e0707b3ac8b5785040f19ccfb65301d4ee91b1b42167b995686db5c1df8721a5

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe
Size 243KB
Sample260809-lzpl2shh65
SHA256 e0707b3ac8b5785040f19ccfb65301d4ee91b1b42167b995686db5c1df8721a5
MD5 99d9350510d4762be3af52c87ecbb1f2
SHA1 02eaff7aa00acc9c6a95f5d026e41cfd2b1d5d9a
SHA512 b54a13f02c1bac8dc5cc80d932b762ce32215d1c71b660da62e8661f98d0fb0caba69184ac4bae7eeb1fa5b0562e094654129348793b69bfcad067bdabf06258
SSDEEP 3072:QkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7e:NruiLSWa3lLNngoqRttA7e
TLSH
T184345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3236	CP.exe
1888	usmkfcxvpn.exe
2208	CP.exe
3716	CP.exe
3216	i_usmkfcxvpn.exe
1260	pjhbzwusmh.sys
4820	CP.exe
1692	jhbzurmkec.exe
3760	CP.exe
2592	CP.exe
5696	i_jhbzurmkec.exe
2684	cwuomkecwu.sys
1492	CP.exe
5400	urljgecwtr.exe
5372	CP.exe
5408	CP.exe
1216	i_urljgecwtr.exe
6040	bztromjebz.sys
2304	CP.exe
5904	tqomgebwto.exe
2392	CP.exe
908	CP.exe
4276	i_tqomgebwto.exe
1640	bztrojgeyt.sys
4608	CP.exe
1344	wtolgeywto.exe
4368	CP.exe
1064	CP.exe
3700	i_wtolgeywto.exe
3184	qoigdbvtql.sys
1268	CP.exe
5392	qnljdaytql.exe
3356	CP.exe
1216	CP.exe
2120	i_qnljdaytql.exe
3040	igaysqkida.sys
1464	CP.exe
2384	davtnlfdyv.exe
5824	CP.exe
2796	CP.exe
1336	i_davtnlfdyv.exe
4456	icavsqnlfd.sys
3960	CP.exe
1296	xvsnkfcaxs.exe
4460	CP.exe
4808	CP.exe
3016	i_xvsnkfcaxs.exe
1768	nhfcausmkf.sys
4468	CP.exe
624	icausmkfca.exe
5416	CP.exe
1712	CP.exe
1232	i_icausmkfca.exe
2252	causmkecwu.sys
4920	CP.exe
3860	zxupmkeczx.exe
1348	CP.exe
4884	CP.exe
4420	i_zxupmkeczx.exe
3936	zurmjhbzur.sys
4160	CP.exe
2284	trpmhezxrp.exe
4680	CP.exe
2144	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5368_1083683344\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_334377599\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_334377599\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1164562214\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1224710974\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1224710974\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_334377599\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_334377599\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5368_1449820085\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtolgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqdavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurpjhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnljdaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trpmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqdavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urljgecwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtolgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausmkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqlfdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnljdaytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztqojgeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqlfdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicausnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqomgebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkfcaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausmkfca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmkeczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrmjebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczxupmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urljgecwtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trpmhezxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3364	ipconfig.exe
3512	ipconfig.exe
2616	ipconfig.exe
4476	ipconfig.exe
1016	ipconfig.exe
3972	ipconfig.exe
3808	ipconfig.exe
4740	ipconfig.exe
1640	ipconfig.exe
4540	ipconfig.exe
2880	ipconfig.exe
3080	ipconfig.exe
4324	ipconfig.exe
2788	ipconfig.exe
5592	ipconfig.exe
2800	ipconfig.exe
5884	ipconfig.exe
5928	ipconfig.exe
5644	ipconfig.exe
2828	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307431143730846"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{AF53B0E4-762E-42AF-A309-1C517B297459}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	3216	i_usmkfcxvpn.exe
Token: SeDebugPrivilege	5696	i_jhbzurmkec.exe
Token: SeDebugPrivilege	1216	i_urljgecwtr.exe
Token: SeDebugPrivilege	4276	i_tqomgebwto.exe
Token: SeDebugPrivilege	3700	i_wtolgeywto.exe
Token: SeDebugPrivilege	2120	i_qnljdaytql.exe
Token: SeDebugPrivilege	1336	i_davtnlfdyv.exe
Token: SeDebugPrivilege	3016	i_xvsnkfcaxs.exe
Token: SeDebugPrivilege	1232	i_icausmkfca.exe
Token: SeDebugPrivilege	4420	i_zxupmkeczx.exe
Token: SeDebugPrivilege	4476	i_trpmhezxrp.exe
Token: SeDebugPrivilege	5008	i_bztrmjebwu.exe
Token: SeDebugPrivilege	2936	i_hbztqojgeb.exe
Token: SeDebugPrivilege	3484	i_gaytqljdbv.exe
Token: SeDebugPrivilege	3364	i_sqlfdbvtnl.exe
Token: SeDebugPrivilege	3376	i_tqdavsnlfd.exe
Token: SeDebugPrivilege	4372	i_qkicausnkf.exe
Token: SeDebugPrivilege	976	i_smkfcxupnh.exe
Token: SeDebugPrivilege	3012	i_pjhczxupmk.exe
Token: SeDebugPrivilege	3412	i_ezwurpjhcz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 4544	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	89
PID 4544 wrote to memory of 5368	4544	iexplore.exe	90
PID 5368 wrote to memory of 4156	5368	msedge.exe	91
PID 5368 wrote to memory of 3456	5368	msedge.exe	92
PID 5368 wrote to memory of 4768	5368	msedge.exe	93
PID 5368 wrote to memory of 4768	5368	msedge.exe	93
PID 5368 wrote to memory of 4768	5368	msedge.exe	93
PID 5368 wrote to memory of 5024	5368	msedge.exe	94
PID 5368 wrote to memory of 5024	5368	msedge.exe	94
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 5144	5368	msedge.exe	96
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 4616	5368	msedge.exe	97
PID 5368 wrote to memory of 3876	5368	msedge.exe	98
PID 5368 wrote to memory of 3876	5368	msedge.exe	98
PID 5368 wrote to memory of 3876	5368	msedge.exe	98
PID 5368 wrote to memory of 3020	5368	msedge.exe	99
PID 5368 wrote to memory of 3020	5368	msedge.exe	99
PID 5368 wrote to memory of 3020	5368	msedge.exe	99
PID 5368 wrote to memory of 5752	5368	msedge.exe	100
PID 5368 wrote to memory of 5752	5368	msedge.exe	100
PID 5368 wrote to memory of 3972	5368	msedge.exe	101
PID 5368 wrote to memory of 3972	5368	msedge.exe	101
PID 5368 wrote to memory of 3972	5368	msedge.exe	101
PID 5368 wrote to memory of 2516	5368	msedge.exe	103
PID 5368 wrote to memory of 2516	5368	msedge.exe	103
PID 5368 wrote to memory of 2516	5368	msedge.exe	103
PID 2768 wrote to memory of 3236	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	104
PID 5368 wrote to memory of 1976	5368	msedge.exe	107
PID 1888 wrote to memory of 2208	1888	usmkfcxvpn.exe	109
PID 5368 wrote to memory of 2428	5368	msedge.exe	112
PID 5368 wrote to memory of 2428	5368	msedge.exe	112
PID 5368 wrote to memory of 4660	5368	msedge.exe	113
PID 5368 wrote to memory of 5696	5368	msedge.exe	114
PID 5368 wrote to memory of 4660	5368	msedge.exe	113
PID 5368 wrote to memory of 3384	5368	msedge.exe	115
PID 5368 wrote to memory of 5696	5368	msedge.exe	114
PID 5368 wrote to memory of 3384	5368	msedge.exe	115
PID 5368 wrote to memory of 1652	5368	msedge.exe	118
PID 5368 wrote to memory of 1652	5368	msedge.exe	118
PID 5368 wrote to memory of 8	5368	msedge.exe	119
PID 5368 wrote to memory of 8	5368	msedge.exe	119
PID 2768 wrote to memory of 3716	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	120
PID 5368 wrote to memory of 4828	5368	msedge.exe	122
PID 5368 wrote to memory of 4828	5368	msedge.exe	122
PID 5368 wrote to memory of 4828	5368	msedge.exe	122
PID 2768 wrote to memory of 4820	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	125
PID 1692 wrote to memory of 3760	1692	jhbzurmkec.exe	127
PID 2768 wrote to memory of 2592	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	130
PID 2768 wrote to memory of 1492	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	134
PID 5400 wrote to memory of 5372	5400	urljgecwtr.exe	136
PID 2768 wrote to memory of 5408	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	139
PID 2768 wrote to memory of 2304	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	143
PID 5904 wrote to memory of 2392	5904	tqomgebwto.exe	145
PID 2768 wrote to memory of 908	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	148
PID 5368 wrote to memory of 5912	5368	msedge.exe	151
PID 5368 wrote to memory of 1296	5368	msedge.exe	152
PID 5368 wrote to memory of 4460	5368	msedge.exe	153
PID 2768 wrote to memory of 4608	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	156
PID 1344 wrote to memory of 4368	1344	wtolgeywto.exe	158
PID 2768 wrote to memory of 1064	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	161
PID 2768 wrote to memory of 1268	2768	2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_99d9350510d4762be3af52c87ecbb1f2_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffac4f0c188,0x7ffac4f0c194,0x7ffac4f0c1a0
      4⤵
      PID:4156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,11059395501104265228,16358944268360436644,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
      4⤵
      System Time Discovery
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,4069940561479967062,14099661898791774051,262144 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:4768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,3767133657391528460,12856993852097261219,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:13
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,14784214849656184756,17183632707464034334,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,15617793466067290889,7087167323106115266,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,6261858244437810880,15468184898840707088,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
      4⤵
      PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4376,i,6268542133994542706,8826286418710724179,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:9
      4⤵
      PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17405441695311109245,1349565166337740479,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5400,i,5057405136678822788,5518714216363294630,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5224,i,15901435907560083174,12024981547706119518,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10159617202547562483,10237571531189781677,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10159617202547562483,10237571531189781677,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,5310387494992505915,1924195174822603170,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,11333981472829779105,10915300255217567553,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
      4⤵
      PID:4660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8409416097795161442,9984209339115834867,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,11439573452213905541,3244312039205816295,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8627164795880343098,5272919569845127298,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:1652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,17188299677307016558,13863452309459848034,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:14
      4⤵
      PID:8
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6932,i,3598528596069294086,1366505936920597854,2097152 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,5764253873066871626,15338801926706805771,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,9830436688594557214,8481032583547819959,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
      4⤵
      PID:1296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,2724982691554129410,17738225388360194097,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:14
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,2749888643847597849,13557831529167514308,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:5516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,2704557105803260495,15847679552716796417,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7862592475107281804,7780666400582324683,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
      4⤵
      PID:5276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3432,i,7983523584511606925,4302474101939568513,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=928,i,16469809036418956904,2192538814067228964,262144 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,6230556023054074168,17410472610163560237,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,14990161039104701485,6616506068025107483,524288 --field-trial-handle=2144,i,12826017734539905489,1182355053277522694,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
      4⤵
      PID:1200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmkfcxvpn.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3236
- - C:\Temp\usmkfcxvpn.exe
    C:\Temp\usmkfcxvpn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2208
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmkfcxvpn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Temp\i_usmkfcxvpn.exe
    C:\Temp\i_usmkfcxvpn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbzurmkec.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4820
- - C:\Temp\jhbzurmkec.exe
    C:\Temp\jhbzurmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3760
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbzurmkec.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\i_jhbzurmkec.exe
    C:\Temp\i_jhbzurmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5696
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urljgecwtr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1492
- - C:\Temp\urljgecwtr.exe
    C:\Temp\urljgecwtr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5372
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3972
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urljgecwtr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5408
- - C:\Temp\i_urljgecwtr.exe
    C:\Temp\i_urljgecwtr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqomgebwto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2304
- - C:\Temp\tqomgebwto.exe
    C:\Temp\tqomgebwto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqomgebwto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:908
- - C:\Temp\i_tqomgebwto.exe
    C:\Temp\i_tqomgebwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4276
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtolgeywto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4608
- - C:\Temp\wtolgeywto.exe
    C:\Temp\wtolgeywto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4368
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtolgeywto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1064
- - C:\Temp\i_wtolgeywto.exe
    C:\Temp\i_wtolgeywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnljdaytql.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1268
- - C:\Temp\qnljdaytql.exe
    C:\Temp\qnljdaytql.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnljdaytql.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1216
- - C:\Temp\i_qnljdaytql.exe
    C:\Temp\i_qnljdaytql.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdyv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1464
- - C:\Temp\davtnlfdyv.exe
    C:\Temp\davtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5824
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdyv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2796
- - C:\Temp\i_davtnlfdyv.exe
    C:\Temp\i_davtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xvsnkfcaxs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3960
- - C:\Temp\xvsnkfcaxs.exe
    C:\Temp\xvsnkfcaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xvsnkfcaxs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4808
- - C:\Temp\i_xvsnkfcaxs.exe
    C:\Temp\i_xvsnkfcaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausmkfca.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4468
- - C:\Temp\icausmkfca.exe
    C:\Temp\icausmkfca.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausmkfca.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1712
- - C:\Temp\i_icausmkfca.exe
    C:\Temp\i_icausmkfca.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupmkeczx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4920
- - C:\Temp\zxupmkeczx.exe
    C:\Temp\zxupmkeczx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1348
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3080
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupmkeczx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4884
- - C:\Temp\i_zxupmkeczx.exe
    C:\Temp\i_zxupmkeczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trpmhezxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4160
- - C:\Temp\trpmhezxrp.exe
    C:\Temp\trpmhezxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trpmhezxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2144
- - C:\Temp\i_trpmhezxrp.exe
    C:\Temp\i_trpmhezxrp.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrmjebwu.exe ups_run
  2⤵
  PID:1260
- - C:\Temp\bztrmjebwu.exe
    C:\Temp\bztrmjebwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1620
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrmjebwu.exe ups_ins
  2⤵
  PID:2004
- - C:\Temp\i_bztrmjebwu.exe
    C:\Temp\i_bztrmjebwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztqojgeb.exe ups_run
  2⤵
  PID:4420
- - C:\Temp\hbztqojgeb.exe
    C:\Temp\hbztqojgeb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztqojgeb.exe ups_ins
  2⤵
  PID:6000
- - C:\Temp\i_hbztqojgeb.exe
    C:\Temp\i_hbztqojgeb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  PID:2840
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  PID:4776
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqlfdbvtnl.exe ups_run
  2⤵
  PID:5468
- - C:\Temp\sqlfdbvtnl.exe
    C:\Temp\sqlfdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5648
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqlfdbvtnl.exe ups_ins
  2⤵
  PID:200
- - C:\Temp\i_sqlfdbvtnl.exe
    C:\Temp\i_sqlfdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqdavsnlfd.exe ups_run
  2⤵
  PID:3292
- - C:\Temp\tqdavsnlfd.exe
    C:\Temp\tqdavsnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2684
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1016
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqdavsnlfd.exe ups_ins
  2⤵
  PID:860
- - C:\Temp\i_tqdavsnlfd.exe
    C:\Temp\i_tqdavsnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkicausnkf.exe ups_run
  2⤵
  PID:1148
- - C:\Temp\qkicausnkf.exe
    C:\Temp\qkicausnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkicausnkf.exe ups_ins
  2⤵
  PID:5240
- - C:\Temp\i_qkicausnkf.exe
    C:\Temp\i_qkicausnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxupnh.exe ups_run
  2⤵
  PID:2348
- - C:\Temp\smkfcxupnh.exe
    C:\Temp\smkfcxupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5592
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxupnh.exe ups_ins
  2⤵
  PID:5800
- - C:\Temp\i_smkfcxupnh.exe
    C:\Temp\i_smkfcxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczxupmk.exe ups_run
  2⤵
  PID:944
- - C:\Temp\pjhczxupmk.exe
    C:\Temp\pjhczxupmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczxupmk.exe ups_ins
  2⤵
  PID:2380
- - C:\Temp\i_pjhczxupmk.exe
    C:\Temp\i_pjhczxupmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwurpjhcz.exe ups_run
  2⤵
  PID:1080
- - C:\Temp\ezwurpjhcz.exe
    C:\Temp\ezwurpjhcz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5420
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezwurpjhcz.exe ups_ins
  2⤵
  PID:1664
- - C:\Temp\i_ezwurpjhcz.exe
    C:\Temp\i_ezwurpjhcz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:724

C:\Temp\pjhbzwusmh.sys
C:\Temp\pjhbzwusmh.sys
1⤵
- Executes dropped EXE
PID:1260

C:\Temp\cwuomkecwu.sys
C:\Temp\cwuomkecwu.sys
1⤵
- Executes dropped EXE
PID:2684

C:\Temp\bztromjebz.sys
C:\Temp\bztromjebz.sys
1⤵
- Executes dropped EXE
PID:6040

C:\Temp\bztrojgeyt.sys
C:\Temp\bztrojgeyt.sys
1⤵
- Executes dropped EXE
PID:1640

C:\Temp\qoigdbvtql.sys
C:\Temp\qoigdbvtql.sys
1⤵
- Executes dropped EXE
PID:3184

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
- Executes dropped EXE
PID:3040

C:\Temp\icavsqnlfd.sys
C:\Temp\icavsqnlfd.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\nhfcausmkf.sys
C:\Temp\nhfcausmkf.sys
1⤵
- Executes dropped EXE
PID:1768

C:\Temp\causmkecwu.sys
C:\Temp\causmkecwu.sys
1⤵
- Executes dropped EXE
PID:2252

C:\Temp\zurmjhbzur.sys
C:\Temp\zurmjhbzur.sys
1⤵
- Executes dropped EXE
PID:3936

C:\Temp\hbztrpmhez.sys
C:\Temp\hbztrpmhez.sys
1⤵
PID:2420

C:\Temp\bywtrljgeb.sys
C:\Temp\bywtrljgeb.sys
1⤵
PID:3672

C:\Temp\dywqoljdbv.sys
C:\Temp\dywqoljdbv.sys
1⤵
PID:3240

C:\Temp\bqkigdyvqo.sys
C:\Temp\bqkigdyvqo.sys
1⤵
PID:4860

C:\Temp\vtnlidavsn.sys
C:\Temp\vtnlidavsn.sys
1⤵
PID:3868

C:\Temp\nkicaxspnl.sys
C:\Temp\nkicaxspnl.sys
1⤵
PID:5688

C:\Temp\pkhfcausmk.sys
C:\Temp\pkhfcausmk.sys
1⤵
PID:4196

C:\Temp\zxspkhcauk.sys
C:\Temp\zxspkhcauk.sys
1⤵
PID:2032

C:\Temp\ezwromkecz.sys
C:\Temp\ezwromkecz.sys
1⤵
PID:4448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrojgeyt.sys

Path C:\Temp\bztrojgeyt.sys
Size 141KB
SHA256 35c91dd9061007d2802d977822672ed42e431d18858fc070a20740c95419c00d
MD5 94b82688b4f52eaff70f4a190e6cea3f
SHA1 272d6451b83853ac2d721aaf10b3ddaa855c66b0
SHA512 6d33b21b4b23f597aadf6cc8975cd0a87daa6450342f45ba574708e15cec651630fc6b02b424c5e6f0ab7f04ce98382e4dab112b307c166de8a6aa52c35acf6b
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C2E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztromjebz.sys

Path C:\Temp\bztromjebz.sys
Size 141KB
SHA256 f5c291973351002a197d39574b7dd2f9ea06e0cc91350085ffd479176addb84b
MD5 9cffaaaa1f778ec7b878b5a998bd271e
SHA1 71aa00cbf4fbf441c68cc15b5d49fd75ac52e5a5
SHA512 929861551bc056b81d7c3c982f7bbc4e2671a79efc8d1131031a6adb311842e4a9582746df09e9315288aa345ceaa8e61c42604fa21031f8d730dcf0562d4f70
SSDEEP 1536:9a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:9a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C6E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomkecwu.sys

Path C:\Temp\cwuomkecwu.sys
Size 141KB
SHA256 4dc5012c740ce0f8fb224c30f9551dd47b449ce0078e601f100e1fd2a1c5a803
MD5 4c58ae64fb26a13059183d1cfecd2bdc
SHA1 2be54f43cb353e128da839c0703d581eded93eec
SHA512 d80ac84470f884e9c22fbafadc38ee9c0944b146c9f11396f4ebbb2abe8aaad09665806166a0a942853b6b44ee4c26940a7accac79cdf98c3050c6fe75a60786
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzurmkec.exe

Path C:\Temp\i_jhbzurmkec.exe
Size 243KB
SHA256 e02160c1f5de68fbe39e44e4c337456f7e68da5d12f7d9d291e3096e289d8c9f
MD5 845c262bcc45b03a03bac29cb6b18258
SHA1 4c830d8b528d911ad227705b76aee244812ce89d
SHA512 bf7856cfb9365f8dcba17879ae99a1edaeff7092a5ce6c210ab80a6f0b24592c073121de4e15d6d065861a0d64be61be76006a572360c74c7324535987cb87df
SSDEEP 3072:QtkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7yF:VruiLSWa3lLNngoqRttA7q
TLSH
T1E4345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqomgebwto.exe

Path C:\Temp\i_tqomgebwto.exe
Size 243KB
SHA256 6b68f5ca9be0a7d27ae807f03538a3ff01e51e19ba1b8418cbbb582e5adfc684
MD5 cfc20fd079764c12db0b505a30e2b4fc
SHA1 344b2c8bdeb341cda747384cbb71c64a8e64507f
SHA512 ecbc0e235393e22d98165ab569b28c04cb06bf1cd6c473befefb5418d9064eb2038642f01a54091efb9cd827b9c2ab9ac3d9cbc6cc3a3cb032a1abbaeda93e62
SSDEEP 3072:LkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:AruiLSWa3lLNngoqRttA7h
TLSH
T1EA345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urljgecwtr.exe

Path C:\Temp\i_urljgecwtr.exe
Size 243KB
SHA256 a3a243fa3fea0c427ec181bef95aa8b437cdaa1809b5d07fb0423d7f8e294a03
MD5 d022865fb9a4197d4516e91721626704
SHA1 bb42badf90fd44ad4057810cc2d469861d5ca523
SHA512 95f1ce3c3d803586d23942a0aa6a973fc64c019be98b9bf5c28b4d323eb7782ef5c21976b2914d2dd58f0cd8efb1174c1ac426786b7c89851b2463f42bad1d93
SSDEEP 3072:ykruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:DruiLSWa3lLNngoqRttA78
TLSH
T198345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usmkfcxvpn.exe

Path C:\Temp\i_usmkfcxvpn.exe
Size 243KB
SHA256 8a746b6b26b9efb8fb781cd572f5ddb070202fffd966add0b0f98290d44a3243
MD5 e6c4650aefe021e2e45a752180a0088f
SHA1 307871c6a654875b2b4179c7d17dd3b3791db243
SHA512 54c883c7a79db2272a4aa7a0ee17ad12f5bde5cced488c8b6096ae58f4a87303ed276da859f0be31f779a39c1a0182993813715b3bccb7d90df01e77c2a0e3b7
SSDEEP 3072:SkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:jruiLSWa3lLNngoqRttA7k
TLSH
T147345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtolgeywto.exe

Path C:\Temp\i_wtolgeywto.exe
Size 243KB
SHA256 df8d37a34fc235a681844f2b04ac53410024e2d03f54407e13049ded8fe543a5
MD5 cb659a3df601c171d7808d17b7b68340
SHA1 ae79d6b0319dd87359a73508197ec97ce5511759
SHA512 6546aa7f7a62d4589f133ad3f9172a47920166a7d6efd347e24760a5a50c665369a530938673d4fb95c2f5c124a195b14c14352e5eb399f9a2e22ce4bbd35434
SSDEEP 3072:KkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7c:LruiLSWa3lLNngoqRttA7c
TLSH
T1AE345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzurmkec.exe

Path C:\Temp\jhbzurmkec.exe
Size 243KB
SHA256 2057e27b0ece66762da5ffc627d5ce1af1b6c667318ba7584c094883294d74c6
MD5 a386a10cb5b7d49e1a4470e48af7b094
SHA1 b9838933355a381965bcddcebe2872dc80f283b7
SHA512 7cba13fc32c0a6166a51080aed0d7650030d763c7a5a66224aad5f7992ea8099ac9320e6fd07fff7b6c908985659afe7f3880eae8bd4fdc0941102ba643bf405
SSDEEP 3072:rkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:gruiLSWa3lLNngoqRttA7N
TLSH
T1B0345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzwusmh.sys

Path C:\Temp\pjhbzwusmh.sys
Size 141KB
SHA256 c4d0750a216e49dde7b19ab53a36d98e52a0db09c09e7710ad41f9e8801305a3
MD5 cc61a2981fbeb44431123fd4d239ca4c
SHA1 4ce58dd1cfd497e4ea39edaa2f35340a7a942a8c
SHA512 c81ce1523cc99babd0ef76d2853e39774a6213a6f9ff05eae381ca7141f461bcd0d9431b77fadc46593a9ed3654f22cd01c3276eddff6f5838cc0db090016dfb
SSDEEP 3072:/a3rV3dZPFvOAngoRUAFa1nxayHdXkby:/a3lLNngoqRt3
TLSH
T115E37C12B2D2D172E4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnljdaytql.exe

Path C:\Temp\qnljdaytql.exe
Size 243KB
SHA256 8b8c8a73b6c255e1b9dbf44c5c076c404e64e3a7a04c7c13960aee208dd4bee7
MD5 58d541684a89b608a0f6b44059bd299d
SHA1 bf798b148f1fd466532a0b0be72bdf358ba3667c
SHA512 ad450d734c5fa542501e292bfd41be666d9e862a34e0ac0597cc010b2c225efe40504c8f0371004b19260a78a37b450ae1eae20df2295f03585e9541f189b213
SSDEEP 3072:TkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:4ruiLSWa3lLNngoqRttA7p
TLSH
T130345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigdbvtql.sys

Path C:\Temp\qoigdbvtql.sys
Size 141KB
SHA256 ff5cdd042b80250abde9a5da4e731c17b5f64fd6ebe4c09f0a241070e85a80bc
MD5 bb3db1c95305c51d686cd7722409eb09
SHA1 1c1b6ae4509ac61b69a10b8938bcc001aee663f8
SHA512 d17ac29e553721b1153cb648a04f37798743be9e9252b1e3f5409bbb46d8a0dfb07ad21626d069513d6203e11009eef3f52593b7715f7d879ae72563ab2b37d2
SSDEEP 1536:8a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:8a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T12DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqomgebwto.exe

Path C:\Temp\tqomgebwto.exe
Size 243KB
SHA256 4a4658a7854c794b6f3e738f89b4f870eb81c155198548fd2c955f176e511f57
MD5 1bf8a2b8e2c7e67979ed2c718d6bd697
SHA1 bafd324a44730857885bd95acabec8f154d688d5
SHA512 677668d0e0d6abca901d76434a6bf1b9172f1bf1e1dcf7af98c4c55c6bbe1c8c0a9f918a87bab9c2aa3ee0632a7c16dce23583d96f3f9f474814cb2c723752ab
SSDEEP 3072:ykruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7k:DruiLSWa3lLNngoqRttA7k
TLSH
T171345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urljgecwtr.exe

Path C:\Temp\urljgecwtr.exe
Size 243KB
SHA256 99303a295fbdf6f950bf2d1650208b6eddfa582043897ac3963cddbc89ff0f06
MD5 81d2d483417a1aefdef62bf6e922eb14
SHA1 021df2c2c4ad3b8fd23898010123c254c23ce79f
SHA512 a6b1411ae2621670ec7207c7236402e46c99595317130d23083a6153f9ccd4feb7d6a607f607c93508f686760b70a4c3764a302b22bf90d252170f661d6d7d55
SSDEEP 3072:gkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:9ruiLSWa3lLNngoqRttA7G
TLSH
T193345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usmkfcxvpn.exe

Path C:\Temp\usmkfcxvpn.exe
Size 243KB
SHA256 dc750e256f7567042eecb0c599d8dbf4bad93a23b05ad529755aba04b5147e86
MD5 c15b864cc85c5e5f3a7c2e0a3227a9fa
SHA1 3d805a59dd151259b6c5b414aca7395d21c79271
SHA512 bd9abe6234b10df8e7447727337a0777db6e6ea6eaa1db10cbedddfc42be0551eeb48305eb03824ce64120fc0e95e44dee32d77ffb8c80ac4ce652ce57918125
SSDEEP 3072:mkruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:vruiLSWa3lLNngoqRttA70
TLSH
T15C345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtolgeywto.exe

Path C:\Temp\wtolgeywto.exe
Size 243KB
SHA256 0cd206856047f29a24029d889c83d2dd675f69716a66e63684807b872c55f274
MD5 60371c0e8d1cfd5531dd7ffc2cf862ca
SHA1 b80bbce55ab97b03ce1dfa885f0f2c0dd33c9b71
SHA512 8248b5a73d98d8533d7e876e269c132eaa9cfb01c377e495566b7e8421e6e64125c9afb4336ca6471a5851fa47a2d19916b41db052e74423937a03ba60c0dd11
SSDEEP 3072:akruwzLLCJhj7yxa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7g:7ruiLSWa3lLNngoqRttA7g
TLSH
T122345A0172818072E71A0B78045AE7A1467E7C394BA5D5CFFB683F7A1A312D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ef07ce8a868cb30c7864f74acb9d9693930104d175396820d0abb93125985de5
MD5 2457e8997a7da158c64009074642ea43
SHA1 f6fc58f648d419622f5d9e66d568e94fdf07d7d8
SHA512 c684c097e06487721e845dddf51472e74f8eb4655063d82c92f2c3c8e757a42922a85c765f173085de3d15257e5720adc22dc762fcfe5209e9950727d3fcfd87
TLSH
T158512FF7E3EFCAD1CF5644BF60E2E5D43238895A47032AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594973.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594973.TMP
Size 2KB
SHA256 e0101aa906ae8a94d557e181112bf896a8779986f5d392a0789d13975347ce94
MD5 5e3200c16be35bae6c09f2a7e898e2be
SHA1 97922202ff5f3fb80d24164869a39356c899c647
SHA512 67f80f64c339fb55ba3d0a459abda2da2ce7f14f785caa27885f90eb068e7b9dea3a0491303d756d8a0ae962dc7c716ae1eda1aaefe3ac1c99b3eae1be0f1060
TLSH
T18B5121F7E3EFCAD1CF5544BF60E2E5D43238895A47036AB1827650B8697271CA0C92D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fe70cce8bfe1abcdd19e5cb9fb32fa56db71ade31f07da989aa2b0174c6527cf
MD5 d7c4e7be8ce570e4916f2d7b8d6caf0b
SHA1 21486ec18fe57229dd5abfbfdfa26a39f1303f5f
SHA512 9dee85c07282be0dc5023d4fd7347115f4915b8b11bafdcbdb4acd2015b02c50c17a6a759bf55600ea857552419f84e18be739dfcc40459626258f13506fb2e6
TLSH
T18551A0F3C3E8C62E890155F4AB146E2BDE1D0914832C7D5AC9E4AF1BA3E3471D141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3631fd53180c0ce4af0b22414ea09a41e8bb202fa0fd86e64f37897a81184d2f
MD5 42fbb67d24a26c7c249a92a58eb28486
SHA1 176e94b81078133bde3bdc5a0fe7001368b4ad3d
SHA512 f772482f270cabb45466540b7c70b6d64a759665edce980dfa17cbea0e5a2b2ee3e6434265bbfd1bda96208c464d527c125fdc6e3ee4687e4aaacb765423b740
SSDEEP 192:sxR9RTACQ/fSsq09nZ1t8DzoA8p9v/g6+WNCCK/YZ79KEkG9IgVlVgJ:sxR9hQ/fSsq09Zf8y5/5K/eBy
TLSH
T1EE42B615AE28AD3B8CCBD21DBA55BF53E2F95072A0D51E18E6FC9A1C04E76CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 31309154fe3b473be4bb6d69bdfe12a99d0355d60b18927b40cf6a7a1063db9c
MD5 073340a18d2eea10e5b6d5a39a975306
SHA1 334d710833d87710b1e665f46f0a8274e4a19f49
SHA512 d19759dfe1bc602923c7c5039678bf570deec1eb300610e24a2d6115f1a116825a386f4f32cf1d48e2c7bee498f0f6489bc61426f70f6c7981efe08b34e40813
SSDEEP 192:sxRGRTACQ/fSsi0inZ1t8DzoA8p9v/g6+WNCCK/YZ79bEkG9IgDUlVgJ:sxRGhQ/fSsi0iZf8y5/5K/DBD
TLSH
T12142D615AA28AD3B9CCBD20DBA55BF53E2F95072A0C51E18A7FCDA1C04E76CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e608d6fe95fd6b8c36f21eb4d365d7723b304491532f957c8bbb05c2a63baaf0
MD5 318203bf3516dd9b4d2484499283a182
SHA1 2ab51c7e6432edc6be6584ab8a9e8727fddbde83
SHA512 d492478ff977e15b1bae25b49b8a885278acd3d69323700aa3e89753c9237939a01061102a40b2337af634956de4b62f5e052fd7c33e6777ec1a46b5774b972b
SSDEEP 192:sxRGRTACQ/fSsi09nZ1t8DzoA8p9v/g6+WNCCK/YZ79KEkG9IgDulVgJ:sxRGhQ/fSsi09Zf8y5/5K/eBl
TLSH
T1D242C715AE28AD3B8CCBD21DFA55BF53E2F95072A0C51E18A6FC9A1C04E76CD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 0ef7a82b9994e27fe180f759eb3f8a2825309c854a8c711886c23528bd6d5c3a
MD5 f7a809c0a79b21495c88729270107cfd
SHA1 0e1197eafa2d0eca1c194590cb94b47066645c09
SHA512 37f2e6de4b4561d8925462b1b0c7b1f6cba04b4dab74658a9b5b402eac393d351573e8ee2503d484ff955e03d5332c72dfeaaac6f105b9d939f998889e69729c
SSDEEP 768:ky2Svn7pLuLfsvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OV/zdSV4brov+E:ky2SvhEfsvWgd5f/bu1jaQzdU4omE
TLSH
T10FD2DA3B640DCB7F4F804ADDAC197E9E6DA802CB96D8C98047FA951C03C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8765328c55366969214394bfbfd23a0735cc463936bc2b5aa9061a6f52e27903
MD5 c4349da01e1e60bcf9e871a66f48de7f
SHA1 6db585abfc9337cdbf6b7cf4f31006954b9b0051
SHA512 31fefefebf40ad1d9a46cb0ffc1d617ecf84aac5086ef4dcfc38e2ad913b264fef63e7ee0ebbf134d1850f73caa330ee958486822b6faff135222dbefe81b49a
SSDEEP 48:Kj2PKmgsIkYshPIhukKiBqokeG0fBgG5yJUIDKtic27IZKQo8LyouVyej:KIB2KysCqUgKtib7aKQoyu
TLSH
T10D914C62707F4B412CBF6A0D9594C52AD6C275B33019B42B7BE840AA1F6FF411DBD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c657ae89-8cb3-4b36-b661-cc886dd13447.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c657ae89-8cb3-4b36-b661-cc886dd13447.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 e8d761c49b46cfe02aeaf0e53c71969242251b79f6aae763231f49998b6956a4
MD5 41711352e276c953c542ea118ab0ce09
SHA1 e4df6adfd74b8c8b45c5d753664270e10bcd63cb
SHA512 e54b7ee5938c18c00835e30472e09fb15dc7ecbd356a1dd9710c0202b5de391d418fd22ee8beb369a24e267cef1f2718deb913d607cfeba410fdd011ff797ef5
SSDEEP 768:GP3DjEsqkJMAam6aQMGdjWca4Ghf9yK1W:GP3DJJ+maME6pyD
TLSH
T14FE2AE3098B8DD739CA7E295B71A3783BEF011B384D84E44D9D9AB1D029718E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 1275b9484690aea4a529adaedd9960260f395834a19d12db415dae2c17c3ff82
MD5 882dbe031a823ac67841127d053c4d12
SHA1 2b7ade3319c8f838d2e37590d6d2ac264f0cdfd0
SHA512 bb38732043de830654f89585b075c57d096dd4cd6a09150e4a029cce18029a3f489d0f61e3cb562538dc13aef3f36e1d377819d279d0803c4fb769cca4ebf0d1
SSDEEP 768:7FQG3Kwgej75KRAam6aQMGdjWca4Ghf9yK1W:OG3p8TmaME6pyD
TLSH
T1DC03F6F188E79977D8AE9787A73D2E42A9BCC163B4884980B7D45D0CCD921BFD307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 8d93ad98b751128ce6d5667c96dda6cefdaca10bde6d294d812f0a44794f952b
MD5 d80c67bef8ab484b80c7516192ea6bba
SHA1 5d0a5b5f131dd51311a3396fe7d744d78d1ad1e3
SHA512 2522b05150f882a8a39acac6a48ef03bee39e5dee7d51e1aae71f2b6941625e00836d7abde9f7bd89677d47f0fa7f774f54deca67bda07ec65905927de2601d6
SSDEEP 768:1rv+4UNbdA3+jUsqkJ0Aam6aQMGdjWca4Ghf9yMP:1bsby3+pJWmaME6pyS
TLSH
T1AEF2AE30A8BCDD739DB7A595F21B3A83BEB411A388C40E54D9D96B0D029718E370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 f1bde7cea67045754813ad89122e0df9d088af881954c26e3bad55607d60dd0f
MD5 ff220bbbe903659d0652bc5fd1f47864
SHA1 0efcd8570238505a389ae7762ad6a5eaa98f7820
SHA512 affe62d00b02c465c69c73193c52d0c0bf81f1fdfd5974af4d68646ab074b52afe78e45ba7bd52e8a4c8d222951d93704b7b1fed85c5bed4c5598aaf5b7b6cfe
SSDEEP 768:rP3+jEsqkJMAam6aQMGdjWca4Ghf9yK1W:rP3+JJ+maME6pyD
TLSH
T193E2AF3098B8DD779CA7E295B71B3783BEB011B384D84E44D9D9AB1D029718E270BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0b44d4896fdb257333b06b9486d9e53a7718af6973045b0a17a20d4181188c98
MD5 72c9b994fabb10f342597ef82b5fb91e
SHA1 983e5fab2fcd5af10bf95c53a0484ccc38466703
SHA512 1c8780d8a34a499022d9543952c99de9263cd5cc43200f53ad5d2d6cf5b687b3e286901f676da42dbe245eccf61c5f7ffca0265587196fb8ae1bbc6c5dc6146c
SSDEEP 768:/rv+4UNbdq33Jq+AAam6aQMGdjWca4GhfBoPeU/:/bsbc3fKmaME6pwH
TLSH
T157F2BE31A87C9973DDB79A99F21B6B47BEF021A384D40E80D9D91B0D439748E330791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

c8760208-59e3-4c19-baeb-c418f32acb7e.tmp

Path C:\Users\Admin\AppData\Local\Temp\c8760208-59e3-4c19-baeb-c418f32acb7e.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5368_1963229950\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1260-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1640-508-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1768-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-741-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2252-570-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2420-622-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2684-468-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3040-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3184-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3240-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3672-635-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3868-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3936-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4196-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4448-726-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4456-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-658-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4860-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5688-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6040-496-0x0000000000010000-0x0000000000083000-memory.dmp

Download