7e4d1466b1c578299501f85f8cb5ed804f5d72b8cca
SSDEEP 3072:GGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:9XY4LK+a3lLNngoqRttA7
TLSH
T16834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojhbztrmje.exe

Path C:\Temp\i_ojhbztrmje.exe
Size 226KB
SHA256 d894e3b6d2c71368f51bc9851dffbccedfa46b09db1454504522ea65085b6a81
MD5 3c0e82d06a06fa5f16cbaf02a809493f
SHA1 b33e990d3cd949211d76cb2a6c93b1d7d221e55a
SHA512 1cc3fb5deb579d69f38db4ac2cc56d26e685ed3fe49df51fba406928ef7b3a5b91d57a4099e8b189a339f325470ee9dc1218a16fbe31e3dce77fb7d75306d0c9
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T11334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrpjhfzxrp.exe

Path C:\Temp\i_wrpjhfzxrp.exe
Size 226KB
SHA256 13ec8425ecada7018e75ec9e9247bd1a6cf32a65af28a9e1ec5219e1e95034de
MD5 14dc8bc4e9778969250b2e14e18d54d9
SHA1 a2103dce05ff5d23aaf9b1261d861bbe0fed8602
SHA512 23eb24271a0f652903da1401c8faefa8f7dda9fb514cfa4b6397aae5150a9e3cc38af700215390e661e0e6612be061010632c177e878236f027f1386e6ae7fa9
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khcausmkfc.exe

Path C:\Temp\khcausmkfc.exe
Size 226KB
SHA256 5757538cd033a8e75601f1f8e3be8ebc13f810c9d57b216986c57be9c6e616a3
MD5 90b4a0b298f1a4d2e4f718c57bc036e0
SHA1 b3610c120b659c9d5fd118fbac3c296c22619d1a
SHA512 04ce14b96f8fe3bec5ca94f8c960b12cc6bcbbf764e228a1acc4ac9e75a74be9c5dd81ed263b7ae93204973ff63dd58d890d9e863443bdcba06b037ab8818e98
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T1E734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdywqoigb.sys

Path C:\Temp\ljdywqoigb.sys
Size 141KB
SHA256 7a8b7f78ee391211dae36c2da44e7ec7f73330040ab183628225dbe674f1d49a
MD5 00b9f46f92bc17531539e5d4bdb25be3
SHA1 3c03581f73d7ff4aeaac0c1a2b30f730bbf3bc06
SHA512 eb72b806d04bafc46bf803313978b76ea9d6864d2d2a792cd6a874127eaa416eb333cac3e1babaa17e4f1b53272516f6611c971b38d9ae0833b51be0b68b203f
SSDEEP 1536:sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljebwtomge.exe

Path C:\Temp\ljebwtomge.exe
Size 226KB
SHA256 0a5c083c122b78ec2e215d9b934a604a6bc414b92874762ed073734e6c818cce
MD5 1e2502e43b2363380d41a050e9c4f241
SHA1 89da36b3861ddbbcd764cea9aa8fadbb5912812a
SHA512 b1cc2be38d6239ab64db0461c4ac1b46aa2995b34c17353301be480e91e61a93730234f2458651fe4e1bfa6a85274ad3e919dd7b491a1bf51f860b4f17054679
SSDEEP 3072:eGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:1XY4LK+a3lLNngoqRttA7
TLSH
T11C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nigaysqlid.exe

Path C:\Temp\nigaysqlid.exe
Size 226KB
SHA256 341852e0c0b95552446b4bce71bfb598b5d461430e1935aff4cc50807f16e6d2
MD5 8f88724f868452ed0c0d2038a3df0f40
SHA1 fe237a076af05d0cef8b96aada9a45d446ddab93
SHA512 c3117d845ae25c17a6659c3d2ef6071b509c70d98632323cd57b00c055781b83f081f16d4939379b072002aa4c23ce80414d40e25fd27aed29cbebeec4b15273
SSDEEP 3072:5GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:oXY4LK+a3lLNngoqRttA7
TLSH
T1F234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrmje.exe

Path C:\Temp\ojhbztrmje.exe
Size 226KB
SHA256 161931477ede409f2f0fa3a380189c911b3d6b87028ced2bedc2b6590128e03a
MD5 c4e3840e3433bdb36a12f3c474067bc3
SHA1 2da5375ff8461661ebf3b9ed52fe9b2114237463
SHA512 a1aafc262daad5624eef99fd585be7e2ec2c3416810a21b834d34cc1edd5b9d426c0142f980f2a85809e3cb8a3b395f4598b9a65770121166a8ae30c1a21ab64
SSDEEP 3072:hGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:wXY4LK+a3lLNngoqRttA7
TLSH
T13534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigbvtni.sys

Path C:\Temp\vqoigbvtni.sys
Size 141KB
SHA256 840e99e940fbaebff290370de043653306578d2001528971ff01aad257dd304a
MD5 676849a8f62303b9ea3b078d70e68f32
SHA1 b6a81b553806c934236018dadcfde99e3369cd5b
SHA512 781c9ca6c62327911f759147d3317ee3b60adbaa92b8d05a92bef1a68c8c651af60f12e6e61aeb1d6ae5f4db7b5b5302979b1070a4e98da1254a95ad8fd4338b
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T115E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.sys

Path C:\Temp\vtnlfdyvqo.sys
Size 141KB
SHA256 7d1529a2350fffa5a72604ed902ee6293b15540dc90d952f1ee45b7f8896a0d2
MD5 af9a547a671e70febcbf970e18718c75
SHA1 c941d297b38b8525d018b16a32d294ccd7803582
SHA512 4980d5cb53d1ecd67d06f38bd495c0bf5afd4b65e529122cc57667dd92ae66cef5af48759856c2238c6eda4524d9e81ce6d07b4f1e36d6c4331114128a0d55a6
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrpjhfzxrp.exe

Path C:\Temp\wrpjhfzxrp.exe
Size 226KB
SHA256 0c1562f642989507e48b7a7bc053e92dd0f628cf79e3718bc7fb97f9112892c5
MD5 ed19f1e4c4ecc884cc252b34c935fa49
SHA1 79df5b4075a5a1d4f749f864233b4b6d80c4982e
SHA512 10e6bf2f9f981e7554dcb7d0b2a5b30956cb1689d25cd66861b985b61e716e243f16a773c9fef10259ae60ddd0ab187091283d77e35111ff203df923ec5134b3
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1C234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwro.sys

Path C:\Temp\wuomgezwro.sys
Size 141KB
SHA256 54dbfa58c94d330f5029da46441029fa741b3369d973028899048df68bbf2aae
MD5 8eca62d06d2405d0db003ba1b85da5da
SHA1 2e8c19620da44fb29c1ac6695723463bdf4d62d0
SHA512 d95aaaa618403fbf105a760dd5273969bd20e726dae8bc9372158b3026a0f96973bb7c4c1e9dff93a7b278d4157c405ef0687629d8beec8de80e24444ab6864c
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 71f86f37b013034051fae2e3307728bc40653c617383d6aa85219dd8ea093ca3
MD5 2ee9c9062df63fee32f65bc087b93005
SHA1 2874f6b34fdb5f9ff64aed6e38005f7940050b27
SHA512 99729f971f840d780b0e5404260284b048d532cb0dbd20969536cacd61a2d2c52568d6b9d96f6f0168b93eaa3c7236b49d8aafb6138d1b1fcbe89990c6af5af3
TLSH
T1AFD08C4821F66CBAD09ACA7219057B0A2959EAA79E93AB2A39B36C784C4300115911F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d8c0ebc33f7882ac8aaa0f941413384749c7672a7744de3485d53f3d7a832ce
MD5 fb7d9391eb1040937b5c31ff61febe79
SHA1 0be0bde544b492ac590e441f96bf8d0a378d3782
SHA512 d4a405f080afee18100d407e824cc3366114b1acd56307d247bc25ee87ffaba37406581a2dfcfe9320df4d014582f86fd300e9f67a54b4fcd2e471e1358c493d
TLSH
T1AED0804425F15CB6D046C57115457B053955D6A79E539B1A35F36C784C4300115511F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 68f9891dd8c77ddfd7a788924905d5e82daba18e1fa8d30c6766fca874407dcb
MD5 78a576b8b3839b5a1dc520190ba1b1f5
SHA1 b27d7dd283341cc66ff4fc664f530bacfe1f87e4
SHA512 285c62eaebfc781b6531a0a0ecd3d3106d066772756a2653c3f92f4d352db5a4f9edeb3cd6f84bf1cdae63515e7062d1d8edab06b01d7825ea4396b0fc378638
TLSH
T111E0EDAECD25DC3708FA8B5A21400686F66A13262A40950A3A3C92088FB0A7A45DA93C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3a1c40eab285a4d08a1561f20d30c74e16dfe1606ce3d38cdafa04112b212038
MD5 db6d2a391653282253dce3603ee5be99
SHA1 d5abf545fe5c18ea0c5fce4fb8b7476116040205
SHA512 54d5eebfdedda88541667fe32491ca8806db8e753351eee2254309a2da8415e751969b1a678597bd728e9dd891521435bf2a79f16779f4327d2e7de3f6fec9af
TLSH
T14F41DCF7C3E4856E8A1195F0AB186E2BDE2C0954432C7C5AC9E4AF1B93E2460E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 034d62fb5f8507b8d0886003f38baca56eec8b17d7ce1bf1abb1d5ce56728010
MD5 c045c261697c8b9fd6605adc2b251481
SHA1 cdc6b3a637f9ed3129beb4888aa377744e9b5778
SHA512 c3b7a5dff980039ebd562c193c3f9c6dab0b2d56fa0ed6adbebff06c492d1d61945aad75a0f8abd4ae2bdebf52c48353f2cf2efecf5639e92428e3d029cd3fa3
SSDEEP 192:sxZtR4yMqZ/K1Ml8UQvci/f0s9XsinUTP6BvzodpZT/W6+WNsE7/Y0rF1UiVnIgY:sxZt5qki/f0s9XpUTnh/bD/5oiZkP
TLSH
T15A72E859AA3489778CDBD619F945BB53D6F8117391800E44AAFC8F0C01EABED220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 169237e1b963ab583b953300db38c3a6858d4ca2b9dc41cec3f6f25ee0b8dda6
MD5 8eac4c752d08583527baeb4d5beb1429
SHA1 9a6aad046c0b0878f713e75ac93ba81998786961
SHA512 3029a6ae986092a1701ac14cf1f25ceec857178cdb1a418e9a6504c2ba1b2dc129ea0663bfafaf3be57a02236cfe467a458e75b1441e8ea7dd41368bf9d1bc22
SSDEEP 192:sxZtR4yMqZ/K1Ml8Mci/f0sTFpsinUTP6BvzodpZT/W6+WNsE7/Y0rXMaiVnIgj0:sxZt50i/f0sTvpUTnh/bD/5ZiZj0
TLSH
T1C372E8596A3899778CDBD619FA45BB53D6F91173D1800E44AAFCCB0C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b47202c3e8b6ba0834e66a6c17629a4131cc0cbb3c33a8a9813ea9270557487b
MD5 6747260cc2ede0ac1b058ecdf9a3c0e1
SHA1 3516775757b3554687ea61f3053831dc169a68f5
SHA512 40908679fb3ff081193796c06ab54002fa489a83b5ea46db57061d36b6ef52385328cba940c38b5e0514a1640e480e865f4d81f13731f7d6674357cb9b14e15f
SSDEEP 768:kA4so86s2+q7pLuL/HzWRmH9QYR8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EU3SLl4:kA4so86s2+CE/HzWRmH9QYRu1jaKEU3l
TLSH
T16F031D3B684CCB7F4F844E9CEC2ABE8A6DE8018F95988D9447FA444C03C67EB55161DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 386f5cf96e9dc160436116ab1984aa70ebea6312d1a10d5ff5a7820359142050
MD5 7475fe79fb15b122df69204b055def41
SHA1 59d938451f43c330d3688f0f6d7b6c6a8b1ea9d8
SHA512 fb212504735773696f51eeaf9070d99ffef885a8352eae80bf49ead10926ca79102f619967cac90f7a26dd3b13e83dbd5bf764585e4a95443facc963f120e856
SSDEEP 96:KkGQKTyeupuKK8DF6KOkKeFGKWoJp+K6wKK6UKXqAugKHqC6S0KzSA+IK/qa2jS6:ubB91NPhfYXHkvl7X3S9r4dFf/XQ
TLSH
T10FB24A91797A02903A7E259A8595B83E52C23163711CE46B3BF900B60F6BE31DDFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.4\data.txt
Size 145KB
SHA256 7dd75cb36b4cc7c5f2df67bac823b9d9d2c3653172ff73ce6cccd39683970a08
MD5 79f8327a9cd094a4edb1fd159e289e95
SHA1 4d3615906d16d8a807e1bd394bef139507ce12ff
SHA512 9ab212871ccbe15c062da9898a782d75d208a2591b4c804df3e32581751801889f8cad8fae53dc0307cb89172c4536d35e44c06d63df6928ec4c4446a55a1343
SSDEEP 3072:tPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEEY6lCuZY:9X1aI5aZoKzMJ07NtxoY
TLSH
T1C7E3F110CDC51FA8CEAC362C60FE0F1A63D1C69D4867A5C9DB63FD0A6F97A0492275C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cbd90e2b1198c49e861f4bd3ba53b740dd5d5e8e6c3541e87bc19016c0f1ccda
MD5 d84684635cd721094206a63421ce91db
SHA1 723517c788c04b719a5a0c400de364315af79a75
SHA512 f4a5ea307554fa458899ca2e6927e58c240f5d7b849b6a773e9b17b3038e558950ce001d61e61ea31d149cb027d4abd98bbde6163741ce50a08caf8ac539a5e8
SSDEEP 384:nK4iFavqMg38N/8TUNTUlIxBgPSY5o+XOVFfLYpuv1ZTag/iRYV/Vw1mRNCe02r+:aFayv3cwgGvXEYpM1sIiRYk1mj/0a+
TLSH
T1C4C25B32EC54CEBBEDEA8FD9A709B602EEE00267D59C4AD4DAD81E0D00D719D170BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c05356617d85ff06e28ed35a67fc329dc78de5167e99c67a8be0287ff88f9125
MD5 2ad29b3241a3f2dc955d5d9ed838223c
SHA1 e741f5cb053d8f6ee6b5ce74298033b82a6c3edc
SHA512 15796b45544709c648cd33eb77c4f43013a9ca4f3691c5565e9f387b4968aecd73ecb6ed6daf0917b6b561ca4f4bca8597cf334ab5712c759ef5f3f5c5a409e3
SSDEEP 384:n74iFavqMg38Nk8TUNTUlIxBgPSY5fXZVFfLYpuv1ZTagPVjUtRYV/Vw1mRNCe0t:PFayv3DwgGZpYpM1sGKtRYk1mj/0a+
TLSH
T130C26C32EC54CDABEDEA8FD5E7097642EEE01263D98C8AD4DAD44E0D00D719D270BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bb93f9739158618d33d21150886e2dbd3890f9aad08cfbd14a07e2b8701c9f27
MD5 df6f35877fe6f5aaf6f8af97ec576564
SHA1 c1ca6ccb3e95c5a85f9efaf3a6fe2dd11886d704
SHA512 a8763834333b28c6c650ae6fe73cdbb7a846644c8948a67cdf508045b062e99bdaa04056450d8677df75b6d848d0f6045ca546bf25b268fd67ab8fb5d31e0f29
SSDEEP 384:nE4iFejccCs+Bt0S3k38No8TUNTUlIRDsgPSY5WfcVFfLYpuv1ZTagPVjLtSBFU+:sFIccQE3zwgVLeuYpM1sG9tSJcW
TLSH
T1A2D24B329CA4CDB7ECEA8ED9A35A7643DEE01163998C5AD4DAC85E1C00CB1DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 291457bb0f535cb699f7820d02ba497f70ab6f19d6bec0a42638d66cbdf0e5a9
MD5 7bac6a289e92ec6b633f90b9000c718c
SHA1 cccd6cbf80b6e599e4b7545710828fc2cfd86f17
SHA512 55fe98e6b33e9cd6edd684ef24d0136c8b4dc3d55e4057e8ffd6b8edc2fa0501530a7d8dde0ac3cdc977a5259e170c5281c1d2c12dc3ceb03c2cd36951750f6f
SSDEEP 384:nEMiFejccCs+Bt0S3d38No8TUNTUlIRDsgPSY5GXcVFfLYpuv1ZTagPVjctSBFU+:4FIccQ93zwgVLuuYpM1sGatSJcW
TLSH
T15CE291F198D38977E89E8B97933D2E4299FCC153B5484A94F7844E0CCC861BFD70A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 803a282b1144b12e7d374b7fc2d3de01e682ffb16e3704167687f277968169b6
MD5 43a68fd63107b1405587158669aea1a5
SHA1 e7b97d9c1c05713870cc0f25069621c4be9fe176
SHA512 00a556017b93de76808b2a959a40e59c42ea037e54f3ca08ee4e7637e4ac33e9d52a278c6d295525e7fee427e4a405c862d69e063fcff3d12d5f6fe39ac40585
SSDEEP 384:nV4iFXjccCs+Bt0S3k38No8TUNTUlIRDsgPSY5+fcVFfLYpuv1ZTagPVjZtSBFU+:RFTccQE3zwgVLOuYpM1sGbtSJcW
TLSH
T10DD24B329CA4CDB7ECEA8ED9A3597643DEE01163D98C5AD4DAC85E1C00CB1DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 188de8e5891e8c56afef280039b1fb14074f11832e88c0ffa56e8a02f745eb90
MD5 c96d7cc8e9c4168432fca8390e47623a
SHA1 8759bf64ab4dd6401ab1793e88bacdc7f85028c6
SHA512 9b51249be48d4d6df0e4913649240fc81c92f64011fa0182cb778066e28cccd11994f5bfcacffd7773e0498ce5b120af11d6fb4947d9a8324b56a95e34d2ef2c
SSDEEP 384:nV4iFJjccCs+Bt0S3U38No8TUNTUlIRfsgPSY5kfcVFfLYpuv1ZTagPVjZtSBFU+:RFJccQ03zwgVLguYpM1sGbtSJcW
TLSH
T1DDC25C329CA4CDB7ECEA8ED9A3597643DEE01163D98C5AD4DAC85E0C00CB1DD170BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 1d485657d00c777425dd935afad77620c8bc8b147912c07d91231451603a9113
MD5 e09060efd8d2875da7a8ce7a11c28a01
SHA1 444f3d1fe55ad9189fdc6be3bd6dfda21f2a99bb
SHA512 27338303ea2eecffc2a9ab68871583d0a9c1024394a548bca452de4483be9d129b88e85153c194f3380116271648193de6ac95c0e3982b69614ba9fd48154cfd
TLSH
T1815151E05C3D1AD1E0BD0A7EB49B38FC80DCC626F4A4347D2864E9984A7A60D248043F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 93bff34428da63936d1ccfbc560553f7816ae351fd1765dfbec36d71f9802151
MD5 16f77744b6fbb3a057fc1ce105ae3cc0
SHA1 bd255b94787c20672c5ba71f463f3ee90e7de599
SHA512 fc1c13a3a1091fdbbbaeb2c141cefdad4f5e30e722184e7738d931135ee84867b1e47652558d4dbc38b48f7d131ec41b56ef13d8a6fc21c8e71a2192ebc3d30f
TLSH
T15B5151E04C3D1AD1E17E1A7FB48B38FCC4ECC626F4A4347D2864E9984A7A61D608547F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b1ec49c62d6adbd0f7de55fa7ffd471f508c1d02421c260fd293bc1ac7671f76
MD5 b529ea835df4140e06bca61941c55cb6
SHA1 caaa7b6540da54f1a872f3c5335b86fb75366cf2
SHA512 6918b5270b775b3e14885be433565b996dc296e79b95efbb78beaf306455ebb7b1ef1345ef2a09273b36519b0b9aa501a71926c75f6b592915442ed61519bf98
TLSH
T1335163D18C7D5AD1D4BD0A7EB09B78FC84DCC626F4A4347D2868E9980A7EA1D604143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9d273a8d21c2431856aae2b272137fe07c1f57c13bc51e02088b2c2af515d387
MD5 2c7ebd73bc896407ed997fe16dc52340
SHA1 538e4fd97741e368738fa09e3bafd5d38001f04a
SHA512 8fb84e7773eba4542622f7d5f020d196747a7362323dc8e8348304b8eea59581eec7099608f9310c2ccfe322abceaa1e072230c4e45d36d61c68a014f7d31bdb
TLSH
T17D5160E04C7D1AD1D0BD0A7EB49B38FD80ECC62AF4A4347D2864ED980A7E60D248083F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1299906925\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1369699451\manifest.json
Size 52B
SHA256 36565d2ebd6c48537cb3e6fe24ac74ca68dda18b3f0f8be13f47d01aec181d62
MD5 152537f005b8875f68b1af4ac41c46f1
SHA1 70f529940adc1404721cbc1542c65eee289216ff
SHA512 bfcf5e9523b9268e1b0a546b5786498b1decc624ab1ba4fdd89e2e92edacd20800d731fef37c98aef45c64268d267b97d09f78124167685dd152bacd620dc9d0
TLSH
T1D0900260053491171AC10E546570F8859391661955850D1D0545154806A546CE051298
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1859694865\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_1859694865\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6040_787562319\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

memory/752-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/928-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1128-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1660-584-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2188-628-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2464-645-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2540-772-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3348-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3432-248-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-193-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3664-687-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4044-810-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-513-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4836-220-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4868-743-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5248-806-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5276-265-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5400-776-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6132-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download