889fa6b0f2f552b7c39c0fe659b4a87ad6248b37a8cd1403969f4806f139a45c

Analysis

max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe
Size 243KB
Sample260801-thzppadb72
SHA256 889fa6b0f2f552b7c39c0fe659b4a87ad6248b37a8cd1403969f4806f139a45c
MD5 af96c31508a73d7b0bf689f0f9f6257f
SHA1 b971da967e202b807f45ac4e5b8b5884c1cf3332
SHA512 6d69f7dd9fc431b1e891ebf383193e97412c18fdfaace093c1506f8d8cc8890954ee7e303a9b4bbd99701acac581da79411471fbbbcdcc331aa5c34f73f78c6d
SSDEEP 3072:jVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7C:xXP7LQMa3lLNngoqRttA7C
TLSH
T14B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5672	CP.exe
2604	usmkfcxvpn.exe
1488	CP.exe
1936	CP.exe
3684	i_usmkfcxvpn.exe
5224	kiczxrpkhc.sys
2964	CP.exe
3168	fcxusmkhca.exe
4584	CP.exe
2404	CP.exe
4308	i_fcxusmkhca.exe
1828	hczurpkhbz.sys
1444	CP.exe
3760	cxrmkecwup.exe
5416	CP.exe
2476	CP.exe
5948	i_cxrmkecwup.exe
4704	rmjhbzurmj.sys
3252	CP.exe
2904	omjebzwrom.exe
2688	CP.exe
2156	CP.exe
5176	i_omjebzwrom.exe
1924	ezwrpjgbzt.sys
5744	CP.exe
2344	omgeywqomg.exe
1852	CP.exe
4576	CP.exe
2148	i_omgeywqomg.exe
4760	ztrljdbwto.sys
4664	CP.exe
1892	qoigebztqo.exe
2140	CP.exe
3964	CP.exe
616	i_qoigebztqo.exe
4884	vqoigbytql.sys
2884	CP.exe
5948	qoigaysqli.exe
3200	CP.exe
3536	CP.exe
2720	i_qoigaysqli.exe
5508	vtnlfdxvqn.sys
5208	CP.exe
3684	qnifaysqki.exe
5124	CP.exe
4948	CP.exe
5796	i_qnifaysqki.exe
3176	xvpnligays.sys
4852	CP.exe
5780	icaxsqkica.exe
5836	CP.exe
616	CP.exe
4884	i_icaxsqkica.exe
4144	nkfcausnkf.sys
4164	CP.exe
2484	fzxspkhfzx.exe
1092	CP.exe
5856	CP.exe
4860	i_fzxspkhfzx.exe
4312	ezxrpjhczx.sys
4196	CP.exe
5832	zxrpjhczxu.exe
988	CP.exe
5204	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_187657531\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1422431102\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_187657531\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1422431102\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1422431102\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1487190924\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_517260738\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4888_1875867961\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1495862677\_locales\km\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjebzwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbztrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbztrljhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigeytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqoifdbvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqoifdbvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczurpmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigebztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxspkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcaupnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczurpmhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxusmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywqomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigebztqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigeytqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnifaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxusmkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxrmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjebzwrom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxrmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcaupnkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3800	ipconfig.exe
5796	ipconfig.exe
4860	ipconfig.exe
3804	ipconfig.exe
4972	ipconfig.exe
2344	ipconfig.exe
3824	ipconfig.exe
3368	ipconfig.exe
792	ipconfig.exe
2260	ipconfig.exe
3892	ipconfig.exe
1288	ipconfig.exe
5224	ipconfig.exe
2152	ipconfig.exe
1620	ipconfig.exe
2148	ipconfig.exe
5892	ipconfig.exe
6016	ipconfig.exe
4792	ipconfig.exe
2004	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300738676675373"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{5EEEFD3E-9ACC-4974-98D2-097D0E94BAF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3684	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	4308	i_fcxusmkhca.exe
Token: SeDebugPrivilege	5948	i_cxrmkecwup.exe
Token: SeDebugPrivilege	5176	i_omjebzwrom.exe
Token: SeDebugPrivilege	2148	i_omgeywqomg.exe
Token: SeDebugPrivilege	616	i_qoigebztqo.exe
Token: SeDebugPrivilege	2720	i_qoigaysqli.exe
Token: SeDebugPrivilege	5796	i_qnifaysqki.exe
Token: SeDebugPrivilege	4884	i_icaxsqkica.exe
Token: SeDebugPrivilege	4860	i_fzxspkhfzx.exe
Token: SeDebugPrivilege	1592	i_zxrpjhczxu.exe
Token: SeDebugPrivilege	4864	i_wuomhecwuo.exe
Token: SeDebugPrivilege	5224	i_ztrojhbztr.exe
Token: SeDebugPrivilege	4360	i_jgbztrljhb.exe
Token: SeDebugPrivilege	1152	i_oigeytqoig.exe
Token: SeDebugPrivilege	5800	i_sqoifdbvsq.exe
Token: SeDebugPrivilege	1424	i_nkfdavsnlf.exe
Token: SeDebugPrivilege	5796	i_pnifaxsqki.exe
Token: SeDebugPrivilege	1064	i_mkhcaupnkf.exe
Token: SeDebugPrivilege	6056	i_jhczurpmhc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 3172	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	89
PID 3172 wrote to memory of 4888	3172	iexplore.exe	90
PID 4888 wrote to memory of 3380	4888	msedge.exe	91
PID 4888 wrote to memory of 3100	4888	msedge.exe	92
PID 4888 wrote to memory of 2620	4888	msedge.exe	93
PID 4888 wrote to memory of 3100	4888	msedge.exe	92
PID 4888 wrote to memory of 3100	4888	msedge.exe	92
PID 4888 wrote to memory of 3196	4888	msedge.exe	95
PID 4888 wrote to memory of 3196	4888	msedge.exe	95
PID 4888 wrote to memory of 5732	4888	msedge.exe	96
PID 4888 wrote to memory of 5732	4888	msedge.exe	96
PID 4888 wrote to memory of 4460	4888	msedge.exe	97
PID 4888 wrote to memory of 5732	4888	msedge.exe	96
PID 4888 wrote to memory of 4460	4888	msedge.exe	97
PID 4888 wrote to memory of 4460	4888	msedge.exe	97
PID 4888 wrote to memory of 5512	4888	msedge.exe	99
PID 4888 wrote to memory of 4184	4888	msedge.exe	98
PID 4888 wrote to memory of 5512	4888	msedge.exe	99
PID 4888 wrote to memory of 5512	4888	msedge.exe	99
PID 4888 wrote to memory of 4184	4888	msedge.exe	98
PID 4888 wrote to memory of 4184	4888	msedge.exe	98
PID 4888 wrote to memory of 6132	4888	msedge.exe	100
PID 4888 wrote to memory of 6132	4888	msedge.exe	100
PID 4888 wrote to memory of 2464	4888	msedge.exe	102
PID 4888 wrote to memory of 4848	4888	msedge.exe	103
PID 4888 wrote to memory of 2464	4888	msedge.exe	102
PID 4888 wrote to memory of 4848	4888	msedge.exe	103
PID 2696 wrote to memory of 5672	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	104
PID 4888 wrote to memory of 1964	4888	msedge.exe	107
PID 2604 wrote to memory of 1488	2604	usmkfcxvpn.exe	109
PID 4888 wrote to memory of 2036	4888	msedge.exe	112
PID 4888 wrote to memory of 2036	4888	msedge.exe	112
PID 4888 wrote to memory of 4584	4888	msedge.exe	124
PID 4888 wrote to memory of 4584	4888	msedge.exe	124
PID 4888 wrote to memory of 2676	4888	msedge.exe	116
PID 4888 wrote to memory of 2676	4888	msedge.exe	116
PID 4888 wrote to memory of 4252	4888	msedge.exe	117
PID 4888 wrote to memory of 4252	4888	msedge.exe	117
PID 2696 wrote to memory of 1936	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	118
PID 2696 wrote to memory of 2964	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	122
PID 3168 wrote to memory of 4584	3168	fcxusmkhca.exe	124
PID 2696 wrote to memory of 2404	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	127
PID 2696 wrote to memory of 1444	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	131
PID 3760 wrote to memory of 5416	3760	cxrmkecwup.exe	133
PID 2696 wrote to memory of 2476	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	136
PID 2696 wrote to memory of 3252	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	140
PID 2904 wrote to memory of 2688	2904	omjebzwrom.exe	142
PID 2696 wrote to memory of 2156	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	145
PID 4888 wrote to memory of 3684	4888	msedge.exe	148
PID 4888 wrote to memory of 2004	4888	msedge.exe	149
PID 4888 wrote to memory of 1944	4888	msedge.exe	150
PID 2696 wrote to memory of 5744	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	153
PID 2344 wrote to memory of 1852	2344	omgeywqomg.exe	155
PID 2696 wrote to memory of 4576	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	158
PID 2696 wrote to memory of 4664	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	162
PID 1892 wrote to memory of 2140	1892	qoigebztqo.exe	164
PID 2696 wrote to memory of 3964	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	167
PID 2696 wrote to memory of 2884	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	171
PID 5948 wrote to memory of 3200	5948	qoigaysqli.exe	173
PID 2696 wrote to memory of 3536	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	176
PID 2696 wrote to memory of 5208	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	180
PID 3684 wrote to memory of 5124	3684	qnifaysqki.exe	182
PID 2696 wrote to memory of 4948	2696	2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe	185
PID 4888 wrote to memory of 2168	4888	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_af96c31508a73d7b0bf689f0f9f6257f_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff8b96c188,0x7fff8b96c194,0x7fff8b96c1a0
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10633541715746788279,2217647197598500739,262144 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:3100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,13979654966361906016,12491429848894308406,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:11
      4⤵
      System Time Discovery
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,14231729620933081374,3933764959539779896,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:13
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,5792325318978889963,8651091744746062667,2097152 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,8076027134081532273,1659473236474160352,2097152 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2603946425214379705,3197016395403142770,2097152 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
      4⤵
      PID:4184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,3482708870795911596,2816137757014934675,2097152 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,6823306261765850275,11988573484789253469,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,12935076617451418825,2092127937264066475,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11152120253831451614,15467916549238320557,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,535165639077062047,10896758414331569998,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,535165639077062047,10896758414331569998,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,2109650622218657536,3534357304927885956,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,3878699294866575558,66092623785968868,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
      4⤵
      PID:4584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6256,i,803421521161422871,7779375767621740507,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:2676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7109116353286822359,14358039942443801933,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,18020555146753800453,2222284226487837796,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,171207547067591730,669789153470851720,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:14
      4⤵
      PID:2004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,14073099606675947773,8306789504244055035,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
      4⤵
      PID:1944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5532648970910524046,9111245111539680610,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,10627043210386041769,16292676300135605708,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,10257128002622707552,8248182470255083641,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=912 /prefetch:14
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,5615689338727510009,7958509957379375220,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6664,i,9454266248958898742,18072077852792681299,262144 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1145252475810715207,7794972963684181049,524288 --field-trial-handle=2300,i,549548876391848195,4604860281542225889,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:14
      4⤵
      PID:6024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5672
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1936
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxusmkhca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2964
- - C:\Temp\fcxusmkhca.exe
    C:\Temp\fcxusmkhca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4584
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxusmkhca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2404
- - C:\Temp\i_fcxusmkhca.exe
    C:\Temp\i_fcxusmkhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4308
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cxrmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1444
- - C:\Temp\cxrmkecwup.exe
    C:\Temp\cxrmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cxrmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2476
- - C:\Temp\i_cxrmkecwup.exe
    C:\Temp\i_cxrmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omjebzwrom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3252
- - C:\Temp\omjebzwrom.exe
    C:\Temp\omjebzwrom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2688
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omjebzwrom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\i_omjebzwrom.exe
    C:\Temp\i_omjebzwrom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgeywqomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5744
- - C:\Temp\omgeywqomg.exe
    C:\Temp\omgeywqomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1852
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgeywqomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4576
- - C:\Temp\i_omgeywqomg.exe
    C:\Temp\i_omgeywqomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigebztqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4664
- - C:\Temp\qoigebztqo.exe
    C:\Temp\qoigebztqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2140
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigebztqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3964
- - C:\Temp\i_qoigebztqo.exe
    C:\Temp\i_qoigebztqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoigaysqli.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2884
- - C:\Temp\qoigaysqli.exe
    C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3200
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoigaysqli.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3536
- - C:\Temp\i_qoigaysqli.exe
    C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5208
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3684
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5124
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4852
- - C:\Temp\icaxsqkica.exe
    C:\Temp\icaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5780
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5836
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:616
- - C:\Temp\i_icaxsqkica.exe
    C:\Temp\i_icaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxspkhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4164
- - C:\Temp\fzxspkhfzx.exe
    C:\Temp\fzxspkhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxspkhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5856
- - C:\Temp\i_fzxspkhfzx.exe
    C:\Temp\i_fzxspkhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpjhczxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4196
- - C:\Temp\zxrpjhczxu.exe
    C:\Temp\zxrpjhczxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5832
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpjhczxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5204
- - C:\Temp\i_zxrpjhczxu.exe
    C:\Temp\i_zxrpjhczxu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomhecwuo.exe ups_run
  2⤵
  PID:3408
- - C:\Temp\wuomhecwuo.exe
    C:\Temp\wuomhecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomhecwuo.exe ups_ins
  2⤵
  PID:5628
- - C:\Temp\i_wuomhecwuo.exe
    C:\Temp\i_wuomhecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrojhbztr.exe ups_run
  2⤵
  PID:2812
- - C:\Temp\ztrojhbztr.exe
    C:\Temp\ztrojhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6068
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3052
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrojhbztr.exe ups_ins
  2⤵
  PID:5036
- - C:\Temp\i_ztrojhbztr.exe
    C:\Temp\i_ztrojhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbztrljhb.exe ups_run
  2⤵
  PID:700
- - C:\Temp\jgbztrljhb.exe
    C:\Temp\jgbztrljhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbztrljhb.exe ups_ins
  2⤵
  PID:2408
- - C:\Temp\i_jgbztrljhb.exe
    C:\Temp\i_jgbztrljhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigeytqoig.exe ups_run
  2⤵
  PID:5632
- - C:\Temp\oigeytqoig.exe
    C:\Temp\oigeytqoig.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4812
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigeytqoig.exe ups_ins
  2⤵
  PID:3668
- - C:\Temp\i_oigeytqoig.exe
    C:\Temp\i_oigeytqoig.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqoifdbvsq.exe ups_run
  2⤵
  PID:120
- - C:\Temp\sqoifdbvsq.exe
    C:\Temp\sqoifdbvsq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqoifdbvsq.exe ups_ins
  2⤵
  PID:1100
- - C:\Temp\i_sqoifdbvsq.exe
    C:\Temp\i_sqoifdbvsq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdavsnlf.exe ups_run
  2⤵
  PID:5676
- - C:\Temp\nkfdavsnlf.exe
    C:\Temp\nkfdavsnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5144
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdavsnlf.exe ups_ins
  2⤵
  PID:3048
- - C:\Temp\i_nkfdavsnlf.exe
    C:\Temp\i_nkfdavsnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnifaxsqki.exe ups_run
  2⤵
  PID:4832
- - C:\Temp\pnifaxsqki.exe
    C:\Temp\pnifaxsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnifaxsqki.exe ups_ins
  2⤵
  PID:4200
- - C:\Temp\i_pnifaxsqki.exe
    C:\Temp\i_pnifaxsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcaupnkf.exe ups_run
  2⤵
  PID:244
- - C:\Temp\mkhcaupnkf.exe
    C:\Temp\mkhcaupnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcaupnkf.exe ups_ins
  2⤵
  PID:1292
- - C:\Temp\i_mkhcaupnkf.exe
    C:\Temp\i_mkhcaupnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhczurpmhc.exe ups_run
  2⤵
  PID:4348
- - C:\Temp\jhczurpmhc.exe
    C:\Temp\jhczurpmhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1772
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5452
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhczurpmhc.exe ups_ins
  2⤵
  PID:4724
- - C:\Temp\i_jhczurpmhc.exe
    C:\Temp\i_jhczurpmhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2384

C:\Temp\kiczxrpkhc.sys
C:\Temp\kiczxrpkhc.sys
1⤵
- Executes dropped EXE
PID:5224

C:\Temp\hczurpkhbz.sys
C:\Temp\hczurpkhbz.sys
1⤵
- Executes dropped EXE
PID:1828

C:\Temp\rmjhbzurmj.sys
C:\Temp\rmjhbzurmj.sys
1⤵
- Executes dropped EXE
PID:4704

C:\Temp\ezwrpjgbzt.sys
C:\Temp\ezwrpjgbzt.sys
1⤵
- Executes dropped EXE
PID:1924

C:\Temp\ztrljdbwto.sys
C:\Temp\ztrljdbwto.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\vqoigbytql.sys
C:\Temp\vqoigbytql.sys
1⤵
- Executes dropped EXE
PID:4884

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:5508

C:\Temp\xvpnligays.sys
C:\Temp\xvpnligays.sys
1⤵
- Executes dropped EXE
PID:3176

C:\Temp\nkfcausnkf.sys
C:\Temp\nkfcausnkf.sys
1⤵
- Executes dropped EXE
PID:4144

C:\Temp\ezxrpjhczx.sys
C:\Temp\ezxrpjhczx.sys
1⤵
- Executes dropped EXE
PID:4312

C:\Temp\wurmkecwuo.sys
C:\Temp\wurmkecwuo.sys
1⤵
PID:4360

C:\Temp\ecwtrmjhez.sys
C:\Temp\ecwtrmjhez.sys
1⤵
PID:2272

C:\Temp\gbzwrojgeb.sys
C:\Temp\gbzwrojgeb.sys
1⤵
PID:5796

C:\Temp\lgdbytrljd.sys
C:\Temp\lgdbytrljd.sys
1⤵
PID:3124

C:\Temp\yvqligaysq.sys
C:\Temp\yvqligaysq.sys
1⤵
PID:4548

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
PID:1620

C:\Temp\pnhfaxvpnk.sys
C:\Temp\pnhfaxvpnk.sys
1⤵
PID:956

C:\Temp\nhecxupnki.sys
C:\Temp\nhecxupnki.sys
1⤵
PID:4608

C:\Temp\mjhczusmke.sys
C:\Temp\mjhczusmke.sys
1⤵
PID:3948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxrmkecwup.exe

Path C:\Temp\cxrmkecwup.exe
Size 243KB
SHA256 d926617b2327fa94a820fd834f52aabb2c7289a3ebffbb2f53326add01ae3c9b
MD5 86f951b43fc0d865bbd2be0478aa6836
SHA1 e72cdb59a231182253993c3ffdf46921adff9374
SHA512 34c3ae48e35fff9940f7637d60a254a83295613fabd7a14c3b8b0638bb457bc23f35b409030e88a43e812cc0e5cb978b99b5eba7a89695b010f37fb6cc66b0b5
SSDEEP 3072:5VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:LXP7LQMa3lLNngoqRttA7g
TLSH
T186345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwrpjgbzt.sys

Path C:\Temp\ezwrpjgbzt.sys
Size 141KB
SHA256 e88267c8e79835cecb09cf7cbe203809f254be6b50763ecaa03e39756a40a7f7
MD5 ee5af2f86a9bea53227ac86482e639b0
SHA1 c7e834e64a5559eba26e7907b510fc01c316ceb4
SHA512 06269b06454898d599bb6f30875d4e4c61ff539efd0b1029d4080a1637d157f69872a07676030227d502166d688968b3c662f2172259dff7f62c4858d46b1602
SSDEEP 1536:5a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:5a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T165E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxusmkhca.exe

Path C:\Temp\fcxusmkhca.exe
Size 243KB
SHA256 0a6344b822c43e15fc785b0e8f613700d175b820f40e0cac14d983c3692eaf22
MD5 19a8e9659df61338801398c485ef987c
SHA1 83cb27793379de8dde9d2eacc6753cd255b8f5ee
SHA512 9a49494d436c170d7deda6236969d91ec1750c4732afb3121c85bfcacd1747d702c2580c06ebcc6c59c927f65372b499968825500441daa46c0c3329e3d845d2
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:aXP7LQMa3lLNngoqRttA7P
TLSH
T116345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczurpkhbz.sys

Path C:\Temp\hczurpkhbz.sys
Size 141KB
SHA256 2255cd2bd0bef642add75124b0651aa5a6c7774fb4241199d2c48721a5510617
MD5 b97f4d0b4db7b72b8718cf5d82132a70
SHA1 62d6e3693ff68e4fbc1e19b4ff788a83ba4d51a5
SHA512 b2bc283d12ceb42283056743b59b0657b38cd472ca6ea83adabcef02dd0be29d23ce581f30636865b40de12ac0446834819b08dace2bbca04f139e5119787cbe
SSDEEP 1536:Ca3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ca3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T128E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxrmkecwup.exe

Path C:\Temp\i_cxrmkecwup.exe
Size 243KB
SHA256 1b52269c5f8445a9bc7097bdb16eef7becd2be1f408946cda9c66bb8c63d090e
MD5 cc62d0ece8a3f94e372b52f6e6482056
SHA1 071cdb5b538b701a3dbd2f1596817b3d199c08e6
SHA512 3356a1d1ebb1f81643c2fefe1699697fb325c09ed818e65aa756475e83e576115679e1e65f252b20c0df836f2a0f0722a24715b9a60b0765d4d373c0f05ddfca
SSDEEP 3072:tVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:/XP7LQMa3lLNngoqRttA7Q
TLSH
T16D345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxusmkhca.exe

Path C:\Temp\i_fcxusmkhca.exe
Size 243KB
SHA256 9040c4400ad4d29cc70c3a056c8fd8da8c3cada8194f82a12198c5453a94fd1d
MD5 ff9f3d79f53064d43c1d011b55132084
SHA1 81f2f28e1f10e2b9002eadc6aa0b40531cef764d
SHA512 87f77122d8c49bd640a4d197665bceecbaa4c0f3e42ae2a4e62f2985c020de5c89812d3167980d978c28ffe5cf8223671e6635cab6b400b80783f7b17c661bcd
SSDEEP 3072:6VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7b:6XP7LQMa3lLNngoqRttA7b
TLSH
T1EB345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgeywqomg.exe

Path C:\Temp\i_omgeywqomg.exe
Size 243KB
SHA256 c58eb3d02d176d7294158932a400c74dd3eeac9fe28c8c62bcadab5838ccc9d2
MD5 db95c29929b6ba626ad2a8895d497e91
SHA1 dd6df5c990f7f37eb634fb2ccbdf4249a9846ac3
SHA512 d2a55c5b05ab15ac3e0a36b83a19e652cdaa22e61607a67809ab7a1a4d3a1fa67e48867c2c4549e17a814305a2adf767b54686a16c9158eef933d670c605fcbb
SSDEEP 3072:0VXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:wXP7LQMa3lLNngoqRttA7h
TLSH
T1E5345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omjebzwrom.exe

Path C:\Temp\i_omjebzwrom.exe
Size 243KB
SHA256 343e5ecc38433d0bc99fff26e05aaf0e82d0002be7a14bcf17dcb7de13eb7c52
MD5 f6e6cdf194ba53ac560fa8a590cd18a4
SHA1 1b4b759e889559a8478177f6259e0e283c6472a0
SHA512 507cd4504473c04e044ec702b0b36c8ff50ed3e6ca30c5abf8d7c8cda5bea0741a37e160bef7d79a0fd0483d172963f5d82780fdf74e0166f67bb3adb493dd29
SSDEEP 3072:fVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:tXP7LQMa3lLNngoqRttA7y
TLSH
T1B4345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigebztqo.exe

Path C:\Temp\i_qoigebztqo.exe
Size 243KB
SHA256 cb55e686148165e24c60938d9ae8c70bc3e69a22cf8588d76d06192e3604820d
MD5 4fec4200c2d9c1ec3073ebc6e7e09099
SHA1 28b1f3fbd81d1c70c9a142e504a7ee8ce515bc0b
SHA512 c175b1e20fbf1b1dfc22a3036621becc9d281e67141c82c6aeac007da8c449a0beed2feded31ae06052f2e223ce0d8cb72f163e3310462132edefc83746ffc45
SSDEEP 3072:gVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:MXP7LQMa3lLNngoqRttA7R
TLSH
T1CC345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkfcxvpn.exe

Path C:\Temp\i_usmkfcxvpn.exe
Size 243KB
SHA256 1df0ae6e1f27337424933facb7ddef04a1c19f75cedefb6c030501593023bb3a
MD5 b7c8bb69a738355edcf8186b2b7afd0d
SHA1 4ce50e5989b8b20886b8a0e7e5e565ad2d3c1bcd
SHA512 911904d0bc988dd5e791dc6fa6f86b309141d4cbdd900a8322ff32b793b655ed9eb991d7ff294f92e1b44a30247c79c2f2f22fad4b1241f03cc355617ca06069
SSDEEP 3072:EVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7F:AXP7LQMa3lLNngoqRttA7F
TLSH
T1D1345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kiczxrpkhc.sys

Path C:\Temp\kiczxrpkhc.sys
Size 141KB
SHA256 b07be7fa668b4b8db885d7aa865fcae0c8f0e82f417c85f973d5ce40791e14db
MD5 b5ec351d1c50b012c4ad3025debbe56e
SHA1 b4e6869c2e16753ad160ffef9c663d001e4551bd
SHA512 31c40ffb3dd89b59a61856dae797469b25540126912269cc7644c9c05e0d825afc26831d8e541ebbace4d4e42794d4b4c712cc888ab69a6e7f36ee76784445e4
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T166E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywqomg.exe

Path C:\Temp\omgeywqomg.exe
Size 243KB
SHA256 32664ffc13f60f869d2481e451cf56ab9e91019488bcbabdda2b4bf923ddc4c4
MD5 c6091bf3fdd34b8359b42d00b582e03e
SHA1 65d276db2ae85380281e946451b5742cbde3b734
SHA512 8c2fb9f458275b4c35e33ce992eae27ba8e76df18dfe4a45d8ebd57ff507cb73aecbf917f4aa7b036cbae18d933961803ce934be39879a530884d5588d759cdb
SSDEEP 3072:bVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7W:pXP7LQMa3lLNngoqRttA7W
TLSH
T19B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjebzwrom.exe

Path C:\Temp\omjebzwrom.exe
Size 243KB
SHA256 a8ad91edc51ca66bab909a23a0b0b1283bace575f0034891969b54d0b6b2399a
MD5 19c5becbd101c578d8a95f9224deb235
SHA1 3861d4710e2529cd52a99e971c9d8fc94a872a5e
SHA512 16085ff689ac8c7cc5f3d88576c5f70dfb1b2966a65829ff5489eae359130416ab271ba39944047ed15c44a50d75c52354dbfa5f4c8447e2b008b2acac9158f7
SSDEEP 3072:JVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:bXP7LQMa3lLNngoqRttA7Y
TLSH
T1E2345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigebztqo.exe

Path C:\Temp\qoigebztqo.exe
Size 243KB
SHA256 6e7887395c0484a2b96e83064d3dd993732dfc76d4862bc1803d309aac20edc5
MD5 9c29b4466f6fae86888c1461223c0f9c
SHA1 f462f32a52cb176626cd1959df367ffa8bce4163
SHA512 fba69a99419cd7cd2e4e66927abafb286f637c15bcd711b05345e2a77729f031c33e163b436ef759975f8defa690086ad0aa64f1ea6dffca7548ea667346857a
SSDEEP 3072:aVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:aXP7LQMa3lLNngoqRttA7n
TLSH
T161345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjhbzurmj.sys

Path C:\Temp\rmjhbzurmj.sys
Size 141KB
SHA256 54fba642f7f93335d69adfcda8b8c2909eab125852182b94639cf39c3e920087
MD5 b43c7d9fe78dc754fe28082f2f7661af
SHA1 13619c2aa518b296a8039f7f94816e29be8a7fe4
SHA512 8a75e51cd1788012fdaaabeaa1bf56dab785705b86c48c722ee4776581c0addd031acfc84b937ba6151eaf7aba530e01b090fa3130a3b5668a6643fafb24b184
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FEE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvpn.exe

Path C:\Temp\usmkfcxvpn.exe
Size 243KB
SHA256 126d27b183d9701e892031855b9dd63d0b48586a6dfe72298d759a5dcc8e5b4d
MD5 04a7de0a7c2f80d4c8caf75f28dd7111
SHA1 255e52ce5e8afb062604f7142699146eebd6a8c4
SHA512 d23cf046dc466917e7399fff1e49e4b596dda8173bbd456be162b2c9f405b7ede493cd5923e35cef8dd709368d3ea67fc8e46faa683d4514ef7010ac29a2fa5a
SSDEEP 3072:JVXP7LFKJhD7ywSa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:bXP7LQMa3lLNngoqRttA7s
TLSH
T13B345A0172818031E7560B78046AE7A1467EBC384BA5E5CFF7A83B795E312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbwto.sys

Path C:\Temp\ztrljdbwto.sys
Size 141KB
SHA256 4359d6b5ed68eae74f93f415482c414328377ae8bd13ed39990c925c028ec794
MD5 5fbac221fb8b838c14a0c46bf03be23c
SHA1 c2fe43802763c880a21e14f6b2c8d56c21f78277
SHA512 2883d840c6e291bb13d933ccdb7c8af610eafdc2c767f1edcce135b27260ea5aecf66e2a4694bba79ebb58f09205d8c0b8c1da2d6717974b3af98c8098e465a2
SSDEEP 1536:1a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltt:1a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T176E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6ae09032672ef149adebaf8fb95b06b5f3930265023fa34a7fad3e5b575e596d
MD5 a298a8793ab644e6974f4f95b1e34fc5
SHA1 e9af53513ffc34b9f13829f8b254559c2f32038e
SHA512 dd2f17fd9d1895095b32af9ad072b60353c3746c29c9317743c61965135c06cd867cea43e0a31dbaa4b0f991965d3a9966fb9f4f70e1e8e60db0ea64fe0406b4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7l:fwUQC5VwBIiElEd2K57P7l
TLSH
T144B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4610020fc3dcec80901a68c8922c4a8b9b54318f3318865d1ebcc576f4c747cf
MD5 7013ac5679717353cb9d79b50c1bf7a9
SHA1 1059ecb94ca8ef97138d6efe1515bbd905410c7a
SHA512 37c1b0d7fa180aeb42a059e065e5c5d64a339f6ba28c19fc567e6fb9d7ed3366215c68fd2058c58a3f6f09e381113e635b769527f96ae0935c8311b5fa46f077
TLSH
T1706181E8EF2D19F3D32590B753E086D936B0A891B6272EBAC170513F8C46F186C4C453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5931b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5931b5.TMP
Size 3KB
SHA256 e8ceab84e60c7447b408c902d9f44f0bdfda7ede6324729dbcd204e40f264408
MD5 5977ed9de88e17eeb4f8853dadc2031a
SHA1 04d1c18f08871d2d6104d018c5c64dd77b3316ae
SHA512 61ffb4afbeb1fecc936ddb25de58daf0476fb2ad8ec02af0749925a3a1eea97974e306c14fc74884aa9f6d2aec564ff9b6ff72f3e59c87a59c5e6e869961eb18
TLSH
T1506181E4EF2D19F3D325A0B753E086D936B0A895B6272EBAC170513F9C46F186C8C453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 28894d515ed043bf1af6be55ac8052dda5cc85afcb1b090901b16cc2473563b8
MD5 3f3458a166e901df7d166dd79bef0b8d
SHA1 e682c80255a7a0b897e592462f73b76e1643105e
SHA512 24c9ccf69b916ee50f0d0fa30bba11ab56f0e623cf50b57bb6be0c8b913096c2de181fca7cc9ba3b207616e1e9ac87b5d2f68a350a069d0e05a66120d306c19f
TLSH
T1F531CFF3C3E8956E890156F0EA286E2BCE1D0A15432C3D5AC4E4EF2B93E2571E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 de389d26ba48235099fa09190b8e44f64bad53184c772c4f6032bec06819572d
MD5 552b7a671fe9e5b957d9f25b4813be40
SHA1 2d07b5e5d9d88650a4780370ab5ad467bfde6395
SHA512 d9536870ede30f5e42a5f2e5c60d7de1af63b96d78e8711f042066d7138973480c5fa42229b19c551709db3e93c46d04729eddc7bc836552e024e765358fae56
SSDEEP 192:sxRERdyM/jK1Ml8wCK/f1srhcwZkPbKzoA8p94/g6+WNCVC/YxWImG1NIgVY4hJ:sxREn8K/f1slcusje/5x/sfRB
TLSH
T1BF62F915AA34997BCCDBD219FA557F63D2F81173A1904E44AEFC9A1C00E67ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 50ab308da60b3eb2bad178861c57ed9a47901a5ffd579d4c2429f5bcfad20b0d
MD5 2322e966ebd10830fbec165d6bb5b43f
SHA1 42e769b591f3976fbb996ed92805822b4c8aafde
SHA512 7da7eb7971ca04d080caf47032160c60f76d947443c97bbe50d37d557725a93880c1f8b6f70a9ba22ea1bfc3faca10d38ba5cba2b719a7c2b42069d052260b17
SSDEEP 192:sxRHRdyM/jK1Ml8wCK/f1s3hcwZkPbKzoA8p94/g6+WNCVC/YxWImG1NIgD2Y4hJ:sxRHn8K/f1sRcusje/5x/sfR6
TLSH
T12662E815AA34597BCCDBD219FA557FA3D2F81173A1904E44ABFC9A1C00E67DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 024b47ae51407e96d88fdecf84435bf3a629c37ae4377c657f921282d71838a6
MD5 a7bb3928435f6e9fd2aacfc43eb0726e
SHA1 64e10c3bdf2ac24cc3a9c83529f18e95fe82d885
SHA512 a05707aaf18f3b77093a910801b42fe0be318fea03f8c682abba33229e3e54e078f6515bac252da36b61e88de9a94a21a86836fe18b2f2b4e0e2c1deb3c90b8d
SSDEEP 192:sxRHRdyM/jK1Ml8UQ8CK/f1s3h3wZkPbKzoA8pr4/g6+WNCVC/YxOImG1NIgDsYy:sxRHnq7K/f1sR3usj0/5x/SfR4
TLSH
T1B362F915AA349977DCDBD219FA517F63D2F81073A1944E44ABFC9A1C00E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 e546bb817bf7804cddd982ac79cc6a59c02c1355620014b60b2ee10b0a51ec9f
MD5 0119ce7efdf23cf4f4383e985592b382
SHA1 5349bd799feb06992d27b298ca0e9d112cd036f2
SHA512 41290b0bac031899db043f29ff71ba56d010f5529a775213a0a3a7556859adc5a9bbba8130b13314989ecf2b37f97904611433eba7b5914b8a2723dd863a74cc
SSDEEP 768:0xCyeu7pLuLfUjWgbrfM18F1+UoAYDCx9Tuqh0VfUC9xbog/OVNh4rVALroJfaYK:0xCyeuEfUjWgbrfM1u1jayh4pA4Jf9K
TLSH
T192E2EC7B680CCB7F4F804A9DEC297E9A6DA802CF96D8C95447EA840C03C67EB51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8c4e86b39bc500e6b857c38dabc9d169b87a1990ffec91f5a02b4ba88eb0d815
MD5 9f6881560d0f404bd3d677509c406bc1
SHA1 c277a5ef3dfb939fad90a364957adb01669010a6
SHA512 3055491b1d1c61b66dffb06cbf5653b8c98e1936dc046edbe57bcebf8ea41a34e8aa5641890b3a022a0bff69d5a287723a7b78ee51106f0b003e3551c4b8fca1
SSDEEP 48:KccIfKF+cXyRAInKVecV1I9K+wIHyhOIXKTKQJ:KccwKF+OCAwKVeK1GK+wCyO8KTKa
TLSH
T1CAB11E52B53A465138BD65198190C617DAC2B077311AA82B7FE815B20F7BF019EFC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0b04130-7ae4-4159-9abc-ae2f8e4dfba8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e0b04130-7ae4-4159-9abc-ae2f8e4dfba8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 344d8313235d3b1aa6987a8cca6b0facea9dc899d9d0b7496eee90c90c6bbd68
MD5 cd838f4a8eec4fd1f2ef51d241804c67
SHA1 c2fdd423896a6e69ef26962f7a7c5ced75eb447f
SHA512 4714db19637e61b2ca4d2ab2e4cd3620217fc23344e00311397bd8061e7abb8c3df9db595e36b3f7563cdb04e4cbdbb110d8e6d22ca65b36fbdc9df781704773
SSDEEP 768:4rv+4UNbdj3IW6kKL2StEjF669yrqUjWiIwwxMtRUileX:4bsbV3nXjF66INWZTMDUsQ
TLSH
T11013CF70A8689EB3CCF6D645725337C3BF7410A395C40F98C6D9570D068B0D9274BA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 a93e43a117d613dc805041bd152c7ba23e080b32106cf399d71ef917c320a1c1
MD5 4a90ea30fc2d4a753167ac7d86b56e7f
SHA1 5d53a5c14d401e6a9308fc816198b2661c22c031
SHA512 d453578260b50d018a9b867ca491b7e27f16ef6a4c02af9586c71a48a56e3eb68f0030fd4cf86e8c3e9786efac4d9bc3d2bac335b616bf3668c6b63758c8e159
SSDEEP 768:ZFQf3twggmPwtRnF669yrqUjWiIwwxMtR2ewBKZO9K:Yf3QnF66INWZTMD2evZ8K
TLSH
T1B31329F098D78977D8EE9783633D2E869ABCC0A3B5884994B7C85A0CCC461BFD707815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 934fd2d3068f69935847076a31ec1d3acafba2925b0d9ff088a71a49924dbb25
MD5 5f0fa37f46de54305d9eb7d162af7c96
SHA1 8831d96c885621ae4daa923d6b05a1adf6744713
SHA512 42fe8166031f79f181848aec2b24da2d594e5beddca88423a06056dffae0dfaf9a8f52fe12030406350ab65119e4fc308fa48ca7d8cd9b37e377620b51c28e7c
SSDEEP 768:Qrv+4UNbdj3dS6kKL2StZjF669yrqUjWiIwwxMtRUileX:QbsbV3OgjF66INWZTMDUsQ
TLSH
T16713CF70A8689EB3CDF6D645B25337C3BF7410A395C40F98DAD9670D068B0D9274BA2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4938b23cf4c9bb1de8807651f8e9a51d1f04c9427ae69036d4d971942a22cee9
MD5 4aefca576ad103d75e94849099549590
SHA1 a1775ce8753aee9d8bc063237c7cf3eed1f2c829
SHA512 e3bf85c79471dae18d37c0a27f85c3c64513646becb1e42f4b4d4295df0f10e2ee295fa560c160a60da167872a663d0579ab932d452edffceda5ebd62556f281
SSDEEP 768:Ug3aW6kKL2StEjF669yrqUjWiIwwxMtR2ewBKZO9K:Ug3RXjF66INWZTMD2evZ8K
TLSH
T1E9F2BEB0AC645EB3C8FAE745B25233C3AEB041A3E5C40E9CDADDA70D05575D92747C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6d12339e7ef55acc62ee3336fb5a0232df81f694c5cb0dfb8a1055e9322cbeef
MD5 3de420f98a8987aa9dc638be8a9a3e99
SHA1 2aa3048bd393859294f4130fadbee33af74706ab
SHA512 1d5b1f7c276da35bb50043a4699a8b9a31f285f49a4b2370eaa86602c7e7e1bf790ea920f3742377562bc4b8fa28051f30d8e088ec5f9dd6e1b5013ec4c2879d
SSDEEP 768:arv+4UNbdl3iPkKL2StsjF669yrqUjWiIwwxMRpUiler:absbX3pdjF66INWZTMLUsQ
TLSH
T13A03CE30AC589AB7CCF2D68672433783BFB4509396C50B88CADD670D469B4DD2347A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a308e60-bd73-4e75-8bcc-407f9902606e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a308e60-bd73-4e75-8bcc-407f9902606e.tmp
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

3da88a35-1e34-44fe-9291-35c46ea12b0c.tmp

Path C:\Users\Admin\AppData\Local\Temp\3da88a35-1e34-44fe-9291-35c46ea12b0c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4888_2114162194\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-735-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/956-708-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1620-688-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1828-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1924-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2272-640-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-671-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3124-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3948-738-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4144-578-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-607-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4360-627-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4548-682-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4608-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4704-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4760-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4884-560-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5224-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5508-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-651-0x0000000000010000-0x0000000000083000-memory.dmp

Download