d949f84e5faed7684f7b986c9b1a679346a5e3c4c4a33de50e7af4ff60e29ac4

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260808-lvtefavaja
SHA256 d949f84e5faed7684f7b986c9b1a679346a5e3c4c4a33de50e7af4ff60e29ac4
MD5 9443cef491afb0fc2e780aca9b0040fe
SHA1 4021391443b3b5c556175f38804fc31e5d24d091
SHA512 01e4edefe99246527239945bbda40123dc9e5314e60b26aa40dffaba3ae093265b7a498afd5621188469bc9871fda01678c0618170bf340b77928099471feebf
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T13E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2932	CP.exe
1124	hfzxspkicx.exe
4732	CP.exe
3296	CP.exe
972	i_hfzxspkicx.exe
6088	zxrpjhfzxu.sys
3792	CP.exe
1408	pmkeczurpk.exe
4232	CP.exe
1220	CP.exe
2956	i_pmkeczurpk.exe
1736	hecwuomhez.sys
4052	CP.exe
3024	cwuomhezwr.exe
412	CP.exe
1292	CP.exe
3904	i_cwuomhezwr.exe
4368	wuomgebzwr.sys
2204	CP.exe
6124	olgdbwtrlj.exe
6112	CP.exe
1620	CP.exe
1084	i_olgdbwtrlj.exe
4776	rljgbztqoi.sys
4352	CP.exe
3052	mgdywtoljg.exe
3548	CP.exe
1380	CP.exe
2120	i_mgdywtoljg.exe
1396	dyvqnligay.sys
724	CP.exe
1912	daywqoigay.exe
1736	CP.exe
5412	CP.exe
260	i_daywqoigay.exe
3164	davtnlfdxv.sys
2804	CP.exe
2668	sqnifaysqk.exe
3628	CP.exe
5320	CP.exe
3344	i_sqnifaysqk.exe
4080	vpnifdxvsq.sys
3452	CP.exe
4208	hfdauspkhf.exe
1744	CP.exe
3524	CP.exe
1084	i_hfdauspkhf.exe
4592	xvpnhfaxsq.sys
4752	CP.exe
4284	mkicxvpnkf.exe
2780	CP.exe
5896	CP.exe
1092	i_mkicxvpnkf.exe
4412	nhfzxrpjhf.sys
5904	CP.exe
4864	heczurpjhf.exe
3412	CP.exe
3344	CP.exe
2548	i_heczurpjhf.exe
1288	mhezxrpjhc.sys
4720	CP.exe
3580	ecwurmkezw.exe
5768	CP.exe
932	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1150025887\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_684115569\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1330343688\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1330343688\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1330343688\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_1260351558\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5960_646494462\_locales\ru\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgdbwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojhbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgdbwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlidyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlidyvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomhezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmkezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axspkhfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczurpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgdywtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_daywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdauspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axspkhfaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzwus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdauspkhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicxvpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojhbzto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxspkicx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgdywtoljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	daywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicxvpnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeyw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4868	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
6080	ipconfig.exe
6092	ipconfig.exe
3184	ipconfig.exe
6084	ipconfig.exe
2912	ipconfig.exe
3156	ipconfig.exe
1900	ipconfig.exe
5436	ipconfig.exe
2376	ipconfig.exe
1916	ipconfig.exe
5300	ipconfig.exe
5300	ipconfig.exe
4736	ipconfig.exe
2652	ipconfig.exe
2500	ipconfig.exe
6104	ipconfig.exe
5112	ipconfig.exe
4636	ipconfig.exe
3048	ipconfig.exe
5936	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306563074011942"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{B9D686E2-4248-42F6-BB9D-43C1FC1EE50B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	i_hfzxspkicx.exe
Token: SeDebugPrivilege	2956	i_pmkeczurpk.exe
Token: SeDebugPrivilege	3904	i_cwuomhezwr.exe
Token: SeDebugPrivilege	1084	i_olgdbwtrlj.exe
Token: SeDebugPrivilege	2120	i_mgdywtoljg.exe
Token: SeDebugPrivilege	260	i_daywqoigay.exe
Token: SeDebugPrivilege	3344	i_sqnifaysqk.exe
Token: SeDebugPrivilege	1084	i_hfdauspkhf.exe
Token: SeDebugPrivilege	1092	i_mkicxvpnkf.exe
Token: SeDebugPrivilege	2548	i_heczurpjhf.exe
Token: SeDebugPrivilege	3112	i_ecwurmkezw.exe
Token: SeDebugPrivilege	2516	i_ebwtomgeyw.exe
Token: SeDebugPrivilege	2544	i_zwrojhbzto.exe
Token: SeDebugPrivilege	3932	i_eywqoigayt.exe
Token: SeDebugPrivilege	2536	i_qnlidyvqni.exe
Token: SeDebugPrivilege	4424	i_vsnkicavsn.exe
Token: SeDebugPrivilege	5476	i_axspkhfaxv.exe
Token: SeDebugPrivilege	4288	i_zxspkfcxup.exe
Token: SeDebugPrivilege	2664	i_urpjhbzwus.exe
Token: SeDebugPrivilege	4988	i_urpjhbztrl.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4220 wrote to memory of 3404	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3404 wrote to memory of 5960	3404	iexplore.exe	90
PID 5960 wrote to memory of 4060	5960	msedge.exe	91
PID 5960 wrote to memory of 1468	5960	msedge.exe	92
PID 5960 wrote to memory of 4868	5960	msedge.exe	94
PID 5960 wrote to memory of 1468	5960	msedge.exe	92
PID 5960 wrote to memory of 1468	5960	msedge.exe	92
PID 5960 wrote to memory of 5448	5960	msedge.exe	95
PID 5960 wrote to memory of 5448	5960	msedge.exe	95
PID 5960 wrote to memory of 4052	5960	msedge.exe	96
PID 5960 wrote to memory of 2540	5960	msedge.exe	97
PID 5960 wrote to memory of 4052	5960	msedge.exe	96
PID 5960 wrote to memory of 4052	5960	msedge.exe	96
PID 5960 wrote to memory of 2540	5960	msedge.exe	97
PID 5960 wrote to memory of 2540	5960	msedge.exe	97
PID 5960 wrote to memory of 712	5960	msedge.exe	98
PID 5960 wrote to memory of 712	5960	msedge.exe	98
PID 5960 wrote to memory of 712	5960	msedge.exe	98
PID 5960 wrote to memory of 2272	5960	msedge.exe	99
PID 5960 wrote to memory of 2272	5960	msedge.exe	99
PID 5960 wrote to memory of 2272	5960	msedge.exe	99
PID 5960 wrote to memory of 5032	5960	msedge.exe	100
PID 5960 wrote to memory of 5032	5960	msedge.exe	100
PID 4220 wrote to memory of 2932	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5960 wrote to memory of 5440	5960	msedge.exe	105
PID 5960 wrote to memory of 4716	5960	msedge.exe	104
PID 5960 wrote to memory of 5440	5960	msedge.exe	105
PID 5960 wrote to memory of 4716	5960	msedge.exe	104
PID 1124 wrote to memory of 4732	1124	hfzxspkicx.exe	108
PID 5960 wrote to memory of 4256	5960	msedge.exe	109
PID 5960 wrote to memory of 5008	5960	msedge.exe	112
PID 5960 wrote to memory of 5008	5960	msedge.exe	112
PID 5960 wrote to memory of 3640	5960	msedge.exe	113
PID 5960 wrote to memory of 3640	5960	msedge.exe	113
PID 5960 wrote to memory of 3264	5960	msedge.exe	116
PID 5960 wrote to memory of 3264	5960	msedge.exe	116
PID 5960 wrote to memory of 6044	5960	msedge.exe	117
PID 5960 wrote to memory of 6044	5960	msedge.exe	117
PID 4220 wrote to memory of 3296	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 4220 wrote to memory of 3792	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 1408 wrote to memory of 4232	1408	pmkeczurpk.exe	124
PID 4220 wrote to memory of 1220	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 4220 wrote to memory of 4052	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 3024 wrote to memory of 412	3024	cwuomhezwr.exe	133
PID 4220 wrote to memory of 1292	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 4220 wrote to memory of 2204	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 6124 wrote to memory of 6112	6124	olgdbwtrlj.exe	142
PID 4220 wrote to memory of 1620	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 5960 wrote to memory of 628	5960	msedge.exe	148
PID 5960 wrote to memory of 3612	5960	msedge.exe	149
PID 5960 wrote to memory of 2868	5960	msedge.exe	150
PID 4220 wrote to memory of 4352	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3052 wrote to memory of 3548	3052	mgdywtoljg.exe	155
PID 4220 wrote to memory of 1380	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 4220 wrote to memory of 724	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 1912 wrote to memory of 1736	1912	daywqoigay.exe	164
PID 4220 wrote to memory of 5412	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 4220 wrote to memory of 2804	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 2668 wrote to memory of 3628	2668	sqnifaysqk.exe	173
PID 4220 wrote to memory of 5320	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 4220 wrote to memory of 3452	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 4208 wrote to memory of 1744	4208	hfdauspkhf.exe	182
PID 4220 wrote to memory of 3524	4220	2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 5960 wrote to memory of 4776	5960	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_9443cef491afb0fc2e780aca9b0040fe_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4220
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x314,0x7ffef9e1c188,0x7ffef9e1c194,0x7ffef9e1c1a0
      4⤵
      PID:4060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,13579447908757062858,14921909730424562793,262144 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
      4⤵
      PID:1468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,17958297529053123397,8504004216477830720,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:11
      4⤵
      System Time Discovery
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,3000927749902606648,8054120760629076986,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,8267263586962990620,14002309335145895408,2097152 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:4052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,3482714350722395926,16138716475964618883,2097152 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:2540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9687572326381808205,7209347057507328392,2097152 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:9
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16143345026739537865,4750512108381341924,2097152 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,12367487203531672592,15950979367537158014,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14967284720290163077,11332561830507374914,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:4716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3341626016015196186,10420498529556140006,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:5440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9809364238488214588,4702519657400886430,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,9809364238488214588,4702519657400886430,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,13533089140302481367,4487240243200354037,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,5874482255156093140,9673607796338783425,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:3640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,5567169639564050688,16134276143074421518,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,4154779550252038736,3057960751270034969,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,1905559148199399620,10475614218891995868,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,918478910378269103,6888715181822885042,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:3612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,2069217620678341862,9812612181087745152,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:2868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,1681587182835738952,1021502806690914686,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,14052409142925098772,17589298491925405343,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=5628 /prefetch:14
      4⤵
      PID:3572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,13397083419394036264,15113157627367703191,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,10226589147543580302,14572915208709961544,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,7524865007012762115,16119685303105054116,262144 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,3606050176850055081,363578405043699244,524288 --field-trial-handle=2172,i,5993127835697933910,1513734367794090024,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:3516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxspkicx.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2932
- - C:\Temp\hfzxspkicx.exe
    C:\Temp\hfzxspkicx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4732
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxspkicx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Temp\i_hfzxspkicx.exe
    C:\Temp\i_hfzxspkicx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmkeczurpk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\pmkeczurpk.exe
    C:\Temp\pmkeczurpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmkeczurpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1220
- - C:\Temp\i_pmkeczurpk.exe
    C:\Temp\i_pmkeczurpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomhezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4052
- - C:\Temp\cwuomhezwr.exe
    C:\Temp\cwuomhezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomhezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1292
- - C:\Temp\i_cwuomhezwr.exe
    C:\Temp\i_cwuomhezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgdbwtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2204
- - C:\Temp\olgdbwtrlj.exe
    C:\Temp\olgdbwtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6112
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgdbwtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1620
- - C:\Temp\i_olgdbwtrlj.exe
    C:\Temp\i_olgdbwtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgdywtoljg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4352
- - C:\Temp\mgdywtoljg.exe
    C:\Temp\mgdywtoljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3548
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5300
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgdywtoljg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1380
- - C:\Temp\i_mgdywtoljg.exe
    C:\Temp\i_mgdywtoljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\daywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:724
- - C:\Temp\daywqoigay.exe
    C:\Temp\daywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1736
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_daywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5412
- - C:\Temp\i_daywqoigay.exe
    C:\Temp\i_daywqoigay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqnifaysqk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2804
- - C:\Temp\sqnifaysqk.exe
    C:\Temp\sqnifaysqk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3628
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqnifaysqk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5320
- - C:\Temp\i_sqnifaysqk.exe
    C:\Temp\i_sqnifaysqk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfdauspkhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3452
- - C:\Temp\hfdauspkhf.exe
    C:\Temp\hfdauspkhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1744
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfdauspkhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3524
- - C:\Temp\i_hfdauspkhf.exe
    C:\Temp\i_hfdauspkhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkicxvpnkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4752
- - C:\Temp\mkicxvpnkf.exe
    C:\Temp\mkicxvpnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkicxvpnkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5896
- - C:\Temp\i_mkicxvpnkf.exe
    C:\Temp\i_mkicxvpnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\heczurpjhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5904
- - C:\Temp\heczurpjhf.exe
    C:\Temp\heczurpjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4864
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5436
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_heczurpjhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3344
- - C:\Temp\i_heczurpjhf.exe
    C:\Temp\i_heczurpjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ecwurmkezw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4720
- - C:\Temp\ecwurmkezw.exe
    C:\Temp\ecwurmkezw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3580
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ecwurmkezw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:932
- - C:\Temp\i_ecwurmkezw.exe
    C:\Temp\i_ecwurmkezw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwtomgeyw.exe ups_run
  2⤵
  PID:1092
- - C:\Temp\ebwtomgeyw.exe
    C:\Temp\ebwtomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5248
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwtomgeyw.exe ups_ins
  2⤵
  PID:4348
- - C:\Temp\i_ebwtomgeyw.exe
    C:\Temp\i_ebwtomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwrojhbzto.exe ups_run
  2⤵
  PID:4576
- - C:\Temp\zwrojhbzto.exe
    C:\Temp\zwrojhbzto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4668
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwrojhbzto.exe ups_ins
  2⤵
  PID:2020
- - C:\Temp\i_zwrojhbzto.exe
    C:\Temp\i_zwrojhbzto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqoigayt.exe ups_run
  2⤵
  PID:1016
- - C:\Temp\eywqoigayt.exe
    C:\Temp\eywqoigayt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5072
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqoigayt.exe ups_ins
  2⤵
  PID:3824
- - C:\Temp\i_eywqoigayt.exe
    C:\Temp\i_eywqoigayt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlidyvqni.exe ups_run
  2⤵
  PID:5092
- - C:\Temp\qnlidyvqni.exe
    C:\Temp\qnlidyvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3472
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlidyvqni.exe ups_ins
  2⤵
  PID:2040
- - C:\Temp\i_qnlidyvqni.exe
    C:\Temp\i_qnlidyvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkicavsn.exe ups_run
  2⤵
  PID:364
- - C:\Temp\vsnkicavsn.exe
    C:\Temp\vsnkicavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3124
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkicavsn.exe ups_ins
  2⤵
  PID:840
- - C:\Temp\i_vsnkicavsn.exe
    C:\Temp\i_vsnkicavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axspkhfaxv.exe ups_run
  2⤵
  PID:5112
- - C:\Temp\axspkhfaxv.exe
    C:\Temp\axspkhfaxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axspkhfaxv.exe ups_ins
  2⤵
  PID:4368
- - C:\Temp\i_axspkhfaxv.exe
    C:\Temp\i_axspkhfaxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxspkfcxup.exe ups_run
  2⤵
  PID:6108
- - C:\Temp\zxspkfcxup.exe
    C:\Temp\zxspkfcxup.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxspkfcxup.exe ups_ins
  2⤵
  PID:5088
- - C:\Temp\i_zxspkfcxup.exe
    C:\Temp\i_zxspkfcxup.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbzwus.exe ups_run
  2⤵
  PID:4860
- - C:\Temp\urpjhbzwus.exe
    C:\Temp\urpjhbzwus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbzwus.exe ups_ins
  2⤵
  PID:5812
- - C:\Temp\i_urpjhbzwus.exe
    C:\Temp\i_urpjhbzwus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2664
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbztrl.exe ups_run
  2⤵
  PID:2684
- - C:\Temp\urpjhbztrl.exe
    C:\Temp\urpjhbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4756
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbztrl.exe ups_ins
  2⤵
  PID:4112
- - C:\Temp\i_urpjhbztrl.exe
    C:\Temp\i_urpjhbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:944

C:\Temp\zxrpjhfzxu.sys
C:\Temp\zxrpjhfzxu.sys
1⤵
- Executes dropped EXE
PID:6088

C:\Temp\hecwuomhez.sys
C:\Temp\hecwuomhez.sys
1⤵
- Executes dropped EXE
PID:1736

C:\Temp\wuomgebzwr.sys
C:\Temp\wuomgebzwr.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\rljgbztqoi.sys
C:\Temp\rljgbztqoi.sys
1⤵
- Executes dropped EXE
PID:4776

C:\Temp\dyvqnligay.sys
C:\Temp\dyvqnligay.sys
1⤵
- Executes dropped EXE
PID:1396

C:\Temp\davtnlfdxv.sys
C:\Temp\davtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:3164

C:\Temp\vpnifdxvsq.sys
C:\Temp\vpnifdxvsq.sys
1⤵
- Executes dropped EXE
PID:4080

C:\Temp\xvpnhfaxsq.sys
C:\Temp\xvpnhfaxsq.sys
1⤵
- Executes dropped EXE
PID:4592

C:\Temp\nhfzxrpjhf.sys
C:\Temp\nhfzxrpjhf.sys
1⤵
- Executes dropped EXE
PID:4412

C:\Temp\mhezxrpjhc.sys
C:\Temp\mhezxrpjhc.sys
1⤵
- Executes dropped EXE
PID:1288

C:\Temp\mjebztrmje.sys
C:\Temp\mjebztrmje.sys
1⤵
PID:820

C:\Temp\bztrojgebz.sys
C:\Temp\bztrojgebz.sys
1⤵
PID:2040

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:3360

C:\Temp\qnlidbvtnl.sys
C:\Temp\qnlidbvtnl.sys
1⤵
PID:3164

C:\Temp\davtnlidav.sys
C:\Temp\davtnlidav.sys
1⤵
PID:1280

C:\Temp\axspnhfcau.sys
C:\Temp\axspnhfcau.sys
1⤵
PID:2880

C:\Temp\causmkfcxu.sys
C:\Temp\causmkfcxu.sys
1⤵
PID:3572

C:\Temp\xupmhecwus.sys
C:\Temp\xupmhecwus.sys
1⤵
PID:1584

C:\Temp\czurpjhbzt.sys
C:\Temp\czurpjhbzt.sys
1⤵
PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomhezwr.exe

Path C:\Temp\cwuomhezwr.exe
Size 226KB
SHA256 0648ce5f8519edc55c0e8c90c458f9504ebe6af0b5e7bd06568ef262707027f5
MD5 962fde726feab0a760319df41f8411f4
SHA1 3c88216fbb911af42a22a88ceb4751aa065afcb4
SHA512 1305bdf8cc1445587dbacc1f2ded104d67bc94f80d9e82138218055552d849fcfadd88c818aeefd7b701faca7d1758b9907344f4051f8f02ecb5c72f5a9a0c96
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T14734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daywqoigay.exe

Path C:\Temp\daywqoigay.exe
Size 226KB
SHA256 f958af1cb91fb4dd9a77a4caaff97dabbce34c9945d49eb345823958b26ab82e
MD5 d1b81c63fa32e8b517d5f6342791d89b
SHA1 d289c125d969936f93bcf92eed985d518421b1a2
SHA512 636c1be4d765ddd48fb0214839b217be5c88b6cfa10d19e2f063718425d53fe61a291707862b1659880c4da7830438f73648a6d03fb7b5d0c95c2359fedfc9f9
SSDEEP 3072:FGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:kXY4LK+a3lLNngoqRttA7
TLSH
T1E034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqnligay.sys

Path C:\Temp\dyvqnligay.sys
Size 141KB
SHA256 5884c31a823022ad457665bb9975f60eefad7e133c73faef12a2c2a3738f9217
MD5 6195199f3288145e4537c7ad8cd32b47
SHA1 f0bcc59ce5419d6d3a651ab757bde30a5b295931
SHA512 8e5ef9e214afce080efedd1db0912d95894ac9f2b71d879c20ad9289d8b7228d8d1266ca56063bc4807988c9d789ec38704f7f8d20154f92c500fe2ae268b59a
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1ECE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecwuomhez.sys

Path C:\Temp\hecwuomhez.sys
Size 141KB
SHA256 be0f190d89028b13edcb53ff85268abd0e21427553a99b64f68879ff9734fe74
MD5 7e3eacd05228d14315bc1c4619859f95
SHA1 917d639ea9ccc0638531379ff81d2d0099ea3703
SHA512 e05cd21cf66b8851fefab95463b55e279d1c42ad361e5680f0018b86cffc1a9c90af2227e6f7938283b2cd3abe64b9a5a71b6a96ae615176a8ee51593ec665ea
SSDEEP 3072:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkbr:Ra3lLNngoqRt
TLSH
T14DE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxspkicx.exe

Path C:\Temp\hfzxspkicx.exe
Size 226KB
SHA256 0aad565409846f1fcf18941105a7e15ad7132f153e993ab91d66963a732ae961
MD5 235694ef0d0ba94f0ed4895b334beac1
SHA1 d9959bc492706fed0521ffed73a4c98c27ddc509
SHA512 2a0e6adc8f9abab1deddb1551ac591dc75776ef41b6105775dab9c9fc687e23950aead94076eff2b6179f259d85e4130ff4e9d978d89b18237e9129edbc6eaef
SSDEEP 3072:HGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:mXY4LK+a3lLNngoqRttA7
TLSH
T12E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cwuomhezwr.exe

Path C:\Temp\i_cwuomhezwr.exe
Size 226KB
SHA256 87fc8bc0718e00ecb6cedbc97b0e8970664c7439281a92ba1deeb14bf956f930
MD5 a5257e22e07024880a5680a2ec950bea
SHA1 d9dd258e5efe2ce34dd6fcf6c4ee38abc4606dee
SHA512 f41d73f93054085ec749e9d34174910fa208eeeb780195ebb0cb7bd5443c3fbbeb4bd9efda5baac61dd6fa04b1a2b2db054d6b69c36c268f3f7e861accc55e0d
SSDEEP 3072:JGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:4XY4LK+a3lLNngoqRttA7
TLSH
T12234490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxspkicx.exe

Path C:\Temp\i_hfzxspkicx.exe
Size 226KB
SHA256 da6814f0b57fc0e64c5cab0d56af8e8dde5bc9a8c339313fc55bc6bb66d7f8d7
MD5 48358eb966426bdbf79e2e083658788a
SHA1 179347b625cc06e7e9e1d462d36d629db575d6c6
SHA512 dec4835ccafbc6592c88ee41edd630018cf3b9a9dcdeea3c52ed6f1e10461530a35572ef6a3b4e7887891bef85185a0897d14ce15e265a0dcdbeb359e13be5c5
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T1D934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgdywtoljg.exe

Path C:\Temp\i_mgdywtoljg.exe
Size 226KB
SHA256 d67afda27ba4cef6b59a0d4bee93df30b39691ddfd780fe7824f09ef106ce22d
MD5 7b2d33d5ff8863fd814c0078a49d1aa3
SHA1 7b63ea36698262df15b3b3dfb66b60628aa5d4a6
SHA512 51da855bbe94c69d316598cf7bd2158239cd6c2a7ccd4d94a0d3c0421cc5c69f0dbb17684972e32c4ebde6d92c8695a4aeffe8256c4e685eb468e10bcc932843
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T12734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgdbwtrlj.exe

Path C:\Temp\i_olgdbwtrlj.exe
Size 226KB
SHA256 2468b5dfcc98882073ae9a25f7280c401bf151fbaef93644c409a4b480e54bc8
MD5 de2da3fc8f1ff0ad0f0846da56c0696f
SHA1 c4230a8253f4718f3677e65d9961dbbd21ee8750
SHA512 d801cb2f9b8374018914ff6f40bdbfaaa2a9c1fef4f9a7364232ff21b4798a1bf504207687f19d05b20550345a75886c7d2dfa408f6d6e5cca94399cf632d936
SSDEEP 3072:IGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:PXY4LK+a3lLNngoqRttA7
TLSH
T1D934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmkeczurpk.exe

Path C:\Temp\i_pmkeczurpk.exe
Size 226KB
SHA256 1ea677253b4f01c0ae647cc32585fcc73769790771df565fae799dee26e5ab70
MD5 badf5094b59750ca90c08507f58e3997
SHA1 02f6733bba946b3fcb1292bc8f0ca7df543d9bb3
SHA512 8dc204101c37f55edddac1d91d357d28a9a6034c2ccfe34bac5944659432724ecdf13bbc2ca818ada461f6e89a11e928b8abaddd6c48626837a90d54b847b1c4
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T18F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgdywtoljg.exe

Path C:\Temp\mgdywtoljg.exe
Size 226KB
SHA256 715f31a124a240400bf94dfc7115ba1f2144c5b5acfe227f99a3e8a362d9cb88
MD5 4e636812763667904fea9ee4cadd2d82
SHA1 9e2380608bf5750bea91c30ec0045d38d90eff12
SHA512 ddba07c99abc98222ec35076374fbbc7ac8c14a59ab480bdcaba2e2c74798a624d3a292545eb23e586e147cdce6a1f912fe7506763dd5b074e8fe74ddfa2f36c
SSDEEP 3072:XGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:2XY4LK+a3lLNngoqRttA7
TLSH
T14D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgdbwtrlj.exe

Path C:\Temp\olgdbwtrlj.exe
Size 226KB
SHA256 3c195bbe141e551d11960848134db313cf56d8fe63461c458d71501331844a4e
MD5 54915d81f28a47e2eea9460f7c57f71a
SHA1 ff21caf3ae937951af36809034f8943a89f2e292
SHA512 a820802a0d12ebaeab77ea90d4094f55d01606ce7e89775a33027412b7e3f9fd8d6bf5f133c27008c8422b161684771dd75a8a9710ebc8bbfe760ba18bbf210a
SSDEEP 3072:vGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:OXY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmkeczurpk.exe

Path C:\Temp\pmkeczurpk.exe
Size 226KB
SHA256 6f7ad8c2247e7495de3fb00275a8546294749b6c77fc6015a0139b953fc9fe26
MD5 203bf173f706d64e3746a389384cf594
SHA1 0916bc1db1c74e7e234adb9cf4ae5afc1dd3f23a
SHA512 4e3f337912b210302868bd781905667b7e6f51f9904963014c417e08479873474652c436c95f71c87c1dc551334f49efa95d798c589f91285aba9582d0b2b923
SSDEEP 3072:fGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:+XY4LK+a3lLNngoqRttA7
TLSH
T18134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljgbztqoi.sys

Path C:\Temp\rljgbztqoi.sys
Size 141KB
SHA256 f75726b92c58f339a7fb7e5eae9eef52a0217419c1df19392403ff4841fa0c73
MD5 fbc8017db1b2f4c3bd9988fecfc26a4c
SHA1 58c449cec660a7ba485f5c5e71521eafa4f7d197
SHA512 353e618ab3efdad5dae3f52fff7f70c11ace7bf3eb828e1d252e2e3a903fa28f3651e55e9fbe263be84f104b5153c2526de3e0906c865fcedce7b9a775e4a6ed
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T11DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomgebzwr.sys

Path C:\Temp\wuomgebzwr.sys
Size 141KB
SHA256 d135d3d5315af30020de27ec3a944357e5d37ba1a6a225693bd0c2b77bd563f5
MD5 f8261e223756fa353c7d5711b4dfe959
SHA1 732eef949abc1482fc9f1c4fc6ce4c4f6f543162
SHA512 d565ccc85cc6abd02dffeaa102054f71d573c38ebec29f0f5f1741bbc694844372c9b8e9298fbc6d8362032033140b310f7357331cc0f0d2ca163ffa2ceffd0a
SSDEEP 1536:7a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:7a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T10EE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpjhfzxu.sys

Path C:\Temp\zxrpjhfzxu.sys
Size 141KB
SHA256 854b763ce8f029193983584fb1a072288eed9aae2edb4f6ab4fda6463dd1fae2
MD5 5323ea75a7f02741f098e9b5d1cf7cc1
SHA1 b447825098862f629ee25173e6ca4277f9c1d5e3
SHA512 d48314a0e79147ef881dfc145a7a1cac5e0bd27f4a2226b4e12191c221e4e51df12e05ca33ebcf300419f5112cad82eea2494427bf1d1f23b1e8852e6f62d6b7
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXlty:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37D12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b28890deba12e067fc4d2feb5580d3c41c440f03564bf57389061fc95e34ffb4
MD5 f56c99096ebca93d541e848019c50ce7
SHA1 f05cdd26283c3ad72be6c76d2723c8b2921e76a5
SHA512 5f6ed4ff674ddb4d1011c58252766c4de17dfb0ffe6567503e473bba4084104b233e51b1258ea50f5fe88fab251a8396460e5f289a7770b4a20b08cef23589a2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7t:fwUQC5VwBIiElEd2K57P7t
TLSH
T186B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c9c1b57b84eda29a8f96c1242efabcd27ea73b4ae2a32254cdc4de361e7f050b
MD5 368c4434c91c4e045e02be37c990f90d
SHA1 ad06c44c7e811d7fcdd8073f00aa57579edce82f
SHA512 bd6b47b984b969fe210f7d4d10a3a8123c80e33d62774081ae24f87014f4edf3a69af13d2dae8a80780ad78ad45e3556145679f51f08a9c949601323b23d2dd1
TLSH
T1F141A96F036769C7CF795DB580D294897F3CC4A941CB6E2D464020B98F8B3D89234B30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594b67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594b67.TMP
Size 1KB
SHA256 0b071125143f33cdcd7b27bd7cb4e7c83d711a0b4d1bc664caede300851b2727
MD5 bf0d3ff2d4cb6e7437e5b54b4bd2f77e
SHA1 23afc917ad28c964ed0f56063932105fb52e9ea3
SHA512 a38c36fe976c31953dfba78c990fc07f78d165b44b6541e52bbcda764be05523695890c4d991c4b50c682ca8c96060e662d36571fcd2aeea306ae33feead1787
TLSH
T18A41A96F036799C7CB795CB180D294897F3CC4A945CB6E2E464021B98F8B3D89234B30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 523a9456d7c89112b170ea6019d38d50cd81048c6c4c3c76c33e06d5dc72aa62
MD5 71fa1aa26255942c4ed47f8de14e6372
SHA1 b761215d043da0e9fa882b7964f24d84f8a3ef03
SHA512 055a2532bde70b7872a5c41feb751b4cb3e93d17420aacf011981b84d893b12ccbd5373a2c6064be397da4aa77d0fcaaa97de1d63c4adcaa308184451ff18a73
TLSH
T1BF51BCF3C2E8862D891156F0AB147E2BCE2D0954432C7D5AC9E4AF2B97E2471D18195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1a9519a9e8bae5038c541466df4cd18175ff4f497deb8c187e7bd3ecaf856d6
MD5 33aaaad0b55057d3a1ef10ee8932a204
SHA1 e0e237f6527c2c62e1f522b99a4af0d68eaa69a0
SHA512 520ebdc5342c2c23cf7cc77324fa0b1a0ca5ae365144c31446a1e06573a8b96655027e6ecfe9a29137d82ec2d15b1f79a4ada1312559e1325cfd13a19105203a
SSDEEP 192:sxR3RvyM/jK1Ml8wCF/f+swWIZDqyMzoD8p9Ey/g6+WNC5I2/YCYDOqGW5IgVlVd:sxR3l8F/f+swW2DqRWy/5Ol/ngv
TLSH
T12262F815AA345D7BCCDBD208FA55BF93D6F81533A1901E44AAFC9A1C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d354819cecc48ab7431256122d99d6b6e228d86de840b9bfebf4c89be3fcdbde
MD5 bc39677232e42ff7e0ddcf86ca2f698f
SHA1 50402b2fb5ad6133dac2d60b8fcbee94af43a4de
SHA512 a7ca22c6d78cfc9dba10dec8dd0c1d8b95828bbe3219f89b268a87938234e53a1ce3e83217b68347755ff8ee5b3bf21497ba5e9c3699ea791b39c4c3ffb2bf13
SSDEEP 192:sxRIRvyM/jK1Ml8UQICF/f+sFBIZDqyMzoD8prEy/g6+WNC5I2/YCqAOqGW5IgDE:sxRIlqvF/f+sFB2DqRoy/5Ol/wg4
TLSH
T11662E715AA345D77CCDBD209FA41BF93D6F85173A1901E44AAFC9E1C00E6BED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 03e10eedb08bd1f3dc511f2777f2ec51ead7241d33e2f89ec49248c2f4c16b7b
MD5 c000e127440abdfa49efba4052063462
SHA1 9dbf75b7b5304b36da96146c18a4334b832200c8
SHA512 55d71e6a1be684ec018ab1afb8738029284ef1e532b88a7211025c0e46db1335417578213891b5d85b5a5bc693a4aceae43fbf6a987af18b7372f994fa56c891
SSDEEP 192:sxRIRvyM/jK1Ml8wCF/f+sFWIZDqyMzoD8p9Ey/g6+WNC5I2/YCYDOqGW5IgDsl3:sxRIl8F/f+sFW2DqRWy/5Ol/ng2
TLSH
T18D62F815AA345D7BCCDBD208FA41BF93D6F81133A1901E44AAFC9A1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 c3e6153cb98910648f28418aeb266dc1aba7f4abaa8db60a426da6fc677726c8
MD5 89e366c70062a1b379001c72398ce85c
SHA1 4d7f1965572d21cbb526fdbad5373788c71c7f81
SHA512 6afed4b054891a8a5782148d91757c5cd582e1d6d139b9463a55a20cff8c73d6807e6a4097489dafe40da26fa6506b6921e7d45b8e22c77abfe45b8f650f7ae7
SSDEEP 768:j/8vl57pLuLffQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+KTQqq8rovl:j/8vlPEffQWgQ+fB+u1jaFKTVqnd
TLSH
T1DCE2EC7B680CCB7F4F804E9DEC29BD9AADE801CF5698895447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4567a39a3eb54e6f45ae3b8023417cab5d9360f5bd7028d9a3ac4f9deef2e9b3
MD5 7461aef0a7f4193b4945d5377fa6dace
SHA1 32fa22ab3e9ab8aa23ef676761265ffeb8429a86
SHA512 10ccef0d66f776bf0126336dcbd480e2f9b4d19e5fa5fb941cd72cce7924754cd90e222203ad47e10d1463c10b120103096debc6620dc32aad38327d5d05b728
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOH0VAE+imkWivPgMkK4BgGkckEP+k5HxOfJ:CbEBVj5JAdSp9/EgTK7j6dJOH0VAE+i/
TLSH
T18E91D010323F06C4793DA54C80788D6FC6C1B1673415E62B7BA846664B67E47ADFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6edd702-8e15-4263-85ec-044599f64650.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c6edd702-8e15-4263-85ec-044599f64650.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e65f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e65f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bd44baafd6b67643f1e094747f63a9cf85e06b4705a9cb721b9fb9d38affe279
MD5 35136ed60df027ff33e77da75cf598de
SHA1 ccd8d3a2befd954653d5702d91fa88651cc86008
SHA512 c4faadb3e9c47ea6d9e029fca4032e807133bae053e02b5daa3f2be3b331c6b51d4e29d878e535a733b61cfa4ace6e0c7c481371aa3c10021b05ba6838a23759
SSDEEP 768:XX3nab08NCxp8+p3bd66j+4BRv86aLIWar2ewBKZOZ30s:XX3nUCv8+p3Z6n4yu2evZuX
TLSH
T16AF2AFB1EC689D738CE5D644B28637839FF452B3A5C01EA8D9DDAB1D148225D270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 43311467079948b0679ab16520de2733a9f40c28c10158c8ce27088ea7752ca9
MD5 9d7d1fac1869a64d5a8e442ecd82cc99
SHA1 e1663b535df1e298e80c2b068207f62b18b85742
SHA512 b332c665499c1ab877d76a26ad619d1c5f100cf5b3cbe74861423751143f97b1e56c460cfa7c6031b501c29c59651a7e04ef589ab7b622114fac2643aee99dee
SSDEEP 768:NFQb3Ywgq+brtNLp8+p3bd66j+4BRv86aLIWar2ewBKZOZ30s:cb3xut8+p3Z6n4yu2evZuX
TLSH
T1721339F198D78937D8AE8747A37D2E429EBCC163B4845994B7C86E0CCC821BFD70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 d8bd16498b9019b48bcb0ccdb6a27ca26a5782f7fe028dbcbc7b02c3e7949fbe
MD5 a50fa53a7d913e2d07d1b844992ebf20
SHA1 66101958c35e121ae31a38b62b66e7b705a8d4aa
SHA512 fc1b53ae70e75720ff29b81c76a815a6b4aa82fd83c68da92d376fd4d2c8420dab64330148d811531ac70fa83e766ff5b62d206100c4f73ecd40b0ffa5539788
SSDEEP 768:4rv+4UNbdM34yb08NCNp8+p3bd66j+4BRv86aLIWar2ewBKZOZ30B:4bsb+34cCL8+p3Z6n4yu2evZui
TLSH
T16A13BF72E86CDD738DF2C244B18776836FB811A3A4C01EA8E9D96B5D448619D270FC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 89d6ffbddd980a0fc428b3a1a1ea4b8b19e65c47150f7c21c058e427a35b096b
MD5 87ce8c376f023d02d0f02a14f9b39a57
SHA1 666a099cbaa7da9974ac0c4bb88c7d096a894036
SHA512 bdbbadf0c90eea5624515460f33a79de44c4dbc1bc94ac9f86a3e8552b4ee85716a4566185afad059908d7ff4199bd78b8aad2d4cde219ff26ad5bff60684985
SSDEEP 768:Irv+4UNbdD3kc8LNp8+p3bd66j+4BRv86aLIia+2bwCl1:Ibsbp3AL8+p3Z6n4yL0ww
TLSH
T17203BE72E9A899339CF6C644B24677433FF851A396C10AD0D4DD3B4E419A19E230BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a394d0925937c31bcb2cc402542a900ee3445687910af9718de23606cae973c6
MD5 7796fc96efd5e5dd26be88b762a3d938
SHA1 9cba3808ee46ebbaca22aa835a423c8ccceca242
SHA512 975273e30943a7140847c07be30869263ef77d9fbdc11914121901833c2c3e267bc5d56c62780f7982d99b0c4a5f206b2d2c82be4fcddedbd07eed4a4ea14edb
SSDEEP 768:UX34ab08NCxp8+p3bd66j+4BRv86aLIWar2ewBKZOZ30s:UX34UCv8+p3Z6n4yu2evZuX
TLSH
T159F2AFB1EC689D738CE5D644B28637839FF452B3A5C01EA8E9DDAB1D148225D270BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3b7e71f-c5bd-407b-a94a-33aadee6e014.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3b7e71f-c5bd-407b-a94a-33aadee6e014.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5922a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5922a1.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

97023f56-4bd3-49f4-bd79-e642b6964c2a.tmp

Path C:\Users\Admin\AppData\Local\Temp\97023f56-4bd3-49f4-bd79-e642b6964c2a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5960_1923752442\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5960_692224203\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/820-789-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1280-845-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1288-769-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1288-791-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1396-691-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1584-883-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1584-902-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1688-900-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1736-638-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2040-810-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2880-850-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-834-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3164-717-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-814-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3572-871-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4080-721-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4368-666-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4412-740-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4592-736-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4776-713-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4776-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6088-591-0x0000000000010000-0x0000000000083000-memory.dmp

Download