bf001fa6603948d571e3a855ba063ed23df7d8bd347bb0b9d2851d12eda9a20c

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260517-kdaqbshy5m
SHA256 bf001fa6603948d571e3a855ba063ed23df7d8bd347bb0b9d2851d12eda9a20c
MD5 821192708dc82f37a0ccaa7317d8a014
SHA1 94a3efcedebec8f307f7ecddc6240b967492d5dd
SHA512 090ae52718420277f2c95a69719d702c7cb75216e0b0f9bad5c0422ebabbd5308802b3e54bfaceb487846e19b2d5b88ba3615b2eb78db1052db820856c38fe8a
SSDEEP 3072:dGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:8XY4LK+a3lLNngoqRttA7
TLSH
T12B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5400	CP.exe
6080	hcausmkecx.exe
396	CP.exe
5544	CP.exe
3828	i_hcausmkecx.exe
3724	usmkecwupj.sys
4732	CP.exe
5808	kecwupmhfz.exe
1008	CP.exe
5996	CP.exe
3020	i_kecwupmhfz.exe
4060	jecwuomhez.sys
6096	CP.exe
5068	uomgezwrpj.exe
3960	CP.exe
4724	CP.exe
4532	i_uomgezwrpj.exe
4020	wuomgezwro.sys
5240	CP.exe
2916	mgeywrobyt.exe
4140	CP.exe
5116	CP.exe
1660	i_mgeywrobyt.exe
2500	lgdbwtolga.sys
1040	CP.exe
2140	bvtrlgaytq.exe
1548	CP.exe
5516	CP.exe
5008	i_bvtrlgaytq.exe
388	aytqlidbvt.sys
3200	CP.exe
1232	qnigaysqki.exe
4716	CP.exe
2076	CP.exe
4264	i_qnigaysqki.exe
3724	vqnlfaysif.sys
1244	CP.exe
2844	gaxsqkidav.exe
972	CP.exe
2320	CP.exe
1516	i_gaxsqkidav.exe
2336	nkfcavsnlf.sys
3212	CP.exe
4000	faysqkausn.exe
568	CP.exe
1980	CP.exe
4752	i_faysqkausn.exe
2760	faxspkicau.sys
2344	CP.exe
4020	rpkhcausmk.exe
1028	CP.exe
4580	CP.exe
5196	i_rpkhcausmk.exe
3144	xrpkhcaupm.sys
1616	CP.exe
5960	mkecwupmhf.exe
1344	CP.exe
1236	CP.exe
1044	i_mkecwupmhf.exe
3128	zxrpjhczus.sys
4496	CP.exe
3096	gezwrpjhbz.exe
5024	CP.exe
3800	CP.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-af.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-be.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-cy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-et.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-ga.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-mul-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-en-us.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-as.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-de-ch-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-el.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-it.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-nb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_7821526\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-eu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-gl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-hr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-ml.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-mr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-uk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-sv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-ta.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-lt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-und-ethi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1863843943\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-ru.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-es.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-pt.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_7821526\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-de-1901.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-lv.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-mn-cyrl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-nl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\_metadata\verified_contents.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-de-1996.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-gu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-hi.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-pa.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-sk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1863843943\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-or.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-bg.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-cs.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-hu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-kn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-sl.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-nn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-tk.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-da.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-en-gb.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-ka.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-bn.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-cu.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-fr.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-hy.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-la.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-sq.hyb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-te.hyb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlidyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtrlgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmgeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxnkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxspkhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhbzurmjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhbzurmjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgeywrobyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaxsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezwrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlidyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtrlgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxspkhfaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwupmhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywrobyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaxsqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faysqkausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmgeuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxnkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faysqkausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gezwrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausmkecx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausmkecx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5900	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
220	ipconfig.exe
2080	ipconfig.exe
3132	ipconfig.exe
4344	ipconfig.exe
3964	ipconfig.exe
2052	ipconfig.exe
2316	ipconfig.exe
3484	ipconfig.exe
32	ipconfig.exe
4828	ipconfig.exe
4648	ipconfig.exe
4416	ipconfig.exe
1796	ipconfig.exe
5664	ipconfig.exe
2260	ipconfig.exe
2080	ipconfig.exe
3872	ipconfig.exe
496	ipconfig.exe
5568	ipconfig.exe
6004	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2774903003"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31254701"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237606577130804"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{C221716C-8AB4-440E-B142-2788401DBFDC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4116	msedge.exe
4116	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5920	msedge.exe
5920	msedge.exe
5920	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	i_hcausmkecx.exe
Token: SeDebugPrivilege	3020	i_kecwupmhfz.exe
Token: SeDebugPrivilege	4532	i_uomgezwrpj.exe
Token: SeDebugPrivilege	1660	i_mgeywrobyt.exe
Token: SeDebugPrivilege	5008	i_bvtrlgaytq.exe
Token: SeDebugPrivilege	4264	i_qnigaysqki.exe
Token: SeDebugPrivilege	1516	i_gaxsqkidav.exe
Token: SeDebugPrivilege	4752	i_faysqkausn.exe
Token: SeDebugPrivilege	5196	i_rpkhcausmk.exe
Token: SeDebugPrivilege	1044	i_mkecwupmhf.exe
Token: SeDebugPrivilege	3380	i_gezwrpjhbz.exe
Token: SeDebugPrivilege	2168	i_bztrmgeuom.exe
Token: SeDebugPrivilege	4212	i_tomgeywqoj.exe
Token: SeDebugPrivilege	4024	i_bvtnlidyvq.exe
Token: SeDebugPrivilege	5336	i_qkidxvpnif.exe
Token: SeDebugPrivilege	2064	i_kfdxnkicau.exe
Token: SeDebugPrivilege	5484	i_dxspkhfaus.exe
Token: SeDebugPrivilege	1520	i_pnhfzxrpkh.exe
Token: SeDebugPrivilege	2212	i_mhbzurmjhc.exe
Token: SeDebugPrivilege	4876	i_hezwjhbztr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 5932	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 5932 wrote to memory of 5920	5932	iexplore.exe	81
PID 5920 wrote to memory of 5308	5920	msedge.exe	82
PID 5920 wrote to memory of 5900	5920	msedge.exe	83
PID 5920 wrote to memory of 3604	5920	msedge.exe	84
PID 5920 wrote to memory of 3604	5920	msedge.exe	84
PID 5920 wrote to memory of 3604	5920	msedge.exe	84
PID 5920 wrote to memory of 820	5920	msedge.exe	85
PID 5920 wrote to memory of 820	5920	msedge.exe	85
PID 5920 wrote to memory of 1480	5920	msedge.exe	88
PID 5920 wrote to memory of 4420	5920	msedge.exe	89
PID 5920 wrote to memory of 1480	5920	msedge.exe	88
PID 5920 wrote to memory of 1480	5920	msedge.exe	88
PID 5920 wrote to memory of 4420	5920	msedge.exe	89
PID 5920 wrote to memory of 4420	5920	msedge.exe	89
PID 2596 wrote to memory of 5400	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 6080 wrote to memory of 396	6080	hcausmkecx.exe	93
PID 5920 wrote to memory of 2236	5920	msedge.exe	96
PID 5920 wrote to memory of 1328	5920	msedge.exe	97
PID 5920 wrote to memory of 2236	5920	msedge.exe	96
PID 5920 wrote to memory of 1328	5920	msedge.exe	97
PID 5920 wrote to memory of 2244	5920	msedge.exe	98
PID 5920 wrote to memory of 2264	5920	msedge.exe	100
PID 2244 wrote to memory of 2180	2244	msedge.exe	101
PID 2596 wrote to memory of 5544	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 2596 wrote to memory of 4732	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 5808 wrote to memory of 1008	5808	kecwupmhfz.exe	110
PID 2596 wrote to memory of 5996	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 2596 wrote to memory of 6096	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 5068 wrote to memory of 3960	5068	uomgezwrpj.exe	119
PID 2596 wrote to memory of 4724	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 2596 wrote to memory of 5240	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 2916 wrote to memory of 4140	2916	mgeywrobyt.exe	128
PID 2596 wrote to memory of 5116	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5920 wrote to memory of 1560	5920	msedge.exe	133
PID 5920 wrote to memory of 1656	5920	msedge.exe	134
PID 5920 wrote to memory of 1644	5920	msedge.exe	135
PID 2596 wrote to memory of 1040	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 2140 wrote to memory of 1548	2140	bvtrlgaytq.exe	140
PID 2596 wrote to memory of 5516	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 2596 wrote to memory of 3200	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 1232 wrote to memory of 4716	1232	qnigaysqki.exe	149
PID 2596 wrote to memory of 2076	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 2596 wrote to memory of 1244	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2844 wrote to memory of 972	2844	gaxsqkidav.exe	158
PID 2596 wrote to memory of 2320	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 2596 wrote to memory of 3212	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 4000 wrote to memory of 568	4000	faysqkausn.exe	167
PID 2596 wrote to memory of 1980	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 5920 wrote to memory of 1552	5920	msedge.exe	172
PID 5920 wrote to memory of 1552	5920	msedge.exe	172
PID 2596 wrote to memory of 2344	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4020 wrote to memory of 1028	4020	rpkhcausmk.exe	179
PID 2596 wrote to memory of 4580	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 2596 wrote to memory of 1616	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 5960 wrote to memory of 1344	5960	mkecwupmhf.exe	188
PID 2596 wrote to memory of 1236	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 5920 wrote to memory of 2180	5920	msedge.exe	195
PID 5920 wrote to memory of 2180	5920	msedge.exe	195
PID 2596 wrote to memory of 4496	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	196
PID 3096 wrote to memory of 5024	3096	gezwrpjhbz.exe	198
PID 2596 wrote to memory of 3800	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	201
PID 2596 wrote to memory of 5512	2596	2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 6036 wrote to memory of 1596	6036	bztrmgeuom.exe	207

C:\Users\Admin\AppData\Local\Temp\2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-17_821192708dc82f37a0ccaa7317d8a014_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffee9acc188,0x7ffee9acc194,0x7ffee9acc1a0
      4⤵
      PID:5308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1712,i,9315602919312726397,8389646520992735768,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
      4⤵
      System Time Discovery
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,6629547345865629379,8365444395816581601,262144 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:3604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,17633383397099099739,16634273873675878148,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
      4⤵
      PID:820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,7251846067531250901,8583057276291512997,2097152 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,16115870021383570000,14998074701270919981,2097152 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,11652382966623443799,4524212042116895661,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,18074741331570626061,9050090468219743322,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:14
      4⤵
      PID:1328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,13836392546633780235,5726664799321156704,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5468548100551095564,3776169999516395371,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:5892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5468548100551095564,3776169999516395371,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
      4⤵
      PID:2264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,7005014659536472327,14148238100134996729,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,12363359805076216996,16865353798055449986,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,16564957662658442914,14936357663798360266,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,8983408500556244424,11484492129976751128,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3895159813056298886,12561337814660072144,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
      4⤵
      PID:2180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=876,i,12086128012733434124,11587177920267941538,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5284,i,18247225275159895378,14445279031641673107,262144 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,5636937113218861468,5461910422880061788,524288 --field-trial-handle=2292,i,14455974840447352700,13972427408469020696,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
      4⤵
      PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausmkecx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5400
- - C:\Temp\hcausmkecx.exe
    C:\Temp\hcausmkecx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:396
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausmkecx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5544
- - C:\Temp\i_hcausmkecx.exe
    C:\Temp\i_hcausmkecx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwupmhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4732
- - C:\Temp\kecwupmhfz.exe
    C:\Temp\kecwupmhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1008
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwupmhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5996
- - C:\Temp\i_kecwupmhfz.exe
    C:\Temp\i_kecwupmhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezwrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6096
- - C:\Temp\uomgezwrpj.exe
    C:\Temp\uomgezwrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3960
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezwrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4724
- - C:\Temp\i_uomgezwrpj.exe
    C:\Temp\i_uomgezwrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgeywrobyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5240
- - C:\Temp\mgeywrobyt.exe
    C:\Temp\mgeywrobyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgeywrobyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5116
- - C:\Temp\i_mgeywrobyt.exe
    C:\Temp\i_mgeywrobyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtrlgaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1040
- - C:\Temp\bvtrlgaytq.exe
    C:\Temp\bvtrlgaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2140
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtrlgaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5516
- - C:\Temp\i_bvtrlgaytq.exe
    C:\Temp\i_bvtrlgaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnigaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3200
- - C:\Temp\qnigaysqki.exe
    C:\Temp\qnigaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnigaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_qnigaysqki.exe
    C:\Temp\i_qnigaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaxsqkidav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1244
- - C:\Temp\gaxsqkidav.exe
    C:\Temp\gaxsqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaxsqkidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2320
- - C:\Temp\i_gaxsqkidav.exe
    C:\Temp\i_gaxsqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faysqkausn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3212
- - C:\Temp\faysqkausn.exe
    C:\Temp\faysqkausn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faysqkausn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1980
- - C:\Temp\i_faysqkausn.exe
    C:\Temp\i_faysqkausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpkhcausmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\rpkhcausmk.exe
    C:\Temp\rpkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpkhcausmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4580
- - C:\Temp\i_rpkhcausmk.exe
    C:\Temp\i_rpkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5196
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwupmhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1616
- - C:\Temp\mkecwupmhf.exe
    C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwupmhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1236
- - C:\Temp\i_mkecwupmhf.exe
    C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gezwrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4496
- - C:\Temp\gezwrpjhbz.exe
    C:\Temp\gezwrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gezwrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3800
- - C:\Temp\i_gezwrpjhbz.exe
    C:\Temp\i_gezwrpjhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmgeuom.exe ups_run
  2⤵
  PID:5512
- - C:\Temp\bztrmgeuom.exe
    C:\Temp\bztrmgeuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:32
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmgeuom.exe ups_ins
  2⤵
  PID:4808
- - C:\Temp\i_bztrmgeuom.exe
    C:\Temp\i_bztrmgeuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tomgeywqoj.exe ups_run
  2⤵
  PID:4352
- - C:\Temp\tomgeywqoj.exe
    C:\Temp\tomgeywqoj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tomgeywqoj.exe ups_ins
  2⤵
  PID:3344
- - C:\Temp\i_tomgeywqoj.exe
    C:\Temp\i_tomgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtnlidyvq.exe ups_run
  2⤵
  PID:5664
- - C:\Temp\bvtnlidyvq.exe
    C:\Temp\bvtnlidyvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtnlidyvq.exe ups_ins
  2⤵
  PID:5676
- - C:\Temp\i_bvtnlidyvq.exe
    C:\Temp\i_bvtnlidyvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidxvpnif.exe ups_run
  2⤵
  PID:5352
- - C:\Temp\qkidxvpnif.exe
    C:\Temp\qkidxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5892
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidxvpnif.exe ups_ins
  2⤵
  PID:4400
- - C:\Temp\i_qkidxvpnif.exe
    C:\Temp\i_qkidxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxnkicau.exe ups_run
  2⤵
  PID:668
- - C:\Temp\kfdxnkicau.exe
    C:\Temp\kfdxnkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxnkicau.exe ups_ins
  2⤵
  PID:3684
- - C:\Temp\i_kfdxnkicau.exe
    C:\Temp\i_kfdxnkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dxspkhfaus.exe ups_run
  2⤵
  PID:5388
- - C:\Temp\dxspkhfaus.exe
    C:\Temp\dxspkhfaus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5748
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dxspkhfaus.exe ups_ins
  2⤵
  PID:1168
- - C:\Temp\i_dxspkhfaus.exe
    C:\Temp\i_dxspkhfaus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxrpkh.exe ups_run
  2⤵
  PID:3360
- - C:\Temp\pnhfzxrpkh.exe
    C:\Temp\pnhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxrpkh.exe ups_ins
  2⤵
  PID:2084
- - C:\Temp\i_pnhfzxrpkh.exe
    C:\Temp\i_pnhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhbzurmjhc.exe ups_run
  2⤵
  PID:388
- - C:\Temp\mhbzurmjhc.exe
    C:\Temp\mhbzurmjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhbzurmjhc.exe ups_ins
  2⤵
  PID:4840
- - C:\Temp\i_mhbzurmjhc.exe
    C:\Temp\i_mhbzurmjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezwjhbztr.exe ups_run
  2⤵
  PID:3956
- - C:\Temp\hezwjhbztr.exe
    C:\Temp\hezwjhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1592
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3156
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezwjhbztr.exe ups_ins
  2⤵
  PID:4884
- - C:\Temp\i_hezwjhbztr.exe
    C:\Temp\i_hezwjhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:232

C:\Temp\usmkecwupj.sys
C:\Temp\usmkecwupj.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\jecwuomhez.sys
C:\Temp\jecwuomhez.sys
1⤵
- Executes dropped EXE
PID:4060

C:\Temp\wuomgezwro.sys
C:\Temp\wuomgezwro.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\lgdbwtolga.sys
C:\Temp\lgdbwtolga.sys
1⤵
- Executes dropped EXE
PID:2500

C:\Temp\aytqlidbvt.sys
C:\Temp\aytqlidbvt.sys
1⤵
- Executes dropped EXE
PID:388

C:\Temp\vqnlfaysif.sys
C:\Temp\vqnlfaysif.sys
1⤵
- Executes dropped EXE
PID:3724

C:\Temp\nkfcavsnlf.sys
C:\Temp\nkfcavsnlf.sys
1⤵
- Executes dropped EXE
PID:2336

C:\Temp\faxspkicau.sys
C:\Temp\faxspkicau.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\xrpkhcaupm.sys
C:\Temp\xrpkhcaupm.sys
1⤵
- Executes dropped EXE
PID:3144

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\mgeywrojhe.sys
C:\Temp\mgeywrojhe.sys
1⤵
PID:5016

C:\Temp\bywrljdbvt.sys
C:\Temp\bywrljdbvt.sys
1⤵
PID:4964

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
PID:580

C:\Temp\jdbvtnavsq.sys
C:\Temp\jdbvtnavsq.sys
1⤵
PID:4384

C:\Temp\vqkicavsnl.sys
C:\Temp\vqkicavsnl.sys
1⤵
PID:3532

C:\Temp\nhfaxsnkic.sys
C:\Temp\nhfaxsnkic.sys
1⤵
PID:5004

C:\Temp\zurmkecxup.sys
C:\Temp\zurmkecxup.sys
1⤵
PID:1644

C:\Temp\cwupmherpj.sys
C:\Temp\cwupmherpj.sys
1⤵
PID:2072

C:\Temp\rmjezwuomh.sys
C:\Temp\rmjezwuomh.sys
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidbvt.sys

Path C:\Temp\aytqlidbvt.sys
Size 141KB
SHA256 dc18e0edc256f13bd4d6d861356bc7e0b00606403a44711809d746de4ed34336
MD5 057ce34815f4b3658d428464afa647f6
SHA1 2f22348fda8112362d0af4ccf51ac0473fb925cf
SHA512 be1df811dfae1248ec8f860a2c41a06dfc50ba33f9a1624d4e733f347894f36e29262834c8fd216618bca866790ebdb07eee4849e6a2f5aca344ed1990618f9b
SSDEEP 1536:Ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T142E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtrlgaytq.exe

Path C:\Temp\bvtrlgaytq.exe
Size 226KB
SHA256 c644daf615fd8fa61876ff0edfad6416b9814e88ed924c7aca65db6c095c0cb2
MD5 23bea2ca23fa384857a83d81be5175d6
SHA1 329bc6f4deb3533b07c2f7f71ac14df9f55359ee
SHA512 06277006a5f4428eb79c3aeca62282a062c7d918a221fde8f385698e0f4fb2b0c47e07dad76724732436853a09567e2633cadd4c21b85f0a31462308f9ae927c
SSDEEP 3072:RGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:gXY4LK+a3lLNngoqRttA7
TLSH
T19634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaxsqkidav.exe

Path C:\Temp\gaxsqkidav.exe
Size 226KB
SHA256 73bc0ced86aba047503dc78671af5180b5ca2706762ed1a84abea14650464cc2
MD5 d95669004d5828e58124024d55531e9e
SHA1 38751b3a1f3439a4c9b8602633d9d6c849989594
SHA512 8009139f31bd7102bb4d53f0137f6ca29307cb0721a17f6e6ba638c491867b7de193c27b198f03d93abbd14c83c25ee5cd925b887e99393bd2e2abd5cd882064
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T10634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcausmkecx.exe

Path C:\Temp\hcausmkecx.exe
Size 226KB
SHA256 5e212ce2cea914bed7fe58877a38675a7b283378ebd22045d8bc67ac2e05d87a
MD5 dcbd8778df0dde7ff5fd030bed16b832
SHA1 f17fd8e31fcc247ca3b87d0d605bdb499be482c5
SHA512 7191deffe9361300298fdeb20a75f9a9651c8a1c7821cfc70b0a03efdf1b3af158d04d47906151542c66743ae68f9c97db40fd729eef113d23e715f5ecee5cda
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T10F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtrlgaytq.exe

Path C:\Temp\i_bvtrlgaytq.exe
Size 226KB
SHA256 ec309b74b64941d606067df906a97ff1289c2d4c65f5950c247a1a270b44f5aa
MD5 632373346fdc4548a8b849d9febf984f
SHA1 6446401f237bdbb2c75e9029ae3b743f2837d29f
SHA512 86c4fa9096c44d992c0a1438488de057c5a8cb1cd34ea693f13e7dd79de6c93d79f957316766554297f4ae99d2bd943db28a1056b87b197a4ff6093423124fde
SSDEEP 3072:2GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:tXY4LK+a3lLNngoqRttA7
TLSH
T1C834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hcausmkecx.exe

Path C:\Temp\i_hcausmkecx.exe
Size 226KB
SHA256 2dd6d60ceb198b1ddc8b2b88bb93d9c5b9acf83e04b338dd2a84e2b8e95b0090
MD5 ebad7c35b5b9201db156338684c08daa
SHA1 8615553c002405ce2b16233468ee9bd215352a34
SHA512 f154af5fbed0fe2e80fadebf270965ef866d04f67ebc137011438c421b6ea2d04bd75353d1cd85b6453597f4c7fbf6661b74999e9ec15c04d004028580014a0e
SSDEEP 3072:6GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:BXY4LK+a3lLNngoqRttA7
TLSH
T10634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kecwupmhfz.exe

Path C:\Temp\i_kecwupmhfz.exe
Size 226KB
SHA256 8f88afd9752132bc313d54078de55e0b2438a7a741d842c3080daa2bd0e6176c
MD5 5a25f11b46779750d2148af9691c1fb8
SHA1 48c7dca112cfab2bb75e2d4f1488ce747c9faa6e
SHA512 c5fe686c5c4660844e95ed57f1fc6ab83ac8e83bfe00e27c0aef155afc2e7502a4f518a49a3a6facaf03a6e3fa4f0e81262ac0dfff9354a72fdb60b80680e153
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T1EF34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgeywrobyt.exe

Path C:\Temp\i_mgeywrobyt.exe
Size 226KB
SHA256 5a9778967992810ce2fd50be39f4ba17c36246506d4043d440dae772e7b96b52
MD5 c04bb5f70dc7fad0cb465ef7994720e5
SHA1 08ccab4781dc85bef5ff8e70226c1a3c0e369f1f
SHA512 6aa4a2fbcf9c2d3659f1df3cfca339a582221c2be2a55bcf8e236bc9817cb6e7cc5047f3e7083ee9cf0ea32c0c3de8224341a2c2386af0ef8c588bc1f0d20515
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T16E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigaysqki.exe

Path C:\Temp\i_qnigaysqki.exe
Size 226KB
SHA256 86c503b8e628eb2d7153acc3bb6d3267c6f848246057e193cc67e15de7268b51
MD5 f97fb7e97fb739fa36063bcd40aa9b56
SHA1 b887324dbabc6386c537a81a2b8c8cc70e8341a1
SHA512 6dc24b9a8d1fef99029630765cf35649b21564f813dac17933d718f1bb71c547b15231b6b2260b48c02e720dc57d7add32e6ccb865df369ec8f26519fba909e6
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T10E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomgezwrpj.exe

Path C:\Temp\i_uomgezwrpj.exe
Size 226KB
SHA256 6b7a465fbd38cd9bd228c64a5523f2ef6e93dedcc224120e0fc1ba2217045cb4
MD5 c0bf7f13ba402bc6cd7ff686b82605cc
SHA1 7cf9a79a8fd7da73e4dc5ad2e4a00ce5f27579af
SHA512 af72ecc854b66b534e552e01e3a37ecb9f5b4a043955811c6bdcd8aa2d0df062b0a8a71838e12e01e2159cd9c5178f3a2523e628a620cb35edfbc381306c691e
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jecwuomhez.sys

Path C:\Temp\jecwuomhez.sys
Size 141KB
SHA256 552d25a1b5e582581115462b17be601fcae2c1d2c02e013106f797e7f65cf733
MD5 fb467fc97d987e161a0e64dbce8390e7
SHA1 0ddd56f0267b212c7833baf8d604835c5a57e575
SHA512 c4ac44831d91b7f246bf631b9c895c2ffd7219543cee6370297b289b8c53e6182add2a4956c2247dc1fc498d848f34ea65d92b4c24ad120cf2f8423ef2088412
SSDEEP 1536:Va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwupmhfz.exe

Path C:\Temp\kecwupmhfz.exe
Size 226KB
SHA256 84e00716ab589c467d57b154db1be553e74f8acb1f5617e6a685e760c8a52c4f
MD5 1beb88dc1092eb3be7f7c12edc2f5a81
SHA1 d78c14379d4d2d60db8e8d2db43a3ec20aabefab
SHA512 fc32896f4a3327de23103db57d2581c54f691c8b244c02bd35b017ebf681f5ab749c656801d61adf53983bb0c6945b6f653be1987ebb1970f83875adfe4dc1d3
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T1D334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbwtolga.sys

Path C:\Temp\lgdbwtolga.sys
Size 141KB
SHA256 84452fad45b38bf95d43c1c61b3990403c0778add33ebcd7c522d45272880cf6
MD5 880318fe1f11f7a8bee8178f412e25b6
SHA1 54635a60e2657ea94a5a1e00b4fa9e11d283b8bb
SHA512 5abe0eddee9106eefeaa0fca66f097a516df870c5338a536df7d5d38b843708a40428bf9ae40c26a5bae8ee8b63eeb41bcab4179cc6af10f69d8486a1ff8a033
SSDEEP 1536:Pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T114E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywrobyt.exe

Path C:\Temp\mgeywrobyt.exe
Size 226KB
SHA256 d8af19fdd5bf903dc25a7fc40dc9a67e6b8c13841d748026c14356d0b1d7b7e1
MD5 66baa0de114fc99ccb8da2a611013cc2
SHA1 e37fe19590c4414bb12721b9eda331e417125e2b
SHA512 aea5bdfcb8c5c37ffd688165f55ed44c4e15a96376eabd49674dfc17adfd13942202145c20f67244e53790879b712a588494daff9c51ecc1d77c7b7f4323c07b
SSDEEP 3072:yGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:ZXY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.exe

Path C:\Temp\qnigaysqki.exe
Size 226KB
SHA256 c084fe4f28cdf02b25668b6464c576f8a6594b6a30df9fc0b5237ea49ad0fbb6
MD5 7b0d4a6f755d56a7e379974a9c8cdb4e
SHA1 e3251fdc848bc29cfb61a020d37c106ea1411cc0
SHA512 43d624a3c9c0dd9597dea1784c64bfe89eb1521863dec09464e35fcf8a270f91798f2d5a541530be7caa7a04bedac4e8b3d5c63d395537e17fa348cbe1a497d9
SSDEEP 3072:WGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:NXY4LK+a3lLNngoqRttA7
TLSH
T16234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.exe

Path C:\Temp\uomgezwrpj.exe
Size 226KB
SHA256 216d7f77adb8d28d672f9ea68fdd7eda914991cf5c8ae4137f9f110fa4bded6a
MD5 fa4f907d2fa84a028f1a918f22e38aea
SHA1 92f52e6f71b2777f8216941363e37d992319cded
SHA512 a339b3fce019811b97a957227ee39c417e428d2d7ccba79fce64cab2d166d9cdd2053acdd2627c2108442f077f974728aa6253cf062751c3a30de089d9e79f81
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T17234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkecwupj.sys

Path C:\Temp\usmkecwupj.sys
Size 141KB
SHA256 f44dd7f1e73d263601bae012aff9755637b049b23cdba61a546b7767789b4b98
MD5 8e00fd837ace98ae4a4fbf5ffc27be44
SHA1 ec3cb464c80dc2a65cb3df3817b3c3345c08d995
SHA512 2c0d9899775b5ae441d4868e2e768aa6310dadb9d2bbd745bb1bf6dcfe7386fbec065a37ef257560ce3f5d3e1783477e8e2c0a8afaae4fed03fb2be6f92ad071
SSDEEP 1536:xa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:xa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CFE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlfaysif.sys

Path C:\Temp\vqnlfaysif.sys
Size 141KB
SHA256 db4c2142b5c795cdea1bb3d4ec61420c19792c066fb4536e184990873cf314ce
MD5 1dda37dccea47c9c62e83213483b2524
SHA1 2f0028f3dda80b56e4adda3771ea1a5ef2ba105c
SHA512 9f61a43a9477c44b6fecd85c7dfd6542bfc58568e6150d7305e44e0eaad5fba039ecd84937f924b1af033e4044a82109a394c8df769b8bb8d1bdec3ac0f606ad
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T17DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgezwro.sys

Path C:\Temp\wuomgezwro.sys
Size 141KB
SHA256 6d167a0b824b47627e8cc14e87a46d12dd00a97c341dacfcefcdc3b882f234ef
MD5 32d1f9780308be016580b1bf751e37be
SHA1 00f67569d4454dd745f24297d1c248e31f836212
SHA512 91c824b5fb8817966df611d69695367bf89a43d8db7f4b59cfb5f065d8118469adb28de742aeb74ecd5636fd774bc3c463dbcedf25dd9ea721dc59a14dfa15a6
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T163E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 b3a5272c30f7526ed719d1c23fbbf2a664ce200da98fc69918ab7f8ba4f20903
MD5 6aa2adb89bcc3973e622b85ad58e38ba
SHA1 020c781359a16ce1fa10f7a593ad7c6340efdaa6
SHA512 4cf00a3ebf14f3e625dac910de1d979319d596fc2722ecd93a3f31abf0bfd41f91e9a194434fa57d1628921a8c4084484706fb480c5d18522aceabb9b28a19e8
TLSH
T134E02BF6C8229C2B08FE072979941745D70113672B40591F373D820CCFB473B459A91C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8ba3e7eb96a22915c1a28c4016b7d7cc31320ce83d9e0d58134dd4890de19660
MD5 3ee698f80dd7f29c209fe76b4b64ae1c
SHA1 5881211244afb2e4faea691ba8c61d0097988d1c
SHA512 a5b2012e9d2d05f1fc91dce83337bd421932abc32cee7d6d5ce754ceb68267917b793fddb522a59c9bc46b1c34f85dd20fe3b96ac6791b1e8467a38a0b02c89a
TLSH
T1DD41C1F7C3E4866D8A0195F0BA18BE2FCE1D0914436C3D9AC5E4AF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 01f890832de115c0a3dacaceae0db074fed1b81f89f5b0d7a4efad883a1d3bda
MD5 660b5c5ea86551b170fb5a3d23907d41
SHA1 d61440ca1a8be21cb281f951a4bfd73073ea01df
SHA512 61839c239461f4fc49ea4587131837213b2603b2d54999cbb0ff7281b1b37c65d9b69cfa81348e8be98458f01822d22066dcf9bce60acd1e8a1024ebb66a5bd0
SSDEEP 192:sxZVRWyMqZjK1Ml8UQYcf/fmsKqKQ7PgYsj0qzodpZ2/W6+WNsX//Y0ZpBxIg50G:sxZVTq3f/fmsKqV7orj0R4/bc/5vGLC
TLSH
T1BC7209166638997B8CDBD219FA557B53D7F91563D2900E44AAFCCB0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a120ce65d4e4096ef486c9423e55fb8357475110a916c08656c202590c1c8088
MD5 ff2063233b3bac56088b072c8cafb811
SHA1 02bff60b2c9bc2657df31d4d6183ecee56f1e295
SHA512 e19fcd0fee9882eecfedadd825f1d903733e348010c8c8dc4aa5ed8e852dfcf5caf5e1aff7c5c94015ceeb0d82962495d93bf8481ea2dd4a4ea5a9308f7d84ea
SSDEEP 192:sxZVRWyMqZjK1Ml8Mcf/fmsSDKQ7PgYsj0qzodpZ2/W6+WNsX//Y0ZdBxIgjJ1J:sxZVT0f/fmsSDV7orj0R4/bc/5bjJf
TLSH
T1FB62F8166638997B8CDBD219FA557B53D7F91663D2900E44AAFCCB0C00E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 c0fded08c2130319574c3ffa0cda333227a5701cfcfcde1b4d66b427f88ab059
MD5 ab0fd7fc9ad9f3ac99aa07f451ce0b1d
SHA1 cde5f3e8cfb32d333523f970433fdbcda175de57
SHA512 07eade2827d470462820d7182962d52ef7b5c3f31ba18044230d9ec9377dd095f1fb2e7e3db0cc1f4f089cc04921edef294988c26a7c074b29ae4a26f8a1d696
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3YGq9Ll1:XwZh38Dv2SkEnZFWRm6GQFmu1jaKYGqV
TLSH
T115030A3B280CCB7E4F844E9CED267F8A6EE8028B56988D5447FA494C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 68d9968d36886951376da8a0f2fc010a9b591c13c8ce43c07186d22f8a55bf35
MD5 e7f520c547567311a7a59b6dd482d3bc
SHA1 72b4a15d3a6080a77a9e1a371cc8ae0fe5d22f83
SHA512 e360258ff7064eddab2b099a7f04c17c4f94c654a576c7fe8ba14baea4e963b2ab4b0aa7091340472e14ff6c169eeeabd263915d02733c989f49193cec088f51
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlBN5G:ctGj+BCNC5qFVpKxBnG
TLSH
T1D0B2651632FA02023C3DB91D87A597371A42B1633058E93B7BE954BA4E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 72fd0d868f43f14cb4cf0d0adf2732ef552e3cceb458165bdad34fcbb7770d11
MD5 668c4ab7ad50daee934cf357e35bcbdf
SHA1 7579e67b00c8b10a95bcffdaaeabfb125c02f3d2
SHA512 b421f8f4956a4146edec80cbdfb44f8c5fab3df2de579b526d2f714ffafe0e6c6c368a0f102aed5a1055d01554b4ace61029de8027cbb364bfba1a1649ae313e
SSDEEP 384:njiF9CcmyWCs38NW8TUNTUlIRwrk6IQO91if+Aot5ja7XbnA3Lty/7IgJ:OFccps3VwgZ7koLebnAs
TLSH
T183B24A32E8A9CEA7EDD75B99F35A3243DEE0516386C89ED4D9E84E0C008B1DD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 9a58461b77dbcf5b31e1308c0bbd09c71843383a6e9e161d11c45fb2161e6b88
MD5 a9b819ef3647e4a5a5c1b40e2db07adb
SHA1 a18efdb1aceb605e667ea72a7a85ecf4f1773450
SHA512 1c5d173a552aacd6f04c6354e7089f34ca7c385cf5d1281106b79ee5776bb2e4ee618fe6c1fc52b8f1f02eec59d28a86508731754356937dbd50c18e66df85b7
SSDEEP 384:nPiF0CcmyWCpR38NW8TUNTUlIRErk6ItO91if+Aot5ja7XbQACddblI4H+H/ty/i:aF/cpz3Vwgx+koLebQACfH+Ajwn
TLSH
T16ED25C32D8A9CEA7ADE75B99F35A3643DEE0116785888ED4DAD85E0C008B1DD170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 52641a2b922e856be34940a31d8c0e1eec6148f16f84cdefa5e16a211d66e25a
MD5 99840c61dc9497c09fed5a966d01a6ff
SHA1 2728b244f9b4ade3065842754bdc291c7d0b88b9
SHA512 e7b3ff7fea0b96a7e08230f8dc40278896c28693d445495285b91d4667a80fbc8ce3fb22a169052007335d27d492bb3e93f7ad529e4747148217db2e142d5244
SSDEEP 384:njiF0CcmyWCbR38NW8TUNTUlIRErk6IrO91if+Aot5ja7XbQACddblI4H+H/ty/i:OF/cpd3VwgxIkoLebQACfH+Ajwn
TLSH
T1D7D25C32D8A9CEA7ADE75B99F35A3643DEE0116785888ED8DAD85E0C008B1DD170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 be9ea0238ee519b19362af02d8c158c1bf8636df194ba2cef97c574bf90cedd8
MD5 9d16fa06b7f03d01132fbeccb907c56e
SHA1 c761aded242632855f274a350fbba62d8f3a87f6
SHA512 6ba9b8d5153821a5c25d22aff09dceee47bea47cfadf47e83a8eeebbb328a13da7768a0133507752f274d6a09ff9dbd9d0b6f78af3d3be65fdfb64ba3a11324d
SSDEEP 384:nBiF9CcmyWCs38NGZ8TUNTUlIx0vGrk6o2vF1if+Aot5ja0SBe4KV8p0Epty/7Iz:oFccps39Zwgqv9yvsoL9SBI8p0c
TLSH
T1CCB25C36EC99CABBEDE64F99F74A7603DEE0516782C89AD4DAD81D0C00C719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 50217a93154b9b3095ef5e5735060e278a2d7cc846c5c2395c16c872c8f82e47
MD5 2de2d74c60b89e63545c5b959b9fab50
SHA1 b246b37f682b4478c4f2744686843ecef861dfc5
SHA512 d2cab447d7ac8eb4d0fd76a6720e880f8da9b3780bfd44bdbd23689e9988865ec7eab660bc366fb581249b019719ed038c5cea8c137e7edf2f59caf5c3055ca5
SSDEEP 384:nxiF0CcmyWCf38NW8TUNTUlIRErk6IVO91if+Aot5ja7XkOACddblI4H+H/ty/7+:YF/cpf3Vwgx2koLekOACfH+Ajwn
TLSH
T1DCD25C32D8A9CEA7ADE75B99F35A3643DEE0116785888ED8DAD85E0C008B1DD170FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.19.1\typosquatting_list.pb
Size 397KB
SHA256 a2ce65565de87ad65e06a827fa388c975c9231d335beaf67ec4011b39f3e69f7
MD5 88ff091d8125bda1a06ed624cbb39219
SHA1 3ba3dd813cf25e39d8118ac38c98d58d80107f9b
SHA512 c48448a9028b059e9a0f6651c8552782472fd5efc77d35464b7acbc2b1a3d782adf6f48056779c6f67ae3bac6f20761c760d36cc543ab3a730c7de4ef528e27d
SSDEEP 3072:nOmXKKKxPTa5ORUEaT7sfD0yTFSp1+A9q9JyNrylwks:baKKxe8avgVr9YN6wks
TLSH
T10D84A3B9DFC00150DB78112D20BE71D8181412A580E9DFEAFE7D865F2BC2AC977E85E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 ff86879db2eec7562e3b2f6094aed59ce1c90abf93c8dfd7a4f5695ba70bb239
MD5 84c6f2b40193ed4b2d80a7eda31af6a4
SHA1 19b8b76fe1383b2e61eeadff8826c3d9bb9c5631
SHA512 e9551bf123897b1c143a03a7293be4d004a4b700271bb08bf5c8d6564cc180a59f8a72a9320f533f58c0d99c067554a1e2b1215c68669498bfed1a7541b8d498
TLSH
T182415EE14C3D6AC2D0BD0EAF74DB34EC96D8D725F1A4347A2868EAA40A3D61D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4f86d86f4f6c0a6e43ab2ccb6ab092fe9eded74d7dbee6eb2bb49701bbe43270
MD5 1dedb1a782ceb940f426b8ead3c20756
SHA1 e1debb815d77daa87748864843a5acd5186b8184
SHA512 7bbde22f266d4c4400c7cbdc5640185eaf74a55092ff12ff3d6b68f5f7497bb1aeac13b2e6e37c582fb912c09cb8b00eb0eeac2c4e0504a19cdb927c1278c152
TLSH
T18C4144E14C3966C1D4BD0A7F70CB34FC95D8D725F5A4347D2C68EA984A3961C248543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4d648759735cc04b29d14db69db2dbff9b8b361f7190bcdafa9ab117d7ab699c
MD5 ca8cb67d7d7c7355f0b516009e6839a7
SHA1 35c85ac563c5b384db66e89286f49efb49eaa380
SHA512 4a13131d38296a66736813e229bfe039c52e723dbf32b7fe8df152540a15dc476224bc3bd187791cc5ea9ccd269d19c59379a6b4878bc0c719cb8c6165dda302
TLSH
T14F4163E14C3D6AC2D4BD0A6F70CB34FC95D8D725F1A434792C68EA98063951D248543F
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1150310547\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_1863843943\manifest.json
Size 118B
SHA256 4b3be55f09ddc486485a1e8b1d551f970646384a8bf530a9211a47a68bfb5058
MD5 9a19fd388e446c195b1b6e81936be92e
SHA1 33ecabb6c265eb85b65df37d776167cf6c422e6d
SHA512 84fda76a03333473d738e218e25e261c2dfede223d45e9a39c2f0a1b486dd162889580361f2988e7d04d16be70fb62ccdeacf135b1b3d071e14bcb0c09b9da94
TLSH
T118B092B00C5AA47B22C09360ECA06A8283F81218E8061B1A089036482F9817880362F2
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_7821526\data.txt
Size 145KB
SHA256 5f9da8ac4889421d2020e6246daa63b3d5d4fb5a19019b1c20fc803481f01484
MD5 b4802e5464604d772904c865a0d5e532
SHA1 77d577350787cc6d5fe65bdcb5e2a574f552fcf7
SHA512 05205448cf3424787f64bc99dd6b958ec497f1963a2d37a7fcac3cc9676b389e151ea456913c36358d07a92b6864557927fe0f53c37f890bb285a0e5446fd31f
SSDEEP 3072:UPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEgG5v7UFSk8KH99jo:4X1aI5aZoKzMJ07NJB7U58KPo
TLSH
T15CE3F220CDC45FD8DFAC252C90BE0B1DA391C69D842A7686E763FE4ABF9760452271CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5920_7821526\manifest.json
Size 52B
SHA256 90f59dd0f7cd3fb4906d133943819da7aaf33f7ae5b5a0241e03ddea2611885d
MD5 c86c55c53e2bf572642bd11d17a15dff
SHA1 dd16da5cbdc5519179a01396cb94f1194a814939
SHA512 a079421f077a5f2b822469efb6f4b1822e095beff27b2d1551c74d1d880c9fe085bc0f64ea040d17be2d2ad2969051e13f3a782e72bfa692752a16c3316fa49d
TLSH
T185900270042591172AC10E506570F8859391661955860D1D08551548029546CE4502D8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/224-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/388-262-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/580-413-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1644-687-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2072-707-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-306-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2336-311-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-233-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-310-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3128-348-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-360-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3144-331-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3532-445-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3724-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4020-220-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4060-192-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4384-425-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4964-390-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5004-458-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-400-0x0000000000010000-0x0000000000083000-memory.dmp

Download