0657a6d34907f4debfb6792fc63dfc4854d10eb51efcaaf6d9cf2b2cc6653f3a

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 14:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe
Size 243KB
Sample260806-r4lnvatcmd
SHA256 0657a6d34907f4debfb6792fc63dfc4854d10eb51efcaaf6d9cf2b2cc6653f3a
MD5 ef948ac5771b9f88a7473619c9a1f396
SHA1 8f9343bc332852c96989ed293ec9952ac223ff39
SHA512 0ef760bf3188ab12516cf18aa6760500b1f5de7613ba3598fce64062ed760ec5d4fdbcf4b02e9db2a838d885c011a9442d0e6ec624c4162e8b830018f3c6897b
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:GvMsLaOa3lLNngoqRttA71
TLSH
T17F345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2244	CP.exe
4828	vpnhfaxsqk.exe
1204	CP.exe
3364	CP.exe
1504	i_vpnhfaxsqk.exe
5412	cxusmkfcxu.sys
3264	CP.exe
4416	xspnhecxus.exe
3724	CP.exe
5924	CP.exe
500	i_xspnhecxus.exe
4872	upmhfzxrpj.sys
1264	CP.exe
4552	mhezxrpjhb.exe
1768	CP.exe
4768	CP.exe
3848	i_mhezxrpjhb.exe
4112	jhbzurpjhb.sys
5000	CP.exe
4256	gebzwromjh.exe
1116	CP.exe
5564	CP.exe
4760	i_gebzwromjh.exe
1476	uomgezwrpj.sys
1740	CP.exe
1284	dbztrojhbz.exe
1820	CP.exe
2076	CP.exe
4136	i_dbztrojhbz.exe
4476	lgdbwtoljg.sys
5068	CP.exe
3332	ljdbvtolge.exe
5680	CP.exe
4300	CP.exe
4520	i_ljdbvtolge.exe
1952	fdbvtqligd.sys
1292	CP.exe
2852	fdbywqoiga.exe
3132	CP.exe
4252	CP.exe
4740	i_fdbywqoiga.exe
4628	nlxvqnifay.sys
5848	CP.exe
4092	gaysqkidav.exe
5956	CP.exe
5424	CP.exe
5608	i_gaysqkidav.exe
3156	licaysqkid.sys
2108	CP.exe
2740	ankfdxvpnh.exe
4864	CP.exe
5772	CP.exe
4520	i_ankfdxvpnh.exe
4304	qkhfausnki.sys
1960	CP.exe
2580	nhfzxspkhc.exe
1496	CP.exe
1880	CP.exe
2164	i_nhfzxspkhc.exe
3968	zxupmkhczx.sys
520	CP.exe
6044	fzxrpmkhcz.exe
5356	CP.exe
6100	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2011240121\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_1960761163\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_1960761163\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_742199114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2011240121\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_742199114\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_1960761163\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_804077449\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3120_2015823523\_locales\hr\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcaysqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkidav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ankfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwjhbwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebzwromjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaxvpnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxupmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdbywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwjhbwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnlidays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxupmkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpjhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ankfdxvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpmkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebzwromjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdbywqoiga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nhfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcaysqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3024	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3456	ipconfig.exe
3188	ipconfig.exe
1868	ipconfig.exe
4716	ipconfig.exe
3452	ipconfig.exe
2444	ipconfig.exe
1088	ipconfig.exe
2412	ipconfig.exe
4676	ipconfig.exe
4376	ipconfig.exe
2352	ipconfig.exe
1492	ipconfig.exe
4304	ipconfig.exe
3144	ipconfig.exe
5008	ipconfig.exe
3480	ipconfig.exe
1492	ipconfig.exe
4820	ipconfig.exe
5148	ipconfig.exe
2596	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305011020302119"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{280D8CB6-E2BC-4C64-92B9-9084426274C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	i_vpnhfaxsqk.exe
Token: SeDebugPrivilege	500	i_xspnhecxus.exe
Token: SeDebugPrivilege	3848	i_mhezxrpjhb.exe
Token: SeDebugPrivilege	4760	i_gebzwromjh.exe
Token: SeDebugPrivilege	4136	i_dbztrojhbz.exe
Token: SeDebugPrivilege	4520	i_ljdbvtolge.exe
Token: SeDebugPrivilege	4740	i_fdbywqoiga.exe
Token: SeDebugPrivilege	5608	i_gaysqkidav.exe
Token: SeDebugPrivilege	4520	i_ankfdxvpnh.exe
Token: SeDebugPrivilege	2164	i_nhfzxspkhc.exe
Token: SeDebugPrivilege	4872	i_fzxrpmkhcz.exe
Token: SeDebugPrivilege	3456	i_ezxrpjhczu.exe
Token: SeDebugPrivilege	5756	i_zwjhbwurmj.exe
Token: SeDebugPrivilege	4304	i_bwtomgeywq.exe
Token: SeDebugPrivilege	5360	i_dbvtqljdbv.exe
Token: SeDebugPrivilege	2168	i_yvqnlidays.exe
Token: SeDebugPrivilege	4184	i_kfcaysqnhf.exe
Token: SeDebugPrivilege	5616	i_kicaxvpnif.exe
Token: SeDebugPrivilege	1100	i_fcxupmkhfz.exe
Token: SeDebugPrivilege	872	i_jhfzxrpjhc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 4696	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	88
PID 4696 wrote to memory of 3120	4696	iexplore.exe	90
PID 3120 wrote to memory of 4860	3120	msedge.exe	91
PID 3120 wrote to memory of 5888	3120	msedge.exe	92
PID 3120 wrote to memory of 3024	3120	msedge.exe	93
PID 3120 wrote to memory of 5888	3120	msedge.exe	92
PID 3120 wrote to memory of 5888	3120	msedge.exe	92
PID 3120 wrote to memory of 4232	3120	msedge.exe	94
PID 3120 wrote to memory of 4232	3120	msedge.exe	94
PID 3120 wrote to memory of 2036	3120	msedge.exe	96
PID 3120 wrote to memory of 2036	3120	msedge.exe	96
PID 3120 wrote to memory of 2036	3120	msedge.exe	96
PID 3120 wrote to memory of 5680	3120	msedge.exe	97
PID 3120 wrote to memory of 5680	3120	msedge.exe	97
PID 3120 wrote to memory of 5680	3120	msedge.exe	97
PID 3120 wrote to memory of 5156	3120	msedge.exe	98
PID 3120 wrote to memory of 4476	3120	msedge.exe	99
PID 3120 wrote to memory of 5156	3120	msedge.exe	98
PID 3120 wrote to memory of 5156	3120	msedge.exe	98
PID 3120 wrote to memory of 4476	3120	msedge.exe	99
PID 3120 wrote to memory of 4476	3120	msedge.exe	99
PID 3120 wrote to memory of 988	3120	msedge.exe	101
PID 3120 wrote to memory of 988	3120	msedge.exe	101
PID 6012 wrote to memory of 2244	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	102
PID 3120 wrote to memory of 1416	3120	msedge.exe	105
PID 3120 wrote to memory of 3892	3120	msedge.exe	106
PID 3120 wrote to memory of 1416	3120	msedge.exe	105
PID 3120 wrote to memory of 3892	3120	msedge.exe	106
PID 4828 wrote to memory of 1204	4828	vpnhfaxsqk.exe	107
PID 3120 wrote to memory of 2352	3120	msedge.exe	111
PID 3120 wrote to memory of 1244	3120	msedge.exe	112
PID 3120 wrote to memory of 1244	3120	msedge.exe	112
PID 3120 wrote to memory of 3712	3120	msedge.exe	113
PID 3120 wrote to memory of 3712	3120	msedge.exe	113
PID 3120 wrote to memory of 1780	3120	msedge.exe	116
PID 3120 wrote to memory of 1780	3120	msedge.exe	116
PID 3120 wrote to memory of 2444	3120	msedge.exe	117
PID 3120 wrote to memory of 2444	3120	msedge.exe	117
PID 6012 wrote to memory of 3364	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	118
PID 6012 wrote to memory of 3264	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	122
PID 4416 wrote to memory of 3724	4416	xspnhecxus.exe	124
PID 6012 wrote to memory of 5924	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	127
PID 6012 wrote to memory of 1264	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	131
PID 4552 wrote to memory of 1768	4552	mhezxrpjhb.exe	133
PID 6012 wrote to memory of 4768	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	136
PID 6012 wrote to memory of 5000	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	140
PID 4256 wrote to memory of 1116	4256	gebzwromjh.exe	142
PID 6012 wrote to memory of 5564	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	145
PID 3120 wrote to memory of 4092	3120	msedge.exe	148
PID 3120 wrote to memory of 3188	3120	msedge.exe	149
PID 3120 wrote to memory of 5776	3120	msedge.exe	150
PID 6012 wrote to memory of 1740	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	153
PID 1284 wrote to memory of 1820	1284	dbztrojhbz.exe	155
PID 6012 wrote to memory of 2076	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	158
PID 6012 wrote to memory of 5068	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	162
PID 3332 wrote to memory of 5680	3332	ljdbvtolge.exe	164
PID 6012 wrote to memory of 4300	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	167
PID 6012 wrote to memory of 1292	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	171
PID 2852 wrote to memory of 3132	2852	fdbywqoiga.exe	173
PID 6012 wrote to memory of 4252	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	176
PID 6012 wrote to memory of 5848	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	180
PID 4092 wrote to memory of 5956	4092	gaysqkidav.exe	182
PID 6012 wrote to memory of 5424	6012	2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe	185
PID 3120 wrote to memory of 4968	3120	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_ef948ac5771b9f88a7473619c9a1f396_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6012
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x260,0x300,0x7ffb17d7c188,0x7ffb17d7c194,0x7ffb17d7c1a0
      4⤵
      PID:4860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,2961529622885587490,16516579370286594199,262144 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,18192088024879325092,9343798877569820976,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
      4⤵
      System Time Discovery
      PID:3024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,13533541185132411653,13578697812471416678,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:13
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,8685715997683470543,14355023798107817368,2097152 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,9059942781176440930,8408831099434330821,2097152 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:5680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15378988112760476995,7805592713534962499,2097152 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:5156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4328,i,9489049477541668547,10178326577858603317,2097152 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:9
      4⤵
      PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3852,i,10441422758305921792,8909086392571930229,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1321679146274406760,1722186203410928033,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,8765940439019369714,16122726465981269201,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5942720741588632347,18211771699234364529,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,5942720741588632347,18211771699234364529,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,14276410248535508687,12923602995675579137,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
      4⤵
      PID:1244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,13192809844875374128,18066553157981291871,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:3712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,2437962458595347840,13144226859919494726,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,8938728129404289165,8706885014455258269,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,733398734595406528,2965573359239489798,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,17776247085044398744,4382678716008271398,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:3188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,17230011536988694881,6715602283650261751,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:5776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3581193756896037870,11497508505512532348,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,13598744325169178152,4949887185621738512,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=944,i,17828331799759957192,3540241188204538113,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
      4⤵
      PID:3804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,17199674290233367678,13418575371662782527,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:2928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6244,i,1861678222921091501,1607376255537002195,262144 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,9044361361503709145,16267279664397159700,524288 --field-trial-handle=2508,i,13114443275134570379,17021281103246012978,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
      4⤵
      PID:5584
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnhfaxsqk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2244
- - C:\Temp\vpnhfaxsqk.exe
    C:\Temp\vpnhfaxsqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnhfaxsqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Temp\i_vpnhfaxsqk.exe
    C:\Temp\i_vpnhfaxsqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspnhecxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3264
- - C:\Temp\xspnhecxus.exe
    C:\Temp\xspnhecxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspnhecxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5924
- - C:\Temp\i_xspnhecxus.exe
    C:\Temp\i_xspnhecxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mhezxrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Temp\mhezxrpjhb.exe
    C:\Temp\mhezxrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mhezxrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4768
- - C:\Temp\i_mhezxrpjhb.exe
    C:\Temp\i_mhezxrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gebzwromjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5000
- - C:\Temp\gebzwromjh.exe
    C:\Temp\gebzwromjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gebzwromjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5564
- - C:\Temp\i_gebzwromjh.exe
    C:\Temp\i_gebzwromjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrojhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\dbztrojhbz.exe
    C:\Temp\dbztrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1820
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrojhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2076
- - C:\Temp\i_dbztrojhbz.exe
    C:\Temp\i_dbztrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5068
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4300
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdbywqoiga.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\fdbywqoiga.exe
    C:\Temp\fdbywqoiga.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdbywqoiga.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4252
- - C:\Temp\i_fdbywqoiga.exe
    C:\Temp\i_fdbywqoiga.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaysqkidav.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\gaysqkidav.exe
    C:\Temp\gaysqkidav.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaysqkidav.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5424
- - C:\Temp\i_gaysqkidav.exe
    C:\Temp\i_gaysqkidav.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ankfdxvpnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2108
- - C:\Temp\ankfdxvpnh.exe
    C:\Temp\ankfdxvpnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2740
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ankfdxvpnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5772
- - C:\Temp\i_ankfdxvpnh.exe
    C:\Temp\i_ankfdxvpnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nhfzxspkhc.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1960
- - C:\Temp\nhfzxspkhc.exe
    C:\Temp\nhfzxspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1496
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4820
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nhfzxspkhc.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1880
- - C:\Temp\i_nhfzxspkhc.exe
    C:\Temp\i_nhfzxspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrpmkhcz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:520
- - C:\Temp\fzxrpmkhcz.exe
    C:\Temp\fzxrpmkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrpmkhcz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6100
- - C:\Temp\i_fzxrpmkhcz.exe
    C:\Temp\i_fzxrpmkhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhczu.exe ups_run
  2⤵
  PID:5720
- - C:\Temp\ezxrpjhczu.exe
    C:\Temp\ezxrpjhczu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhczu.exe ups_ins
  2⤵
  PID:3344
- - C:\Temp\i_ezxrpjhczu.exe
    C:\Temp\i_ezxrpjhczu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwjhbwurmj.exe ups_run
  2⤵
  PID:3444
- - C:\Temp\zwjhbwurmj.exe
    C:\Temp\zwjhbwurmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwjhbwurmj.exe ups_ins
  2⤵
  PID:2792
- - C:\Temp\i_zwjhbwurmj.exe
    C:\Temp\i_zwjhbwurmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5756
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtomgeywq.exe ups_run
  2⤵
  PID:4872
- - C:\Temp\bwtomgeywq.exe
    C:\Temp\bwtomgeywq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2484
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5728
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtomgeywq.exe ups_ins
  2⤵
  PID:672
- - C:\Temp\i_bwtomgeywq.exe
    C:\Temp\i_bwtomgeywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4304
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtqljdbv.exe ups_run
  2⤵
  PID:3368
- - C:\Temp\dbvtqljdbv.exe
    C:\Temp\dbvtqljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1344
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtqljdbv.exe ups_ins
  2⤵
  PID:4312
- - C:\Temp\i_dbvtqljdbv.exe
    C:\Temp\i_dbvtqljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\yvqnlidays.exe ups_run
  2⤵
  PID:2904
- - C:\Temp\yvqnlidays.exe
    C:\Temp\yvqnlidays.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_yvqnlidays.exe ups_ins
  2⤵
  PID:4136
- - C:\Temp\i_yvqnlidays.exe
    C:\Temp\i_yvqnlidays.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcaysqnhf.exe ups_run
  2⤵
  PID:2448
- - C:\Temp\kfcaysqnhf.exe
    C:\Temp\kfcaysqnhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:612
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2596
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcaysqnhf.exe ups_ins
  2⤵
  PID:5084
- - C:\Temp\i_kfcaysqnhf.exe
    C:\Temp\i_kfcaysqnhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaxvpnif.exe ups_run
  2⤵
  PID:5172
- - C:\Temp\kicaxvpnif.exe
    C:\Temp\kicaxvpnif.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaxvpnif.exe ups_ins
  2⤵
  PID:5148
- - C:\Temp\i_kicaxvpnif.exe
    C:\Temp\i_kicaxvpnif.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxupmkhfz.exe ups_run
  2⤵
  PID:5524
- - C:\Temp\fcxupmkhfz.exe
    C:\Temp\fcxupmkhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3952
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxupmkhfz.exe ups_ins
  2⤵
  PID:2156
- - C:\Temp\i_fcxupmkhfz.exe
    C:\Temp\i_fcxupmkhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1100
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhfzxrpjhc.exe ups_run
  2⤵
  PID:4672
- - C:\Temp\jhfzxrpjhc.exe
    C:\Temp\jhfzxrpjhc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3456
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5900
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhfzxrpjhc.exe ups_ins
  2⤵
  PID:1892
- - C:\Temp\i_jhfzxrpjhc.exe
    C:\Temp\i_jhfzxrpjhc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3376

C:\Temp\cxusmkfcxu.sys
C:\Temp\cxusmkfcxu.sys
1⤵
- Executes dropped EXE
PID:5412

C:\Temp\upmhfzxrpj.sys
C:\Temp\upmhfzxrpj.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\jhbzurpjhb.sys
C:\Temp\jhbzurpjhb.sys
1⤵
- Executes dropped EXE
PID:4112

C:\Temp\uomgezwrpj.sys
C:\Temp\uomgezwrpj.sys
1⤵
- Executes dropped EXE
PID:1476

C:\Temp\lgdbwtoljg.sys
C:\Temp\lgdbwtoljg.sys
1⤵
- Executes dropped EXE
PID:4476

C:\Temp\fdbvtqligd.sys
C:\Temp\fdbvtqligd.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\nlxvqnifay.sys
C:\Temp\nlxvqnifay.sys
1⤵
- Executes dropped EXE
PID:4628

C:\Temp\licaysqkid.sys
C:\Temp\licaysqkid.sys
1⤵
- Executes dropped EXE
PID:3156

C:\Temp\qkhfausnki.sys
C:\Temp\qkhfausnki.sys
1⤵
- Executes dropped EXE
PID:4304

C:\Temp\zxupmkhczx.sys
C:\Temp\zxupmkhczx.sys
1⤵
- Executes dropped EXE
PID:3968

C:\Temp\hfrpjhbzur.sys
C:\Temp\hfrpjhbzur.sys
1⤵
PID:5728

C:\Temp\hbzurmjecw.sys
C:\Temp\hbzurmjecw.sys
1⤵
PID:1864

C:\Temp\ywtrljebwt.sys
C:\Temp\ywtrljebwt.sys
1⤵
PID:2416

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:6048

C:\Temp\igaytqolgd.sys
C:\Temp\igaytqolgd.sys
1⤵
PID:6056

C:\Temp\xsqkidaysq.sys
C:\Temp\xsqkidaysq.sys
1⤵
PID:3952

C:\Temp\pnifdxsqki.sys
C:\Temp\pnifdxsqki.sys
1⤵
PID:1396

C:\Temp\kfcxvpnkec.sys
C:\Temp\kfcxvpnkec.sys
1⤵
PID:5916

C:\Temp\hczxuomkec.sys
C:\Temp\hczxuomkec.sys
1⤵
PID:5140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxusmkfcxu.sys

Path C:\Temp\cxusmkfcxu.sys
Size 141KB
SHA256 f45534cabd9f0699b6f3e7fa257997457e425ec44746af939260fdf36b46a506
MD5 c7cf09d50ce7fca7befafee29a143eee
SHA1 4ef93d8fe28636d53ea3446b86a803c590171b38
SHA512 8c68223e16e887dbf2b1384e652efe4b9805070dd0b9bf1c7b4b5b533f916d8ebdffb59ec78346abd0c0f0b0aa2737445d86bcd0b7ea91005c883ff7d282c65c
SSDEEP 1536:ba3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ba3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T137E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrojhbz.exe

Path C:\Temp\dbztrojhbz.exe
Size 243KB
SHA256 f25091def6615814e87c95b2d7729e38a6f0c95695fe6290a860dd3b55a0359d
MD5 790c7e95c89f0eaed33a0fa2641c70af
SHA1 b0076a3c63805251288b01841ab2427292ca008e
SHA512 1c3c72ed4cab0c201985b1c2d885f456916ff82a00da257e6b6f3ae58f4ac9f0d2711ac946f7dcebca1ae76e07917401d8960542f07a7e17afdfc105104428e6
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:JvMsLaOa3lLNngoqRttA7o
TLSH
T1D1345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gebzwromjh.exe

Path C:\Temp\gebzwromjh.exe
Size 243KB
SHA256 e1805c9f8147111c2fb907aac4aafeb0bccff885d266d89e927af2ad4cc4178c
MD5 fd46f7b41583f3fe2493bdc4a11c84ee
SHA1 81b557edfe4add42d71f722b8bcf2cc6e459edc9
SHA512 c38d28b6af4e19fdae11190b29273b7ff5ad1eb05a50b2da1d01fee52c79bc6dc60f6543427d024eaf1112bf0d2b37503eb2c27b94c75dd35948cf4846b37f6f
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7s:dvMsLaOa3lLNngoqRttA7s
TLSH
T1D4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrojhbz.exe

Path C:\Temp\i_dbztrojhbz.exe
Size 243KB
SHA256 720506c939c411346c78c7faa99478781893abc3228ba111ac4197788093f671
MD5 bdef661d7f2b3b410144df935536b671
SHA1 72c7172f0c1862064322d2716b750cdfdb729f8e
SHA512 126b40a6fd7ecf881ef03a645d9db6a4e49301cf8fbad19da2dec78f81cfbe9e00bb303ad736626f31697e42c8c66120ecfce58aed168e489cbb3757ea50e4e0
SSDEEP 3072:hCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:8vMsLaOa3lLNngoqRttA7v
TLSH
T1E6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gebzwromjh.exe

Path C:\Temp\i_gebzwromjh.exe
Size 243KB
SHA256 b122475f409eb51bae2d1b70fb9f1b41faedf670eb3c4a5e77f22ebedbc7d11d
MD5 6390844c77fcfc13bbb067ece80a9671
SHA1 b772178f1564664a548d952c5c781f69419ade96
SHA512 4e3807e815acc9a4706a116c76511251761d74ab453b6be4f142a60f4b132a75e459af55093a30ea6718be199c553baf8801be47479ef0e3dad5746eb286a008
SSDEEP 3072:DCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:GvMsLaOa3lLNngoqRttA7l
TLSH
T1C6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtolge.exe

Path C:\Temp\i_ljdbvtolge.exe
Size 243KB
SHA256 7278c07d2ad0f3c046295de85247e918883781671ac8b5737bbc2d1defeaab5a
MD5 320530b75ee79309fde3cd3c830064ea
SHA1 0f8d8d6eb43c81d499821187534b0c9e3bbc8113
SHA512 55c32f909708e6d8a32ed762cb75c0721a6c3ba7fb1a3c685763ac2fe671f2f659b238da01d26e4a1c0a12bae293c22a1f6ab32f0cad3a8d8d422ebbe3242ce6
SSDEEP 3072:uCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Q:hvMsLaOa3lLNngoqRttA7Q
TLSH
T18B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhezxrpjhb.exe

Path C:\Temp\i_mhezxrpjhb.exe
Size 243KB
SHA256 be9526c39dd1c24d3172f936d55f6ec701a01467f64dc902d697e266d60a70c1
MD5 d789c10b6c527d61d7b538155fb3dcf2
SHA1 68a41d66c83dfdcf6f6d9cff3ea776caa9ba5721
SHA512 651d17683fe1fbe821a248faf3a85b3832468ef5c67f1f1e0d7654a09ea1d7daccc592954b81e292e702a8779dc543f2e17e9b4bf75a68b10a5969be36b938fa
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7q:XvMsLaOa3lLNngoqRttA7q
TLSH
T103345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vpnhfaxsqk.exe

Path C:\Temp\i_vpnhfaxsqk.exe
Size 243KB
SHA256 41dc87949ddc47120f89222bfb71de0ff24c58e9b5bf0e4b0c73cc032dcc37c1
MD5 66eae10df44e4254d8a87cec477b1ec8
SHA1 36215f065b1b6b0ed6a19f819a3e215ca812692f
SHA512 d99e9f4614e2003d6185cda2c6006564c7e7321e02996d0eb98ab1638d9f6bfde373509d0d2a84c78d80a0e5173183ec0bc17a93a36448c97abaa7d0f094c586
SSDEEP 3072:jCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7l:mvMsLaOa3lLNngoqRttA7l
TLSH
T1DD345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspnhecxus.exe

Path C:\Temp\i_xspnhecxus.exe
Size 243KB
SHA256 5dc7e6f56292e88086271e79dc342fba6ceb795cd08012bf5b839d252fa0ac13
MD5 da1ce355a4d0ab61832be16e05aa6086
SHA1 f079f2ffa9ca278aae4835e11bb0a988fbe76f5e
SHA512 84296864242dbe20cf09ee4df1f9d77c03638f35619247b10f573f5b5713e4d387720c7ed83940e039600daff42dea5c658b141d8cdfa1077da4586467e6c73c
SSDEEP 3072:QCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7y:LvMsLaOa3lLNngoqRttA7y
TLSH
T14E345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurpjhb.sys

Path C:\Temp\jhbzurpjhb.sys
Size 141KB
SHA256 a37c6e4f69b03317b99ecaac778662011f3e39ebb55e1d9f29d4b22684242f8e
MD5 6753670171be0722fccbff5190ac6849
SHA1 ef28888c0ae082e34f5afa4a8dc633437c4ee1f8
SHA512 b03b8ce5c9dad1872ad1e028ae67eafec2fd65a4ee589871b1fd491274065a3dc990b7740ad8dbd64f888b2ec32a1728b692028ed55b93441ca09b8b8f5d0b02
SSDEEP 1536:ka3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ka3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T19CE38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgdbwtoljg.sys

Path C:\Temp\lgdbwtoljg.sys
Size 141KB
SHA256 9dc4a85db122775099d577bf2ee1a02b21fd4af95511bc1ca72127ae808bd28f
MD5 e6813a10117ce96ea9404bbc153c703f
SHA1 6043850e3d23324b3cc54bea220f3045833ce166
SHA512 e79e0cab064152a8dc7eb1d40ac3b1ce3004a6ff1b07569aa21ed9014c8d4f47a724bfb26059acb3889e336f16704ba10ec46400622dce01f3bf23093d99d42b
SSDEEP 1536:2a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:2a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11FE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtolge.exe

Path C:\Temp\ljdbvtolge.exe
Size 243KB
SHA256 42f0069fe1072620e8454685176dc6aaf7c7d0cf51349f8d82421ccfb604808f
MD5 c72a685fc9750bda4e36802a9f601f4f
SHA1 6a6eaad64833828effef0de697620ce8cb0e133b
SHA512 c5980ace427a3fb3996f79ade5cfc33129ccd38e6a4e08275138d0f6eca32a284f5f83288d85e319714eb4b3c2c0f8dd0666d39a498bd30fbe876af1376e23c9
SSDEEP 3072:1CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:4vMsLaOa3lLNngoqRttA77
TLSH
T154345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhezxrpjhb.exe

Path C:\Temp\mhezxrpjhb.exe
Size 243KB
SHA256 fd733cddaac3bdbe5e321d6146f6668433d624d098f4c249102866ab94952147
MD5 f6f08a186af8241b514237ab0060a72c
SHA1 bf8cde0dc9b7200052d9663e17e2096e0eb9ba9c
SHA512 0b8940d0e9776f815c9ae5e78aa1e97115e24257c4e03b3b7eaa79db8d77348be16174e0d5583e91809375ba84f7b04846c4b37d13a8180994343390c9cb8289
SSDEEP 3072:mCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:JvMsLaOa3lLNngoqRttA7w
TLSH
T12D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomgezwrpj.sys

Path C:\Temp\uomgezwrpj.sys
Size 141KB
SHA256 0724ca811aabe02fa9b0de3ad37ffce5ff83bcf406ff70d4391bab1df90a13c2
MD5 5d142ab32a75e59d57b4e1f0fbc01a8c
SHA1 1e306aaa391a9466e1c82c8b49c33ecac05161e3
SHA512 08097b2f275a7d870f2f61518aec467b50ac594aec3a8d02c2bad51d459ffa10982bb1f1b132eade8ae5b03bf6e804e8e5191bbc1265b4880e9906effa7a302a
SSDEEP 1536:Qa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ACE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmhfzxrpj.sys

Path C:\Temp\upmhfzxrpj.sys
Size 141KB
SHA256 c31cdf2fea5ac944b2a6ced270a527ce6c93938f996442f9110dc7cbd48f44f8
MD5 9d40235f14c0fbcfbd5f064adb7d1bc0
SHA1 e42cf568f569af960b3dd214d78e27279f25f350
SHA512 561c3b6bdacc58226ae4098655f72080454541c7c42fae608bf7c75bdd4e2356ccca57e751e0e8b88db3e19d6076418a87d32d5905511699049962f3755c09fa
SSDEEP 1536:ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T124E37C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vpnhfaxsqk.exe

Path C:\Temp\vpnhfaxsqk.exe
Size 243KB
SHA256 272ae73391a18e3cce6da55315f2f11f4c9a00b2f88fe9c22c41086b39850327
MD5 f56df301d5505023a109206b6df7a3ac
SHA1 66e0f9e4b34a1c5dc1424f723f2c7f51428fc953
SHA512 bcd2d4c05dff63079cfab51d79e7d1bc12072e9d129a7b7ea667951751e3251a16cc5d94c3e64d7f65879ccc7c13fa6c581c21e792296f581e8e712065df2d02
SSDEEP 3072:dCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7T:QvMsLaOa3lLNngoqRttA7T
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspnhecxus.exe

Path C:\Temp\xspnhecxus.exe
Size 243KB
SHA256 48e589c150e23af133ea9a8f9d6ea35ccc771e64927c7609e0d79e4105364a40
MD5 c73de3fb05a06e780839e3af31ff43d6
SHA1 3c552684afdc78f50c4da875752313512ef0fc7d
SHA512 8b7c0f1c0c8f3533b947b3d4a813e9aed9f2efd2745b9dbad819febff6a2935f51ea9199d140e01239ec0523a7dc35629342c8f68d2f6399778abe9dba0b81a7
SSDEEP 3072:6CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:lvMsLaOa3lLNngoqRttA7g
TLSH
T102345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2bdeaf787837dcd800e8940e211fc4d259684847a5587484eb52966fe6012ae
MD5 b76ee844580057ae18f58a141a9843b1
SHA1 43780e493b2376dfcc8dccef3acbd5a422516806
SHA512 448e9c32953423f40ac4412bfce027a2cc6e470cb1d5d4d47ada82da4242c26e922a65d3524f1a8bef985289be70cb7a2b7b1c750c613013c8b66a04dec30eba
TLSH
T1DB61214B236E04E9D36A4A7251D9774436F086704D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592bd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592bd9.TMP
Size 3KB
SHA256 6d70559ab74ae323ffd86e6eb4b0311bd25bdbdfa323d803c25df2397498cc8e
MD5 3a34bb9a0d3210512c3667575cda52ee
SHA1 17f52e80b5df43f56252fb0b07919dadf3624e9b
SHA512 31551c78a979549313de86b2d8ba0ef240705c00c810068b179a66c9a0944bdd41a90fc798640569f73332a603c0949023261e017c8691d43cd35b1313b7a8ff
TLSH
T1A661214A235E04E9D36A4A7254D9774436F086744D07BF8080F6DEBADC2AF5892F921F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01343a92-7626-4a5c-bb4c-305a332e7c96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\01343a92-7626-4a5c-bb4c-305a332e7c96.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6bebfd4ab53af92bc66c1a73203781073859c88fadbe10825a1a326c9ea2bd12
MD5 48fe328c08dc7ce44d685287f28f3f74
SHA1 ce59a04feb85c2a63677fafb031e0eb14fccacf0
SHA512 194cecdc97a0718a12001c97ac53efc499bbcace96f01f49225c0f52210f17ab44427fdd1a36b9fea080075ea71efe9fc81e5f9ede7d2d1aa53a4fa5136b17ba
TLSH
T11A519CF3C6E8862DC90156F0AB186E1BDE2D0914832C3D5AC8E4AE1BA3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 74d03067acd0c0b38c75dc57e9fdee592682b08d2fa39f0ef488ba50d1d3b680
MD5 0f8ac8ecfcc2a7f998ad8a44619a2994
SHA1 62f5f66040356b32dc0a42bf55a7133fd5c5e86f
SHA512 349c41d7764dc26a22c319ddc02199099ccf4a02519c0363b2258eadb1d162763710993f18ae0b9f15752763a234e9e96ff3243160e3fc0ad72d5f487cecaee7
SSDEEP 192:sxRlRSCM/f7s1S0TZb29Y/zoA8p9H/g6+WNCsg/YnO3hZG3IgVrPVJ:sxRlTM/f7s1S0db2l/5e/fRYp
TLSH
T1F042C7556E28A93B4CCBD61DBB297F53D6F95032A0911E58F6FC9A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 218d47011c191a5cb59d3c24025e412966b65011fa591584537eef45a9d57682
MD5 be2dbc9426ab51907bd4b798184a3147
SHA1 60e80366f107306b32659db705ea78bafa99a413
SHA512 b3c4e2944198018fd21f0b1e82b36bbf7e844284642073084a91bcc74051475a2e9d6974bc7dd6ff8b2b4e9279701893751ea1c4658d1fcfac1c59905f97ec07
SSDEEP 192:sxRiRSCM/f7s3S0TZb29Y/zoA8p9H/g6+WNCsg/YnO3hZG3IgDhrPVJ:sxRiTM/f7s3S0db2l/5e/fRYx
TLSH
T18842D7566E28A93B4CCBD61DBB257F53D2F95032A0911E58A7FC9A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d823289c50b5858733e33dc7afc2f953aa97a2d3c4f9131abb4be9b0b2316132
MD5 b8a19a8821e738c5a7e60ed42c189c75
SHA1 4db66c7cfe9c9acd1cf0873e9acd161b5754a6ae
SHA512 0455ff87a4622216afb90bdf01e84e5c047e6443a6e44b797e970eed243cd40a96f4b03fb7e3568295da3c7c1b863276fef377800b2b39a5bebf6586c9a06b2b
SSDEEP 192:sxRiRSCM/f7s3SOTZb29Y/zoA8p9H/g6+WNCsg/YnOjhZG3IgDLrPVJ:sxRiTM/f7s3SOdb2l/5e/fVYj
TLSH
T14E42C8556A286D3B5CCBE61DBB257F53E2F95032A0911E58B7FC9A1C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 d103847083f0693ed9b3ac014fcb419095efda6cb52c621f0045d68b0fc9ad20
MD5 48d885636bc026f26e7a2565043bf50b
SHA1 bb909c25d4c5e0a0503fbbb604783fc01556251d
SHA512 92fc0f520176758044e4f0c1b2fe28aeda1fe088387553334401f1f487d0dd22aa542ce542413db6deba644a96977aba784a6b78d55f16c6ab88b641377f20ec
SSDEEP 768:wb8dFs7pLuLfR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVwemu465rohRhUp:wb8dFQEfR6Wgouf6Mu1jaPemV6yhUp
TLSH
T17DD2DA7B740DCA7F4F800ADDEC19BE9F6DA802CB96D8C94447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0a71df068ecdd3192c00845ab2ec1724cc5396a7a808634b9c08dfe76b311fdc
MD5 f5ea2a353e4103907b50b320363fcccc
SHA1 e0c19e8e41fecf99161d0611ecf2f833f4af3e16
SHA512 b6c423715bbd08d2ea00dff6ebbb4896d78af20b21649ada40eb297755d50d43d01044eade1e60ebfcbd2bc56a8634c76b37265b752a88ae2ea1d9edb5957e7d
SSDEEP 96:KRtaTHd3LfWTI2gPfK4Ogxfc1NAj70HS3eyEkUyW8pBgiyK43gYyciKxQWu5SOkt:CtaTHd3LeTInPlOgxU1NAj70HS3eyEk6
TLSH
T142914745307B42803C3E7E5C80798C1B96C27472745AA56BFBA916E11F6AF124EFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c951.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c951.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2015098167777ceca06ac23ea9906e3c6fbf32c25aefa89186d43eb6dedffab9
MD5 67ecd9a0623eb64a847c558998f3740e
SHA1 fb31f0293b4069de8c62b3b3b614008113a709ae
SHA512 acd504eafc7b91ca05b79c5a1597569693dd55f9640ae87dc766db3bc77b98fc2b05d96b322fe1b9b643367e913422a07551461bf84b906b7b35c1ed562017c1
SSDEEP 768:ezP393PpDZIO0X6RNzc4ReyIsPtjLwJBBue:eL3JxRtc44bsljLwnBr
TLSH
T19BF2BFB1A835DC639CEAE246B50B7293BEF4513781C85E84D9ED4B0C05476ED1B1F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9668cec8c75130ce5011739e58333b3fbe6a69e5f31894d1122c2c1a2946313c
MD5 eca4d2476ab2c3361825a35dd2744910
SHA1 8253a1a3c3b969385e22fe0a0240426b0965ef40
SHA512 f6d12b21e0b8fdc533e06041fc0e033ec9bbe54f1a297af5ade50041a95117d27377c43c69cee58a668470d9f7af46800be5bf678598a04746a461216cdef0eb
SSDEEP 768:JzP3c3PpDZIO0X6RNzc4ReyIsPtjLwJBBue:JL30xRtc44bsljLwnBr
TLSH
T1DDF2BF71A835DC63ACEAE246B50B7293BEF4513781C45E84D9ED4B0C05476ED1B1F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25d821e6aebf3c992f33e37263ce671a176427518e5eadabd6538462ccdebd9c
MD5 aedf64e73034878e25adbebc76da1450
SHA1 0b647269ec8dc5d4cde6c3d8439e7d2dbb81ec40
SHA512 75a13764058989ef4efc4a767ff14e41de4cf87c91e2f1b85345760f02c05bd73fb5d351a972cc2275ea5d14be2949c06fec0c25f633887f4589ed77a2afc70c
SSDEEP 768:Trv+4UNbdUP302m9pDZIO0X6JNzc4ReyIsPt5:Tbsb+3nmbJtc44bsl5
TLSH
T1C003CE32F838DD73ACEAA645B10B72937EF8206781C50E94D9DA6B0C05476ED271F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 066f1351b247f53b16607c8b7474fd6b8d7568eb9b4a2617b794f12e4883ae60
MD5 88745e11189c24ba350363ea243b37ab
SHA1 02d20ce76f4714bf6f71f5f5c0567a5206d4fe94
SHA512 ac75d685b7bc22686ecbd2ac73241fcf44dbde79dd472647c3e46963f084efc1f51a2d6e7f2ca92e1db1c06ebfe43cde295b6e6080108b731041f2fcfb135200
SSDEEP 768:6rv+4UNbds3hBDZIO0sNzc4ReyIsXgeVH1S5D:6bsbS37tc44bsQEH1Y
TLSH
T1E003CF32A8788937ECF6A686B54B76137EF8611B82D81F90C5DE6F0C464B5DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 bf59e01a563fedace7b8d86184c49f9aa752daade3709fc5da6232eb1311798a
MD5 cc5944a0da527e90f1270661a295015f
SHA1 37cb95e74c27232a916054591e8023e44aacf0de
SHA512 a2c7ea2ce08d1664e996d15199888c3d9a8eb9d87ab50b491c24a714613e11c04b9282cb71b051644cad049bb3b2ddfd1fd2334c5acf84a1ecd6cd70539e07ec
SSDEEP 768:tFQ8P3mwgo3A4Zw5O0X6RNzc4ReyIsPtjLwJBBue:8E3TnRtc44bsljLwnBr
TLSH
T1EC1328F698E38977E8AE9747A73D6D429DFCC123B1885980B7994D0CCC461BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

85c9a225-d86d-4cf8-a49c-8acf8e27485c.tmp

Path C:\Users\Admin\AppData\Local\Temp\85c9a225-d86d-4cf8-a49c-8acf8e27485c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3120_1809959653\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1396-700-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1476-541-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1476-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1864-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1952-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2416-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3156-565-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3952-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3968-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4112-494-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4304-569-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4476-519-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4628-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-466-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5140-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5412-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5728-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5916-704-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6048-662-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6056-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download