e5d2ce7b6cb52c9928f3a099a5b85f4ca2a875c78bc8817e17d9a46a3e5b064a

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260528-kjmxvacv61
SHA256 e5d2ce7b6cb52c9928f3a099a5b85f4ca2a875c78bc8817e17d9a46a3e5b064a
MD5 69fe3fee110308da689e196918016adb
SHA1 1b19cacc5edf8962769ea4ed254db74d1a16386e
SHA512 f371cd98ff4c045689ceacb442037469a8ae5faab6c9af95777ced8de30d3af486af02fcb95a2966abd46fdb76bcd5340b7524476c8effee3207fa7ddd0182eb
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T1FD34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2304	CP.exe
5600	xrpjhczusj.exe
4512	CP.exe
5396	CP.exe
2336	i_xrpjhczusj.exe
5324	czurmhezwu.sys
3896	CP.exe
3044	jebztrljey.exe
1644	CP.exe
3428	CP.exe
1344	i_jebztrljey.exe
4856	ojhbztrmge.sys
2592	CP.exe
2668	bztrljebwt.exe
1308	CP.exe
5024	CP.exe
3036	i_bztrljebwt.exe
5932	jdbwtomgey.sys
5520	CP.exe
5856	vtnljdbvto.exe
1792	CP.exe
5696	CP.exe
2840	i_vtnljdbvto.exe
3376	bvtnlfdyvq.sys
5088	CP.exe
3960	nlgdywqoig.exe
5472	CP.exe
2036	CP.exe
124	i_nlgdywqoig.exe
4144	vqoigaysql.sys
1216	CP.exe
3136	fdxvqnifax.exe
3192	CP.exe
5296	CP.exe
3772	i_fdxvqnifax.exe
4240	nkfdxvpnhf.sys
1896	CP.exe
3752	fdxvpnifay.exe
2508	CP.exe
2076	CP.exe
6040	i_fdxvpnifay.exe
4720	fcxupnhfzx.sys
1152	CP.exe
2504	usmkfcxrpk.exe
4700	CP.exe
5828	CP.exe
5016	i_usmkfcxrpk.exe
4020	wupnhfzxrp.sys
4892	CP.exe
2472	mhezxrpjhb.exe
4176	CP.exe
1496	CP.exe
5184	i_mhezxrpjhb.exe
1332	upmhezxrpj.sys
2808	CP.exe
5880	czurmjecwr.exe
1048	CP.exe
1832	CP.exe
1212	i_czurmjecwr.exe
2556	jhezwrpjhb.sys
1008	CP.exe
3944	ztrmjebwuo.exe
4816	CP.exe
4948	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-mobile-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\wallet\wallet-notification-config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\runtime.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Tokenized-Card\tokenized-card.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\hub-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-hub\fi\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-hub\zh-Hans\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\en-GB\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-tokenized-card\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\wallet\super_coupon.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Wallet-Checkout\wallet-drawer.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-mobile-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Wallet-Checkout\wallet-drawer.bundle.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet-webui-792.b1180305c186d50631a2.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\webui-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\cs\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-hub\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\ru\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\wallet\README.md	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet_checkout_autofill_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\de\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-mobile-hub\fr\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\ja\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-tokenized-card\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Wallet-Checkout\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-mobile-hub\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\ar\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-tokenized-card\pt-BR\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\wallet\wallet-checkout\checkoutdata.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\manifest.webapp.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\sv\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Notification\notification.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet_donation_driver.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-hub\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\es\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\app-setup.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-ec\nl\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet-crypto.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\ko\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-tokenized-card\id\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\driver-signature.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\bnpl\bnpl.bundle.js.LICENSE.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\pt-PT\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification\zh-Hant\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-shared-components\hu\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet-webui-227.bb2c3c84778e2589775f.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet-webui-992.268aa821c3090dce03cb.chunk.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\wallet.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-notification-shared\it\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-hub\fr-CA\strings.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-mobile-hub\ar\strings.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebztrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjebwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zusmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqojgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebztrljey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdywqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxrpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnljdbvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvqnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurmjecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kecwuomhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurmjecwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjebwuo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2512	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
232	ipconfig.exe
1300	ipconfig.exe
1760	ipconfig.exe
4760	ipconfig.exe
1248	ipconfig.exe
4904	ipconfig.exe
4640	ipconfig.exe
3496	ipconfig.exe
3064	ipconfig.exe
6028	ipconfig.exe
3624	ipconfig.exe
5096	ipconfig.exe
5368	ipconfig.exe
2476	ipconfig.exe
8	ipconfig.exe
2080	ipconfig.exe
4240	ipconfig.exe
1952	ipconfig.exe
3032	ipconfig.exe
1484	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "3828112189"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31256222"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134244310860131262"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{BD61BE97-EFFF-48B7-BB56-D290895B60B3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5440	msedge.exe
5440	msedge.exe
5440	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2336	i_xrpjhczusj.exe
Token: SeDebugPrivilege	1344	i_jebztrljey.exe
Token: SeDebugPrivilege	3036	i_bztrljebwt.exe
Token: SeDebugPrivilege	2840	i_vtnljdbvto.exe
Token: SeDebugPrivilege	124	i_nlgdywqoig.exe
Token: SeDebugPrivilege	3772	i_fdxvqnifax.exe
Token: SeDebugPrivilege	6040	i_fdxvpnifay.exe
Token: SeDebugPrivilege	5016	i_usmkfcxrpk.exe
Token: SeDebugPrivilege	5184	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	1212	i_czurmjecwr.exe
Token: SeDebugPrivilege	1232	i_ztrmjebwuo.exe
Token: SeDebugPrivilege	488	i_lgeywqojgb.exe
Token: SeDebugPrivilege	5012	i_yvqoigaytq.exe
Token: SeDebugPrivilege	1604	i_qkidavsnlf.exe
Token: SeDebugPrivilege	1844	i_kicaysqkid.exe
Token: SeDebugPrivilege	2484	i_icausnkfdx.exe
Token: SeDebugPrivilege	3520	i_zusmkecxup.exe
Token: SeDebugPrivilege	2596	i_rmhezxrpjh.exe
Token: SeDebugPrivilege	5552	i_kecwuomhez.exe
Token: SeDebugPrivilege	244	i_ojdbwtomge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 4220	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 4220 wrote to memory of 5440	4220	iexplore.exe	81
PID 5440 wrote to memory of 3216	5440	msedge.exe	82
PID 5440 wrote to memory of 2512	5440	msedge.exe	84
PID 5440 wrote to memory of 3556	5440	msedge.exe	85
PID 5440 wrote to memory of 3556	5440	msedge.exe	85
PID 5440 wrote to memory of 3556	5440	msedge.exe	85
PID 5440 wrote to memory of 2884	5440	msedge.exe	86
PID 5440 wrote to memory of 2884	5440	msedge.exe	86
PID 5440 wrote to memory of 3744	5440	msedge.exe	87
PID 5440 wrote to memory of 5664	5440	msedge.exe	88
PID 5440 wrote to memory of 3744	5440	msedge.exe	87
PID 5440 wrote to memory of 3744	5440	msedge.exe	87
PID 5440 wrote to memory of 5664	5440	msedge.exe	88
PID 5440 wrote to memory of 5664	5440	msedge.exe	88
PID 5064 wrote to memory of 2304	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5600 wrote to memory of 4512	5600	xrpjhczusj.exe	93
PID 5440 wrote to memory of 932	5440	msedge.exe	96
PID 5440 wrote to memory of 568	5440	msedge.exe	97
PID 5440 wrote to memory of 932	5440	msedge.exe	96
PID 5440 wrote to memory of 568	5440	msedge.exe	97
PID 5440 wrote to memory of 2672	5440	msedge.exe	99
PID 5440 wrote to memory of 6040	5440	msedge.exe	100
PID 2672 wrote to memory of 1788	2672	msedge.exe	101
PID 5064 wrote to memory of 5396	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	104
PID 5064 wrote to memory of 3896	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	108
PID 3044 wrote to memory of 1644	3044	jebztrljey.exe	110
PID 5064 wrote to memory of 3428	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	113
PID 5064 wrote to memory of 2592	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	117
PID 2668 wrote to memory of 1308	2668	bztrljebwt.exe	119
PID 5064 wrote to memory of 5024	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 5064 wrote to memory of 5520	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	126
PID 5856 wrote to memory of 1792	5856	vtnljdbvto.exe	128
PID 5064 wrote to memory of 5696	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5440 wrote to memory of 5136	5440	msedge.exe	133
PID 5440 wrote to memory of 4108	5440	msedge.exe	134
PID 5440 wrote to memory of 6084	5440	msedge.exe	135
PID 5064 wrote to memory of 5088	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 3960 wrote to memory of 5472	3960	nlgdywqoig.exe	140
PID 5064 wrote to memory of 2036	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	143
PID 5064 wrote to memory of 1216	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 3136 wrote to memory of 3192	3136	fdxvqnifax.exe	149
PID 5064 wrote to memory of 5296	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	152
PID 5064 wrote to memory of 1896	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 3752 wrote to memory of 2508	3752	fdxvpnifay.exe	158
PID 5064 wrote to memory of 2076	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	161
PID 5064 wrote to memory of 1152	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2504 wrote to memory of 4700	2504	usmkfcxrpk.exe	167
PID 5064 wrote to memory of 5828	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	170
PID 5440 wrote to memory of 5580	5440	msedge.exe	172
PID 5440 wrote to memory of 5580	5440	msedge.exe	172
PID 5064 wrote to memory of 4892	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 2472 wrote to memory of 4176	2472	mhezxrpjhb.exe	179
PID 5064 wrote to memory of 1496	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	182
PID 5064 wrote to memory of 2808	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 5880 wrote to memory of 1048	5880	czurmjecwr.exe	188
PID 5064 wrote to memory of 1832	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	191
PID 5064 wrote to memory of 1008	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 3944 wrote to memory of 4816	3944	ztrmjebwuo.exe	197
PID 5064 wrote to memory of 4948	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	200
PID 5440 wrote to memory of 3984	5440	msedge.exe	202
PID 5440 wrote to memory of 3984	5440	msedge.exe	202
PID 5064 wrote to memory of 5744	5064	2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe	205
PID 3772 wrote to memory of 1124	3772	lgeywqojgb.exe	207

C:\Users\Admin\AppData\Local\Temp\2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_69fe3fee110308da689e196918016adb_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ff87808c188,0x7ff87808c194,0x7ff87808c1a0
      4⤵
      PID:3216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1842776051664149116,13717920068502577987,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:11
      4⤵
      System Time Discovery
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5669081984159271738,3052953199099925014,262144 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:2
      4⤵
      PID:3556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,12221850251650551149,2833398629596780059,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:13
      4⤵
      PID:2884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11389849248686779213,3087077823284596563,2097152 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
      4⤵
      PID:3744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3977539609898462967,1082409453936183881,2097152 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,1856112482539794544,9844611145290969531,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,2891938429549165305,5385724081619406617,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
      4⤵
      PID:568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2140770421281023395,11993441860866251510,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:1864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9868005412451676221,16986689434780002046,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,2140770421281023395,11993441860866251510,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,13439170303622151862,5278851305722477216,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2693191192956103926,4192795684019540215,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:4108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,16540537337281190414,5949074219893635423,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2464020069556796692,14653986831026963124,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,13724811847839022316,17622420873810986428,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      PID:3984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,3529545704867650025,5811737050938716552,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:5320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5672,i,12298882316967903,2674142653766523783,262144 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,12677863288254625266,13932111672358696511,524288 --field-trial-handle=2428,i,15112020318757856417,12926268764233085885,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
      4⤵
      PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhczusj.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2304
- - C:\Temp\xrpjhczusj.exe
    C:\Temp\xrpjhczusj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5600
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhczusj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5396
- - C:\Temp\i_xrpjhczusj.exe
    C:\Temp\i_xrpjhczusj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebztrljey.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3896
- - C:\Temp\jebztrljey.exe
    C:\Temp\jebztrljey.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebztrljey.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3428
- - C:\Temp\i_jebztrljey.exe
    C:\Temp\i_jebztrljey.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\bztrljebwt.exe
    C:\Temp\bztrljebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5024
- - C:\Temp\i_bztrljebwt.exe
    C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnljdbvto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5520
- - C:\Temp\vtnljdbvto.exe
    C:\Temp\vtnljdbvto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5856
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnljdbvto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5696
- - C:\Temp\i_vtnljdbvto.exe
    C:\Temp\i_vtnljdbvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlgdywqoig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5088
- - C:\Temp\nlgdywqoig.exe
    C:\Temp\nlgdywqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlgdywqoig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2036
- - C:\Temp\i_nlgdywqoig.exe
    C:\Temp\i_nlgdywqoig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvqnifax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1216
- - C:\Temp\fdxvqnifax.exe
    C:\Temp\fdxvqnifax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3192
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvqnifax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5296
- - C:\Temp\i_fdxvqnifax.exe
    C:\Temp\i_fdxvqnifax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1896
- - C:\Temp\fdxvpnifay.exe
    C:\Temp\fdxvpnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2508
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_fdxvpnifay.exe
    C:\Temp\i_fdxvpnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxrpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1152
- - C:\Temp\usmkfcxrpk.exe
    C:\Temp\usmkfcxrpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxrpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5828
- - C:\Temp\i_usmkfcxrpk.exe
    C:\Temp\i_usmkfcxrpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1496
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czurmjecwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Temp\czurmjecwr.exe
    C:\Temp\czurmjecwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1048
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:8
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czurmjecwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1832
- - C:\Temp\i_czurmjecwr.exe
    C:\Temp\i_czurmjecwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1212
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrmjebwuo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1008
- - C:\Temp\ztrmjebwuo.exe
    C:\Temp\ztrmjebwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrmjebwuo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_ztrmjebwuo.exe
    C:\Temp\i_ztrmjebwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqojgb.exe ups_run
  2⤵
  PID:5744
- - C:\Temp\lgeywqojgb.exe
    C:\Temp\lgeywqojgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqojgb.exe ups_ins
  2⤵
  PID:5968
- - C:\Temp\i_lgeywqojgb.exe
    C:\Temp\i_lgeywqojgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqoigaytq.exe ups_run
  2⤵
  PID:4640
- - C:\Temp\yvqoigaytq.exe
    C:\Temp\yvqoigaytq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqoigaytq.exe ups_ins
  2⤵
  PID:5156
- - C:\Temp\i_yvqoigaytq.exe
    C:\Temp\i_yvqoigaytq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavsnlf.exe ups_run
  2⤵
  PID:4968
- - C:\Temp\qkidavsnlf.exe
    C:\Temp\qkidavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2460
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavsnlf.exe ups_ins
  2⤵
  PID:3852
- - C:\Temp\i_qkidavsnlf.exe
    C:\Temp\i_qkidavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaysqkid.exe ups_run
  2⤵
  PID:6120
- - C:\Temp\kicaysqkid.exe
    C:\Temp\kicaysqkid.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaysqkid.exe ups_ins
  2⤵
  PID:664
- - C:\Temp\i_kicaysqkid.exe
    C:\Temp\i_kicaysqkid.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfdx.exe ups_run
  2⤵
  PID:3736
- - C:\Temp\icausnkfdx.exe
    C:\Temp\icausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfdx.exe ups_ins
  2⤵
  PID:4812
- - C:\Temp\i_icausnkfdx.exe
    C:\Temp\i_icausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zusmkecxup.exe ups_run
  2⤵
  PID:4124
- - C:\Temp\zusmkecxup.exe
    C:\Temp\zusmkecxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5588
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3032
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zusmkecxup.exe ups_ins
  2⤵
  PID:5272
- - C:\Temp\i_zusmkecxup.exe
    C:\Temp\i_zusmkecxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmhezxrpjh.exe ups_run
  2⤵
  PID:2060
- - C:\Temp\rmhezxrpjh.exe
    C:\Temp\rmhezxrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmhezxrpjh.exe ups_ins
  2⤵
  PID:484
- - C:\Temp\i_rmhezxrpjh.exe
    C:\Temp\i_rmhezxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kecwuomhez.exe ups_run
  2⤵
  PID:5584
- - C:\Temp\kecwuomhez.exe
    C:\Temp\kecwuomhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kecwuomhez.exe ups_ins
  2⤵
  PID:3284
- - C:\Temp\i_kecwuomhez.exe
    C:\Temp\i_kecwuomhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojdbwtomge.exe ups_run
  2⤵
  PID:2068
- - C:\Temp\ojdbwtomge.exe
    C:\Temp\ojdbwtomge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2340
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojdbwtomge.exe ups_ins
  2⤵
  PID:932
- - C:\Temp\i_ojdbwtomge.exe
    C:\Temp\i_ojdbwtomge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4948

C:\Temp\czurmhezwu.sys
C:\Temp\czurmhezwu.sys
1⤵
- Executes dropped EXE
PID:5324

C:\Temp\ojhbztrmge.sys
C:\Temp\ojhbztrmge.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Temp\jdbwtomgey.sys
C:\Temp\jdbwtomgey.sys
1⤵
- Executes dropped EXE
PID:5932

C:\Temp\bvtnlfdyvq.sys
C:\Temp\bvtnlfdyvq.sys
1⤵
- Executes dropped EXE
PID:3376

C:\Temp\vqoigaysql.sys
C:\Temp\vqoigaysql.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
- Executes dropped EXE
PID:4240

C:\Temp\fcxupnhfzx.sys
C:\Temp\fcxupnhfzx.sys
1⤵
- Executes dropped EXE
PID:4720

C:\Temp\wupnhfzxrp.sys
C:\Temp\wupnhfzxrp.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\upmhezxrpj.sys
C:\Temp\upmhezxrpj.sys
1⤵
- Executes dropped EXE
PID:1332

C:\Temp\jhezwrpjhb.sys
C:\Temp\jhezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\wqoigbytrl.sys
C:\Temp\wqoigbytrl.sys
1⤵
PID:1172

C:\Temp\jdbvtnlgdy.sys
C:\Temp\jdbvtnlgdy.sys
1⤵
PID:5416

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:3028

C:\Temp\ysqkidavtn.sys
C:\Temp\ysqkidavtn.sys
1⤵
PID:1176

C:\Temp\pnicausmkf.sys
C:\Temp\pnicausmkf.sys
1⤵
PID:932

C:\Temp\hczusmkecw.sys
C:\Temp\hczusmkecw.sys
1⤵
PID:1692

C:\Temp\hczurpmhfz.sys
C:\Temp\hczurpmhfz.sys
1⤵
PID:3936

C:\Temp\wrpjhbztrm.sys
C:\Temp\wrpjhbztrm.sys
1⤵
PID:2408

C:\Temp\bwuomgeywr.sys
C:\Temp\bwuomgeywr.sys
1⤵
PID:1100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlfdyvq.sys

Path C:\Temp\bvtnlfdyvq.sys
Size 141KB
SHA256 3e8835b3b05ccc86d87cbcef40033805e3a8d83b35e2c8aeb17847fafa6077bc
MD5 db81668172d3de4ff3bd257ed7f8741a
SHA1 845546d8663e79cc6827f7e3711a4bc953dad4cc
SHA512 cec4695d7fd374839fc4e3fa81d8398d54c541334b48a0a1050cbe7eb2407d8b083f0597993888473ef1b283aae954b3a5cbd85fbe65966db738c8239646a749
SSDEEP 1536:Ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1DBE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljebwt.exe

Path C:\Temp\bztrljebwt.exe
Size 226KB
SHA256 2ff4e1505976f24c0bddbf05639a98a0460f564f1f274e2c165fd345a1ceb9a3
MD5 928bb8c78a102de38d294297e3080365
SHA1 2a40d6e4c20426b6ad75afd9dd44b08147effd5e
SHA512 9fd735bdb25a4c1973d43aa91d62f968d10c4b0fc86046acd1e51737904e9786f9bccf0b13681489de89d1f278d2cb64c2393a3401fe0fc10bdd657d7aaed497
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T1B734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmhezwu.sys

Path C:\Temp\czurmhezwu.sys
Size 141KB
SHA256 3ef38919fed634ffbcf819593ad13926039a6437e403da937dd05dff240f0f23
MD5 9d5ec840f5329ec3494049cb33cf989c
SHA1 7ac8b3079873292c763b32556291dd95eab56031
SHA512 2314e358f65d5c3895e9119c3c7d1d3b9625a3c67416be41b221752d47d88de9e67ed5ba24b4dfbd545eff3f5b97a521832d9075bb3ade81452c09ab415837eb
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10BE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnifay.exe

Path C:\Temp\fdxvpnifay.exe
Size 226KB
SHA256 903d4ee4bd5e9bbe873d60efe86687323bfd6a0b3ca7ba1093b7dcb296abf7cb
MD5 bdb4c66f6537fe90f5a78f755964f33f
SHA1 a91fcb0223f5840feb83475c21475d85515cf4ac
SHA512 f31f5f79590ebeff3b6c1f5b5e2474554f7d57638d6dc2843451ebc3736696cf9c1e971465a63152e25fb320248d406aed30c8aa41ad239bfbcf60c50443b9a3
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T15234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnifax.exe

Path C:\Temp\fdxvqnifax.exe
Size 226KB
SHA256 7d9e774df2c466c5906bee6ee96a4daf253ba43516787364c1a6c7589c9a01a9
MD5 c3dfe45fc07258bc9f4f8f34ac0e24ed
SHA1 377245d666d7c182ff812404b99e8b43f6d4c730
SHA512 65f31b71cdf5e8a5fc768de08794534f5172b7ca8ba4425a221fd0a06a86fdbdae0b49159c3790a94d14fa15c3c590b6e3eaad90bda4f0f46205fb1391e46204
SSDEEP 3072:zGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:SXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljebwt.exe

Path C:\Temp\i_bztrljebwt.exe
Size 226KB
SHA256 2af6121598aaa4bbe58ee2335d43aff318dfab7eb0d2f6d12ec342ff94b201c8
MD5 cfe6b44960bf36f0b58f7d239e7056ae
SHA1 2966dacf2b9984aa1a0ddbd4c75a5cc466e2162f
SHA512 171aa90faa753d3727ccc93953a720a4f0b648879129ed46fdfed523b3337b3454fcf6c02bbc01e7984740c7454206248090d76aceed97cabc6ec30b17cc7501
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1BB34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdxvqnifax.exe

Path C:\Temp\i_fdxvqnifax.exe
Size 226KB
SHA256 f472cf1b6ce385cb985de0053324da67eb27ad401c27f7d715f6ba0c384e5058
MD5 10fbee52c126b1878a976cd59d2fd30b
SHA1 30fb5846f577878bedc8548fc7b606d0b182af1a
SHA512 904f6506cd314a71ebbc5c688e09e385f838814c05566446d018cac043690b3799d096f468db207b2672394a4c9795f3c13acdefd72a613c07c6160793a4bfee
SSDEEP 3072:KGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:RXY4LK+a3lLNngoqRttA7
TLSH
T1FE34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebztrljey.exe

Path C:\Temp\i_jebztrljey.exe
Size 226KB
SHA256 7b9317ecf87d75c36f6fe308ace50fd5f20f0c9ee8d2159b21d0210b5fa6ea2b
MD5 a6bf1105012f23a7effd9bf9da69ec13
SHA1 1306ac88ec2a1e4f1c852e6a7ce837ae64c190fc
SHA512 2c3a5ab8666b42745012ba9417183f671951aa7f850b6476408fc41deb0c2cbb648e660b34faba26cbbe662b571abe7a9c4571f648fca7ccbebe0b36465941b6
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T1D734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlgdywqoig.exe

Path C:\Temp\i_nlgdywqoig.exe
Size 226KB
SHA256 61209fabe7f5f29a0a609d8d6763d0379f62013cb707390c2d94e74a5106fb5b
MD5 bfde1e868be0aee90defa514f23491c7
SHA1 c7e4d767c5c7c6ce476fcbb5e7f745e06dbcd763
SHA512 672276733f2d6d1aee27ae9ec1299b6aeec213f47ed59f210d28a8f5844e6c291450af622c3713bc1e77720cf61c9c714566f57000de8dfe25d2798fbe482128
SSDEEP 3072:wGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:XXY4LK+a3lLNngoqRttA7
TLSH
T15D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnljdbvto.exe

Path C:\Temp\i_vtnljdbvto.exe
Size 226KB
SHA256 dc8bea30e1105558e6f3a79c2a8eb33c7db9782c80c1c388be66f2819d012fe0
MD5 1d3882473affaa42a3d0efdbd46e4098
SHA1 298746643bbc02f4215b6a9fc1a942e68f0dfd8b
SHA512 608d095eba4786780d0c1fa0becae7f4a6755fd54c91ceff933bd9a2afaa14516027b4e8fe84ab92900abf9870132f454176f43924b5b18c1a5cd3bc0fe91d35
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T17B34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xrpjhczusj.exe

Path C:\Temp\i_xrpjhczusj.exe
Size 226KB
SHA256 11392ac81496d7e701316aee683a0c65f669ae1d10d3e20c558951b5664fb036
MD5 197694e4239b11e4ea1ab81b99989bbf
SHA1 da3ab02343c4855114d093f42c7d40dbb4ddede7
SHA512 ac48aab686571937e361eec63b189ff26259e0ca17f3592eb219677c3c0af7c43a1c21e4ccb968da0e053d117d581b477b312440907deb9c7efbbc2b62e4ef05
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T18D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbwtomgey.sys

Path C:\Temp\jdbwtomgey.sys
Size 141KB
SHA256 5486d444456c1b03550cfdee40c740e94dafecd742f33b5630cdcd9ec0487bd7
MD5 fb53e419c1b96b043f5ccbcf9cac5d8c
SHA1 6f4a38a3f431db8fcc820eb363545dd13d6fe51d
SHA512 86cb390325ac7049aad8e009d44b50aa069453db23adecef542c7e4fb3d7da530ab8fcc17c4dc131173e30616797227f447481bd3b7aa2cf8069ef06ff44dd62
SSDEEP 1536:Na3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Na3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T158E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebztrljey.exe

Path C:\Temp\jebztrljey.exe
Size 226KB
SHA256 2e70b59bac5a3fdf9739da56910661c5c42dc4d304d25880d28b581e558a6849
MD5 613b3c9a88b88fc43a1821757d20fe00
SHA1 34048f62bbfc7d66a05cd52073cf3b7f6258f407
SHA512 302f497c08fcb9685189e3d636f28ad138f48d7a026d2a8bab21a473c2063192533c3b0391e3ba7d1c09594b10d8c9813e6bf5d9581b1ea48c8d388b9050c7b5
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T17834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.sys

Path C:\Temp\nkfdxvpnhf.sys
Size 141KB
SHA256 8daf2eed7209b251eda91856852e476c150ac3d989a85e6d1e04bacd3c500fb9
MD5 a56960e4467d79620f4e8cef49050125
SHA1 d5dd653291203e79d09294c31b21d1b2d827b7bf
SHA512 19c0855843c2669f1375fdcc97797eac1d2fdbb1d055fde901dab6b9c817279947fffbf2359cd8d68276f4cd35907f3af9e9eee236876b3e134f7ad1092357c5
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T183E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlgdywqoig.exe

Path C:\Temp\nlgdywqoig.exe
Size 226KB
SHA256 527768c11fc2c48b04861a17810346aa38e921e2b1108cce9caf169758b0fb1e
MD5 9ce3055f52553ecf5b45f6bb26072bfc
SHA1 e8e0db642f0128b45465e35eda65a7b6d9349c3a
SHA512 2beb33e0b5d8875155a88f62cf7cbcb866e1434554d19664dc721528a55af6ac35122244bc8c47475f6ff342dc4f76248081e2c3aee4f0b276ca81bb7dee99bb
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T19734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhbztrmge.sys

Path C:\Temp\ojhbztrmge.sys
Size 141KB
SHA256 7aa26998bac4e4313fb17d40025ebd8e5ccbd2690b13f18ff83ded3d0dc5a5a2
MD5 482ce542c2c603c1f612594b8aa496d0
SHA1 8888449ecc96f4cdcc5e39bf6b16ea2b9281fe69
SHA512 22a3f5963c3dd95486cf234bb2fecece25e49706da7240d5c8901a046e6cd57bcb7638888627cf0b8fd9f667506837f07b0fe5a94c8845781304c0ad9b401ecf
SSDEEP 1536:Ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T120E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigaysql.sys

Path C:\Temp\vqoigaysql.sys
Size 141KB
SHA256 5a3c8c4ee1902c04959384955ffd20997528000881bbcdeaebe688f91ae6801a
MD5 a061fe970ccf04eb6f4e72670bcf08e1
SHA1 f6672cd479a1003c000eafb963d377afebc29d1a
SHA512 d35cd1a356162383ac485fc0456382508bd5d9857dbf2d48b628e5e5578dacd1b93711d158ea92ea65d0d9102457db2c43bab6064a6de2c1e8e34c8c6e6b3d54
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1CDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnljdbvto.exe

Path C:\Temp\vtnljdbvto.exe
Size 226KB
SHA256 85674e826ad4c0a92786115c20170111c30394509e2bde7bc4209f92cc5df934
MD5 4f88d48a6374b3b47898f462407aa099
SHA1 755354150eb59ed5256264856a2bd54a1e9a1523
SHA512 6f187ef6d1057de1cdf05a9aa4f7ab2ab7d30ac2906929db894f7c29e8e7dac197b3429bdf3a1c7638d51506ca3a06463d61c000466cc110dada765b226e7942
SSDEEP 3072:/GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:eXY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczusj.exe

Path C:\Temp\xrpjhczusj.exe
Size 226KB
SHA256 d90de978c154f293d1b074db14e9bca342a0cbc8e8907b67c36cfb82341bf05c
MD5 35f38276729ee4205d3146b2d0ff86db
SHA1 5977e52ffbead256236469b8b039bdc671d256c0
SHA512 aeb9e7d45db51460f50367b21f9e22fcff06663887042624323a46a9dc3fd5671efc142c8bb36ec2aaf1e4c1bdf36cc0ca56df4ca414a345bc2aa296b3c200b1
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T14234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 1a8c96208b7bd3e82d8527239a5adeb8ee365268e2e12c0f12d5190709c5ee59
MD5 6ea798295d9f1d78ae0ca017a6b338dd
SHA1 50f067cd52c17283c120475ed6a41b48258c5e0c
SHA512 8c824c5698b02f81d239b22ee7908edc426e7b23576719a752f9d58a2afdcde40ed7e14ab8c1d5a111fee29c6a45000f74b0a55c3e41efcbffd3641c8eefd56b
TLSH
T1B1F0F9F5C8219C3708FD0B1974941B4AE755136B2B41485F3B3C430C8FB463B499591C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 16d43342e0c713deb924448e7781c44914c5043311bfa8e68c6c6ac37a1d1426
MD5 8719f72257d5a2d90ad4a8161e01b84a
SHA1 25fbbb68f3b32fc6527c5ba96628a530e5881349
SHA512 b1b6a3bc6bd44da288c6bbadee16e045decd716348bea6b6e4b926cf306234cb64086663153462e31f5eeb0c0420cd16882a996dafa665d784ae62bda8c218ff
TLSH
T1AD419EF7C3E8856DCA0195F0AA187E2FDE2D0954432C3D5A85E4EF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 bbf8b2e20535efb053756273d66e4d9ffc1d1baa918f37ecfdc6d7a3adfb68d2
MD5 5a0e0fdbd479c7969281e7a59a23dd14
SHA1 08879e3c31815a6feaaf77c2d3573544230ddcde
SHA512 7d499cc500e3ea7cbaba9cbcf0ef5c95e9ef99f34867326f24338622c2de98f2d48ef169ac4ddaa160f559a16225a0a5125af706df3fd1cff435b5bc2ebf2bd6
SSDEEP 384:sxZqlqS4S/fYds1+YV7orj0Tr/bX/5moOoc:sC0S4S/fYk+YHP/bP5m9
TLSH
T15C721916AA345977CCDBD309FA557B93D7F8156392900E44AAFC8B0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b923d7e8d7dfadafb7cccc81209cba58c009eb4546c347ee4c2f04dbf717fb8e
MD5 698681081e57f9e728f8b45e9e62a5dc
SHA1 fee8515952974c2a81b47af99a4f9fd5facf4950
SHA512 0f615a8a9694c55b1bbe8988354fa56f44d3f2d66df12c50eccdb8385084bde0cef229ba18fa6e5129895624026b274afb186207a0b8220ecfcb86647e09c486
SSDEEP 384:sxZql04S/fYdsK+XV7orj0Tr/bX/5cojJP:sCm4S/fYT+XHP/bP5cO
TLSH
T1F16208166A745977CCDBD309FA457B93D7F9166392910E44AAFC8B0C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 b0b8219417078fdc381a6dc8dfda4e5d529f7094301657b9e4a6023cc5bd3ed6
MD5 89747c31b59df7567891fad204db0b01
SHA1 2db4b5519ecff13e05b02e2c3f95eedaf889cd70
SHA512 62377f7f87b33332dcb8aa6f5fe04c443cd56c3585babfed3919e9c9e0561132b0a81b9f8e4d8eaa85b7d1932d1f019033edb4883e667c4b1abcb9900626afa4
SSDEEP 768:XwZh38Dv2S47pLuLnZFWRm6GQFm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3AGq9Llg:XwZh38Dv2SkEnZFWRm6GQFmu1jaKAGqA
TLSH
T188030A3B280CCB7E4F844E9CED267F8AADE8028B56988D5447FA494C02C67EF55174DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e05da436fbbd01d5cad81ee5f62eef79b0eb2cec0d0fa3de3f46ea326af39499
MD5 67fcd57bc0947ffabef2852b194efb23
SHA1 baf41dab0f190aec8d141fa6d988755f53b0881c
SHA512 2411649993749b737d6e7dd8004b7b63694a7725865eb411b4318b3519a77925eda183a32d4014b1463c695550bffb583a57f5f3fabbf2be432057a93b24f8ec
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjllFXS:ctGj+BCNC5qFVpKxl1S
TLSH
T1A6B2471632BA02023C3D791D87959B371A42B1B33058E93B7BE954BA4E67E214DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5ea3f2e-2fa5-49b6-9360-7bacc1b89ff6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5ea3f2e-2fa5-49b6-9360-7bacc1b89ff6.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-checkout-eligible-sites.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-checkout-eligible-sites.json
Size 23KB
SHA256 2abefae3d72e7c4f5cdc94eb0ee552612d843a26faf4a7bd061c73839e19d7eb
MD5 ed22bc3ded6df0109b9e594867473559
SHA1 ee39eb80dc23f7fd764199cbe4a153c4edc2e768
SHA512 fb337c0a0107dc37a3067bcd6f60ffb8f63ee892a0ff729dcdf67c7a21fec95a742a274853e8947489108d7543c13b9479e02574f490bc217e8a182f08543aa3
SSDEEP 384:rQR5dkrKzmQWgFlhpyZv8CTi8I6kxAvh0mD:reKrMP8d5JIVAvhV
TLSH
T18CB21064C9210DE11FE4412B6878224B1A3C951B8F90FAFE3B6D928C1F5E06F61B95FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-notification-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-notification-config.json
Size 804B
SHA256 bb26ce6fe9416918e9f92fcc4a6fe8a641eceea54985356637991cf6d768f9fd
MD5 4cdefd9eb040c2755db20aa8ea5ee8f7
SHA1 f649fcd1c12c26fb90906c4c2ec0a9127af275f4
SHA512 7e23b91eab88c472eec664f7254c5513fc5de78e2e0151b0bcc86c3cd0bf2cb5d8bb0345d27afdd9f8fcb10be96feaa753f09e301fa92b8d76f4300600577209
TLSH
T1AB0189EEC8800EB216C24A3A163985C31A3756576C953D147FC9741C2F5D62F22FB98D
MD5 SHA1 SHA512 TLSH

Submit Download

wallet-stable.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-stable.json
Size 81KB
SHA256 c1611bb1872456d5ba656cacea801b833ea43126a6ad7e43e143d52cba9d9597
MD5 46ca0b1726448d9c7ed48735c246336f
SHA1 8e26f1f1c6f909f2f3d34c17e042e579f3b2b449
SHA512 c9ec0465c2c0eb0bc0316163f9a2dab9332c372dfc4ebedb0ef4139fe1195efdd8aa34367155c29e659d97d5a27e2395ce2f6012c115ef5791bad270de26bb28
SSDEEP 768:r7PEXSl9cv2tlNnqSBBoCJkQgXzwb7XARjMLVF2CYgYHFkJ/Eqajvapznp+9l:08W27jLgX2ZLSgYHFkJ/EqajvWnAf
TLSH
T1F283DB29C9120DB11FA4001A28BA290B297C960B4F55FAFD7B6C938D1F0E45F61F59FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wallet-tokenization-config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\128.18367.18366.1\json\wallet\wallet-tokenization-config.json
Size 34KB
SHA256 0088d5ebd8360ad66bd7bcc80b9754939775d4118cb7605fc1f514c707f0e20d
MD5 ae3bd0f89f8a8cdeb1ea6eea1636cbdd
SHA1 1801bc211e260ba8f8099727ea820ecf636c684a
SHA512 69aff97091813d9d400bb332426c36e6b133a4b571b521e8fb6ad1a2b8124a3c5da8f3a9c52b8840152cf7adbd2ac653102aa2210632aa64b129cf7704d5b4fa
SSDEEP 192:0NOKnK+QXzpTYaDEqIyVZ5mxzrIAfrXKoNKExGI+MmsMR6Q9GMKPrZnfB4FXZ8N:SOKK+QXzpTYaDEq/e5EAfrRoRI+B9wC0
TLSH
T1A3F2FCB1D9009C932F58850A20BA9505376C52237F86F9FA736D424E9F9F58F2530EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 3d4ab7e0eb2d54618b8a3e9e69a70d97ff1c881d64b1bd963cb0cd382bfbf0ee
MD5 50d9e2d52d051515430cf8ea817a1070
SHA1 c4e2a5cc7fe6e64d5a3f6be49ee48220ecf97a88
SHA512 ca3df1255581099393234b022bbfa8338c8c97c6b2de2864edb151d8d7236e3c8bfce13eb4ae7a6b566a5532143d5e87e1bb001976d10f6bdee73ebe4798e192
SSDEEP 384:npiFKtNnNnb9HR38NY8TUNTUlIRMrk698m1ifbLoInmeorSdBSTK3RlUVf9ty/7X:AFKjZbf3fwgF7BoIforSdBST+R2xDy
TLSH
T1DAE2B3F298D799B7E8AE4B97A33E2E429AFCC15775481984F7C40D0DCC861BFD206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ec9d213aed83d6835315d4c958dce431ed2b122bf1dc849ebe34d426aa2afed1
MD5 c2957bcb7ce1d0d17d926d1717cdc3b8
SHA1 be103f543a1f545f4d4d2461ffbdeec8a68293a2
SHA512 f9061ef5acfb164b2948f4e64da301bd3569df2b72da3533b76af8032bb2d291208dd8a0ab7fda1a62a4b3d3fd418f59925d6ae8152b819c697f57183039c7f8
SSDEEP 384:nciF9CcmyWCs38NA8TUNTUlIxBrk6oRFF1ifbLoInm/Sqe4KV8p0Khty/7Ig2t:HFccps3Hwg4NFuoIWSqI8p0st
TLSH
T1A5B26C36EC98CAFBECE74F98A74E6603DEE0516386889AD4DAC85D0D00D71DD174B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 ed8f66da9882ab7e4b7b5b2eeadc443c578af44b5ae68cf3e6be2fa0ad809bb1
MD5 bee49bff54039f74e06f40d0a97ca417
SHA1 3698dcd0ed911ae449d5de90a138c33bc9f90e78
SHA512 d4c33fda13ebdfde3ba963bf01534246e4a28d70b4c6cb2536f40e3ba469e208c5f362b79f27197002b03f19a2e876c34e87951caf612fdd227552bf1154ef5e
SSDEEP 384:nsiFvtNnNnb9w38NY8TUNTUlIRMrk66dm1ifbLoInmehHdBSTK3RlUVf9ty/7IgR:XFvjZby3fwgFjBoIfhHdBST+R2xDy
TLSH
T167D24B36ECA4DAB7ECE74F98A70E7643EFE4116785881AC4D9D85D0E00C728D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4e025e828a3036db3d61493a4252bfcc11f3ed535df863286866a0c98377d9ce
MD5 4cd7db001cd953db13bcedc1c3fb20f8
SHA1 6f2da17ae05a81ea63ddbd831c0b6cea3cc5776c
SHA512 52297ae33d4186db950fdfaca86ce6a55f8ccb5b89821de4ef31e08489c6f1babd695ac93d99192a8c71062ce4eaa2b97cb27e8c0d13f6780295772942d00a81
SSDEEP 384:nsiF9CcmyWCs38NY8TUNTUlIRlrk6Qdm1ifbLoInmehRd/7MXqty/7IgP8:XFccps3fwgU5BoIfhRd/7I8
TLSH
T1DBB23A36EC98CAF7ECEB4F99A74A76439FE05167868859D8DAD94D0D00C71CD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 63a3bc53c09e35db4f97fa26e2cdecbf795471eaa0ef6ee4da55f83151d431ec
MD5 ff099abd93f6b2571f653ee73fb21272
SHA1 e12d4a4c8d4736e33d47370c2b7ead94e28148be
SHA512 f50ff7caafbaef13d0b7dbed035ba3728401b1ab21b2c45f535dae8fbe95fb2efd2ce05b1b964cb513f5dcd09f6dfcd3aeacfc221ae8a4642522dad312992a41
SSDEEP 384:nWiFKtNnNnb9S38NY8TUNTUlIRMrk66dm1ifbLoInmehydBSTK3RlUVf9ty/7IgR:9FKjZbs3fwgFPBoIfhydBST+R2xDy
TLSH
T131D24B36ECA5DAB7ECE74F98A70E7643EFE4116785981AC4D9D85D0E00D728D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 dce5b0ba7c9923f069c98eb12f7072a209b31c47e1957419be52e7af8b48d074
MD5 8dbd8aed0dd0757cf7916ff68929a8f2
SHA1 16dd1aad65763db4ff5be12e021d24be15b6d45e
SHA512 956f859d34f80d9767991bbb219fcc9ac27bcd87dcde3fd6e97210ee49082ed08ce44e83a052fdbdf4e15042a6fc6aaf9f557d0c6a78a8150c2684079ead6791
SSDEEP 384:nsiFKtNnNnb9o38NY8TUNTUlIRMrk6sdm1ifbLoInmehydBSTK3RlUVf9ty/7IgR:XFKjZby3fwgFlBoIfhydBST+R2xDy
TLSH
T149D24B36ECA5DAB7ECE74F98A74E7643EFE4116785885AC4D9D85D0E00C728D130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.5.28.1\typosquatting_list.pb
Size 507KB
SHA256 b34c96309ee41ff6d06dea8e605991b9b8c4d67fb4885cde883350c3b5ad674d
MD5 60b2b141019ad9ca0918db29dce42c12
SHA1 574e04a0a62023df2271a4633378f57320d33c8c
SHA512 918e6ea325b74876026691a37440441ffd3be78736595127ce77288e0bf3ab8597d52c62f94956f5567d1f985c2d38fa82f288ee330f8282f0e804ec2dc06b14
SSDEEP 3072:diBzZPXsIPv9aayls9OPzItqVCLWtQAMDvUlDetL81QFh9QGFFXaYllJzCWCD43s:ozZsIPv9akA0WuIDo/FhJFXNfFw43s
TLSH
T189B4C5B9DFC00194DB78112D20BE71D8181412A580E9DFEAFE7D855F2BC2AC977E85E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 bfd517f2a8ec3d91b0be0dbda4e1fd01e215fa6b8d02ec68abe5f734ca7fe244
MD5 fadb28dca01575d28682e75c62000918
SHA1 ac451f6d1c195040fd7d009a4aafe746b1498fbc
SHA512 041726486db512bbb335767205aa2a728ac56a80fe4ce417797b0a12f7fe457101b974777f2f3db0a536560de585e1bd5bfeed6f1dae65b897015b48222224cb
TLSH
T1A34130E14C7C1AC0D4BD0ABE608B38FC81DCD72AF5A4357D2C54EAD94A79A2C288443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 4a90ec4ed152aeaa174481d94c9457fcd21570847ec3e3ad66f3371d5eab940a
MD5 34b6be95ff56a411fa320e2420de87e9
SHA1 f7c0b65415e0c01942e8f4bc78dc1d844ccfc8b3
SHA512 2732f213244de82f4cb461cb6d36343b133d3a888b5a0403ba3e975bef99666c48e1ed40fa87286956e247bdd702d6f75c078a8a23e77b302c8e3a3a16b780c8
TLSH
T1A4412EE15C7C1AC1D4BD0EAE608B34FC82D8D725F5A4357D6864EA940A7961D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 64ea69de82be14ec9315a6d0933d86b856b51477608975b800d31372b7cdc9b5
MD5 729c07f0773fd4dd0bf7139fc3043fb9
SHA1 63d9a22b27da0f08bc3f0d3704af5568dae5caab
SHA512 c8781375da6d5e794fb9c69c62fc212e18404a84690875f6ad36c3fde3ce39e84b9197132bef882133b555f28ad834849a94478bcd2442179b874b9cb858453f
TLSH
T1D15130E04C7D5AC0D4BE0A7E608B34FC81D8D726F5A434BD2858EA950A7962C748543F
MD5 SHA1 SHA512 TLSH

Submit Download

notification_fast.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Notification\notification_fast.bundle.js.LICENSE.txt
Size 551B
SHA256 38ed54eb53300fdb6e997c39c9fc83a224a1fd9fa06a0b6d200aa12ea278c179
MD5 7bf61e84e614585030a26b0b148f4d79
SHA1 c4ffbc5c6aa599e578d3f5524a59a99228eea400
SHA512 ca5f2d3a4f200371927c265b9fb91b8bcd0fbad711559f796f77b695b9038638f763a040024ed185e67be3a7b58fab22a6f8114e73fdbd1cccdda6ef94ff88f3
TLSH
T108F08B5A31E12673416285A1270B52DE7F0C10BDB0AF39779444C3386C348EE82D0EE1
MD5 SHA1 SHA512 TLSH

Submit Download

tokenized-card.bundle.js.LICENSE.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt
Size 1KB
SHA256 363f376ab7893c808866a830fafbcd96ae6be93ec7a85fabf52246273cf56831
MD5 8595bdd96ab7d24cc60eb749ce1b8b82
SHA1 3b612cc3d05e372c5ac91124f3756bbf099b378d
SHA512 555c0c384b6fcfc2311b47c0b07f8e34243de528cf1891e74546b6f4cda338d75c2e2392827372dc39e668ed4c2fd1a02112d8136d2364f9cab9ee4fa1bd87f5
TLSH
T1A2313A5B32F53673416245A1670B52DEBF0C24AEB56F38B79495C3387C388ED82D1DA1
MD5 SHA1 SHA512 TLSH

Submit Download

strings.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\json\i18n-tokenized-card\fr-CA\strings.json
Size 2KB
SHA256 c67b555372582b07df86a6ce3329a854e349ba9525d7be0672517bab0ac14db5
MD5 cd247582beb274ca64f720aa588ffbc0
SHA1 4aaeef0905e67b490d4a9508ed5d4a406263ed9c
SHA512 bf8fa4bd7c84038fae9eddb483ae4a31d847d5d47b408b3ea84d46d564f15dfc2bae6256eac4a852dd1c4ad8e58bc542e3df30396be05f30ed07e489ebe52895
TLSH
T17251EE3D88F4489B60C7921B6B1142D7C9704E36D704F3848A63828A035BDEFB0BF69D
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1217656722\manifest.json
Size 121B
SHA256 cd25cc1afcc03514d978f0a90692454e810c3cc81763074e0ea5ac504255335a
MD5 8083caaf7f5bc5f01ede464e68db1c7e
SHA1 ed6cf18f79c4ee2968adfffe7bf1bce163ef3873
SHA512 60924bd5617ac5f994805f9a871999764ba93c6adda79c501a0b692dce51b9db6f6531a5e25129bc424ae7c4de868ba6e5a976d6bcfbac2bb8bd192c5513c7ee
TLSH
T10CB0922289429D300469079809B486A6E230674BE406F0397B7041CC8B785B8A4A2A94
MD5 SHA1 SHA512 TLSH

Submit Download

data.txt

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1552005780\data.txt
Size 146KB
SHA256 4d3b611b8b664c9b2e4503f41eabf3833860e521447c1dc921f0849e0c8633de
MD5 824a5940f80f495eec4743b1e719aa38
SHA1 1194b5bb383ef6fb33dcf906c99743f23cfaf790
SHA512 979860e2f4dbf25a3562c9e29c218f8d779a98a0f652dbfda04752f537d86f11bf8d27aad22d9b6ce16d34f734f9efb883e89ec326cc645506b7b163e429c2b6
SSDEEP 3072:TBPAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEpASogqAlrE7FkEBih5:9X1aI5aZoKzMJ07N8gqAlrE7OXv
TLSH
T1D7E3F110CEC41FDCDFA9291C90BD0F0963E1C79E853BAA85EB63FE466F67A045617089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_1552005780\manifest.json
Size 52B
SHA256 98fd5d8bd64136534587ef4cd3f9151defa2a6dae9f0b269a2cbb06433c50336
MD5 4b38fcc473ed6f7c17ddfb82a738f25e
SHA1 ecdc59ae25620ddc8111f05fa358f9bd829ab553
SHA512 8a7b883c0f656ec7bca3c0239dc7f362db0375236f234844d07b4a9639e7c26a3fcefb1b6927e32bda3dfc2ca5cb1872a9b422fa7f8881d56409c33063176a92
TLSH
T114900260042491571AE10E606570F8859395761955950D1D04451548029946CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5440_2060817726\manifest.json
Size 118B
SHA256 1b90c1e9cbd34978ee21dae135f1ea9f51599d19014f9219cd47d730fd914f55
MD5 7cbc275e0cbde8ca623fc70c406367c3
SHA1 2b9fecd47ed8ad353bfdd958e0f5197f20dc370c
SHA512 6966dbc5899213f4b9d0e241409cd834f67ef2df35a5b437cb194893c6c6f7fcd8a33c0f22344a20682a84dabaa2d0f95b9d739e5d0a840a91fc2806e09e0b06
TLSH
T198B092B00C0BA47B22809720ECA166C283FC0218E8466B1A08C036481F9817880362B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/932-441-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1100-1321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1172-377-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1176-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1176-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1332-337-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1692-476-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1692-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2408-488-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2556-354-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3028-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3376-269-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3376-243-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4020-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4144-268-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4240-297-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-313-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4856-222-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4856-201-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5324-165-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5416-395-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-221-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5932-244-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-190-0x00000146482E0000-0x00000146492E0000-memory.dmp

Download