4e996a7db76e984a8a89ba0aa67a465f801869d91af57825c6f3210ce3efff95

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
Size 243KB
Sample260824-e4h7hashlc
SHA256 4e996a7db76e984a8a89ba0aa67a465f801869d91af57825c6f3210ce3efff95
MD5 97bb10f75cad9965ae842ee38a23a0c1
SHA1 5dbd06c24ae191d9372d37d69e6b9243a60ed2c4
SHA512 919227d0c7fb35983178694e908f13cf921d65f25c50c6687816ba88cde51f1dcbec7a16bab4cfce13290c4155f6c5cc80383ca7c8574de950ee2824d64c5e08
SSDEEP 3072:XCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Z:yvMsLaOa3lLNngoqRttA7Z
TLSH
T1E8345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1344	CP.exe
5908	rpjebztrmg.exe
3552	CP.exe
1576	CP.exe
1964	i_rpjebztrmg.exe
6068	oigbytrljd.sys
4848	CP.exe
3560	geywtrljgb.exe
4928	CP.exe
1396	CP.exe
4996	i_geywtrljgb.exe
3128	wtnlgdywqo.sys
204	CP.exe
5000	tnljdbvtnl.exe
5236	CP.exe
2400	CP.exe
940	i_tnljdbvtnl.exe
4804	bvtqljdbvt.sys
1052	CP.exe
1192	ifdbvsqkig.exe
1440	CP.exe
4976	CP.exe
1652	i_ifdbvsqkig.exe
1264	vqnifdavtn.sys
4996	CP.exe
4628	qkidavqnlf.exe
2792	CP.exe
3556	CP.exe
2152	i_qkidavqnlf.exe
4984	qkicavsnkf.sys
3112	CP.exe
1560	kfdxuspnhf.exe
940	CP.exe
4948	CP.exe
4824	i_kfdxuspnhf.exe
2788	spkhfcausp.sys
5140	CP.exe
52	xrpmkhczxr.exe
260	CP.exe
2816	CP.exe
6048	i_xrpmkhczxr.exe
5796	mhezxrpjhc.sys
1136	CP.exe
2848	hfrpjhbzur.exe
2328	CP.exe
1772	CP.exe
5520	i_hfrpjhbzur.exe
5256	omjezwuomg.sys
5012	CP.exe
4188	pmhezuomge.exe
4432	CP.exe
1132	CP.exe
4932	i_pmhezuomge.exe
2276	jhbzwrojgb.sys
5784	CP.exe
296	eywqomgeyt.exe
360	CP.exe
2840	CP.exe
2796	i_eywqomgeyt.exe
2892	olgeywqoiy.sys
5260	CP.exe
4152	dbytrljdbw.exe
2772	CP.exe
4804	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1103458473\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1103458473\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1461083691\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1441886737\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5732_1359323022\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5732_1067144220\_locales\km\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcaxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdbvsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfdxuspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjebztrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjebztrmg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidavqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpmkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfdxuspnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpmkhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdavtqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdavtqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljgaywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidavqnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljgaywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezuomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqomgeyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnljdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwromhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigbytrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdbvsqkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfrpjhbzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcaxspki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6060	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2796	ipconfig.exe
3244	ipconfig.exe
2348	ipconfig.exe
6108	ipconfig.exe
4984	ipconfig.exe
3684	ipconfig.exe
4496	ipconfig.exe
3688	ipconfig.exe
5392	ipconfig.exe
4788	ipconfig.exe
2992	ipconfig.exe
2088	ipconfig.exe
5948	ipconfig.exe
3012	ipconfig.exe
4620	ipconfig.exe
4260	ipconfig.exe
6076	ipconfig.exe
5468	ipconfig.exe
4600	ipconfig.exe
2216	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320193819954411"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{928C860E-5206-486E-9D52-EDCE800CEA7C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5252	msedge.exe
5252	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe
5732	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1964	i_rpjebztrmg.exe
Token: SeDebugPrivilege	4996	i_geywtrljgb.exe
Token: SeDebugPrivilege	940	i_tnljdbvtnl.exe
Token: SeDebugPrivilege	1652	i_ifdbvsqkig.exe
Token: SeDebugPrivilege	2152	i_qkidavqnlf.exe
Token: SeDebugPrivilege	4824	i_kfdxuspnhf.exe
Token: SeDebugPrivilege	6048	i_xrpmkhczxr.exe
Token: SeDebugPrivilege	5520	i_hfrpjhbzur.exe
Token: SeDebugPrivilege	4932	i_pmhezuomge.exe
Token: SeDebugPrivilege	2796	i_eywqomgeyt.exe
Token: SeDebugPrivilege	2868	i_dbytrljdbw.exe
Token: SeDebugPrivilege	688	i_jdavtqljdb.exe
Token: SeDebugPrivilege	5244	i_kidavtnlfd.exe
Token: SeDebugPrivilege	824	i_faxvpnifax.exe
Token: SeDebugPrivilege	4504	i_mkhcaxspki.exe
Token: SeDebugPrivilege	5804	i_zxrpkhczus.exe
Token: SeDebugPrivilege	6020	i_ezxrpjhezx.exe
Token: SeDebugPrivilege	5668	i_hbzwromhez.exe
Token: SeDebugPrivilege	3188	i_oigbytrljd.exe
Token: SeDebugPrivilege	5788	i_wtrljgaywt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5860 wrote to memory of 4264	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	88
PID 4264 wrote to memory of 5732	4264	iexplore.exe	90
PID 5732 wrote to memory of 3220	5732	msedge.exe	91
PID 5732 wrote to memory of 4980	5732	msedge.exe	93
PID 5732 wrote to memory of 6060	5732	msedge.exe	94
PID 5732 wrote to memory of 4980	5732	msedge.exe	93
PID 5732 wrote to memory of 4980	5732	msedge.exe	93
PID 5732 wrote to memory of 4344	5732	msedge.exe	95
PID 5732 wrote to memory of 4344	5732	msedge.exe	95
PID 5732 wrote to memory of 4788	5732	msedge.exe	96
PID 5732 wrote to memory of 4788	5732	msedge.exe	96
PID 5732 wrote to memory of 4788	5732	msedge.exe	96
PID 5732 wrote to memory of 928	5732	msedge.exe	97
PID 5732 wrote to memory of 928	5732	msedge.exe	97
PID 5732 wrote to memory of 928	5732	msedge.exe	97
PID 5732 wrote to memory of 2944	5732	msedge.exe	98
PID 5732 wrote to memory of 2944	5732	msedge.exe	98
PID 5732 wrote to memory of 2944	5732	msedge.exe	98
PID 5732 wrote to memory of 5084	5732	msedge.exe	99
PID 5732 wrote to memory of 5084	5732	msedge.exe	99
PID 5732 wrote to memory of 5084	5732	msedge.exe	99
PID 5732 wrote to memory of 3280	5732	msedge.exe	101
PID 5732 wrote to memory of 3280	5732	msedge.exe	101
PID 5860 wrote to memory of 1344	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	102
PID 5732 wrote to memory of 1584	5732	msedge.exe	104
PID 5732 wrote to memory of 3140	5732	msedge.exe	103
PID 5732 wrote to memory of 1584	5732	msedge.exe	104
PID 5732 wrote to memory of 3140	5732	msedge.exe	103
PID 5732 wrote to memory of 688	5732	msedge.exe	107
PID 5908 wrote to memory of 3552	5908	rpjebztrmg.exe	109
PID 5732 wrote to memory of 2720	5732	msedge.exe	112
PID 5732 wrote to memory of 2720	5732	msedge.exe	112
PID 5732 wrote to memory of 4688	5732	msedge.exe	113
PID 5732 wrote to memory of 4688	5732	msedge.exe	113
PID 5732 wrote to memory of 3016	5732	msedge.exe	114
PID 5732 wrote to memory of 3016	5732	msedge.exe	114
PID 5732 wrote to memory of 1720	5732	msedge.exe	117
PID 5732 wrote to memory of 1720	5732	msedge.exe	117
PID 5860 wrote to memory of 1576	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	118
PID 5860 wrote to memory of 4848	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	122
PID 3560 wrote to memory of 4928	3560	geywtrljgb.exe	124
PID 5860 wrote to memory of 1396	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	127
PID 5860 wrote to memory of 204	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	131
PID 5000 wrote to memory of 5236	5000	tnljdbvtnl.exe	133
PID 5860 wrote to memory of 2400	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	136
PID 5860 wrote to memory of 1052	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	140
PID 1192 wrote to memory of 1440	1192	ifdbvsqkig.exe	142
PID 5860 wrote to memory of 4976	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	145
PID 5732 wrote to memory of 2924	5732	msedge.exe	148
PID 5732 wrote to memory of 5620	5732	msedge.exe	149
PID 5732 wrote to memory of 4600	5732	msedge.exe	150
PID 5860 wrote to memory of 4996	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	153
PID 4628 wrote to memory of 2792	4628	qkidavqnlf.exe	155
PID 5860 wrote to memory of 3556	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	158
PID 5860 wrote to memory of 3112	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	162
PID 1560 wrote to memory of 940	1560	kfdxuspnhf.exe	164
PID 5860 wrote to memory of 4948	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	167
PID 5860 wrote to memory of 5140	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	171
PID 52 wrote to memory of 260	52	xrpmkhczxr.exe	173
PID 5860 wrote to memory of 2816	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	176
PID 5860 wrote to memory of 1136	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	180
PID 2848 wrote to memory of 2328	2848	hfrpjhbzur.exe	182
PID 5860 wrote to memory of 1772	5860	2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe	185
PID 5732 wrote to memory of 4456	5732	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_97bb10f75cad9965ae842ee38a23a0c1_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5860
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x110,0x2f4,0x2f8,0x224,0x304,0x7ffea42dc188,0x7ffea42dc194,0x7ffea42dc1a0
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1964,i,2396053149661239079,747655336091939597,262144 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,2464835936455447462,14063094822436792368,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
      4⤵
      System Time Discovery
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,9110807012772747610,8905606367469808841,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,16440447959887414183,11105373567972164631,2097152 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:4788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,9145504703006264469,10605531865970058714,2097152 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,2371490100795061102,11494983251689393192,2097152 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:9
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4332,i,18257727056441656222,10702738898786188119,2097152 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,17816531201733557297,15245808193658652604,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
      4⤵
      PID:3280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,10620551645053094700,550951710538761125,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,3098216779770485308,289994424518674206,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1689108715388359622,11838407070909990030,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:3388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,1689108715388359622,11838407070909990030,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,5101573090433496940,657534244746787410,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,10403567892075393733,15895365560255625096,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:14
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,13382180240885735513,11758378061953219807,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:14
      4⤵
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,11294220750306724615,8361720241627577262,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,13698216034938141058,6804100221443711211,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:14
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,15969754733333786861,8932543809284168788,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:14
      4⤵
      PID:5620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1296,i,16473694253244952446,3139287232131750303,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,13462552923169551724,6059665920791961992,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,12207329740165879452,11220149573380461661,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,13010313034178371007,12518631605720565516,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:5968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,7876259760542358096,16014434943533885209,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
      4⤵
      PID:5736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6668,i,11174363667841562380,12503442404597258110,262144 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12416951203858041219,10765796662262449875,524288 --field-trial-handle=2492,i,10688606202344582280,3110990427730804262,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
      4⤵
      PID:3172
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjebztrmg.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1344
- - C:\Temp\rpjebztrmg.exe
    C:\Temp\rpjebztrmg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3552
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4600
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjebztrmg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1576
- - C:\Temp\i_rpjebztrmg.exe
    C:\Temp\i_rpjebztrmg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywtrljgb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\geywtrljgb.exe
    C:\Temp\geywtrljgb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywtrljgb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1396
- - C:\Temp\i_geywtrljgb.exe
    C:\Temp\i_geywtrljgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tnljdbvtnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:204
- - C:\Temp\tnljdbvtnl.exe
    C:\Temp\tnljdbvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tnljdbvtnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2400
- - C:\Temp\i_tnljdbvtnl.exe
    C:\Temp\i_tnljdbvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdbvsqkig.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1052
- - C:\Temp\ifdbvsqkig.exe
    C:\Temp\ifdbvsqkig.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1192
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1440
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5948
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdbvsqkig.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4976
- - C:\Temp\i_ifdbvsqkig.exe
    C:\Temp\i_ifdbvsqkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkidavqnlf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4996
- - C:\Temp\qkidavqnlf.exe
    C:\Temp\qkidavqnlf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4628
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2792
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkidavqnlf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3556
- - C:\Temp\i_qkidavqnlf.exe
    C:\Temp\i_qkidavqnlf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfdxuspnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3112
- - C:\Temp\kfdxuspnhf.exe
    C:\Temp\kfdxuspnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2216
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfdxuspnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\i_kfdxuspnhf.exe
    C:\Temp\i_kfdxuspnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpmkhczxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5140
- - C:\Temp\xrpmkhczxr.exe
    C:\Temp\xrpmkhczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:52
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:260
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpmkhczxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2816
- - C:\Temp\i_xrpmkhczxr.exe
    C:\Temp\i_xrpmkhczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfrpjhbzur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1136
- - C:\Temp\hfrpjhbzur.exe
    C:\Temp\hfrpjhbzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfrpjhbzur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1772
- - C:\Temp\i_hfrpjhbzur.exe
    C:\Temp\i_hfrpjhbzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezuomge.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\pmhezuomge.exe
    C:\Temp\pmhezuomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4188
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezuomge.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Temp\i_pmhezuomge.exe
    C:\Temp\i_pmhezuomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqomgeyt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5784
- - C:\Temp\eywqomgeyt.exe
    C:\Temp\eywqomgeyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:296
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqomgeyt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2840
- - C:\Temp\i_eywqomgeyt.exe
    C:\Temp\i_eywqomgeyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytrljdbw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5260
- - C:\Temp\dbytrljdbw.exe
    C:\Temp\dbytrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4152
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2772
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytrljdbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4804
- - C:\Temp\i_dbytrljdbw.exe
    C:\Temp\i_dbytrljdbw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdavtqljdb.exe ups_run
  2⤵
  PID:4088
- - C:\Temp\jdavtqljdb.exe
    C:\Temp\jdavtqljdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:240
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:364
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdavtqljdb.exe ups_ins
  2⤵
  PID:5764
- - C:\Temp\i_jdavtqljdb.exe
    C:\Temp\i_jdavtqljdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kidavtnlfd.exe ups_run
  2⤵
  PID:1740
- - C:\Temp\kidavtnlfd.exe
    C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:484
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6076
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kidavtnlfd.exe ups_ins
  2⤵
  PID:1228
- - C:\Temp\i_kidavtnlfd.exe
    C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxvpnifax.exe ups_run
  2⤵
  PID:4824
- - C:\Temp\faxvpnifax.exe
    C:\Temp\faxvpnifax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2044
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxvpnifax.exe ups_ins
  2⤵
  PID:5348
- - C:\Temp\i_faxvpnifax.exe
    C:\Temp\i_faxvpnifax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcaxspki.exe ups_run
  2⤵
  PID:4568
- - C:\Temp\mkhcaxspki.exe
    C:\Temp\mkhcaxspki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4480
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcaxspki.exe ups_ins
  2⤵
  PID:1248
- - C:\Temp\i_mkhcaxspki.exe
    C:\Temp\i_mkhcaxspki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxrpkhczus.exe ups_run
  2⤵
  PID:1048
- - C:\Temp\zxrpkhczus.exe
    C:\Temp\zxrpkhczus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5500
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5392
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxrpkhczus.exe ups_ins
  2⤵
  PID:6036
- - C:\Temp\i_zxrpkhczus.exe
    C:\Temp\i_zxrpkhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhezx.exe ups_run
  2⤵
  PID:1212
- - C:\Temp\ezxrpjhezx.exe
    C:\Temp\ezxrpjhezx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5724
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhezx.exe ups_ins
  2⤵
  PID:4200
- - C:\Temp\i_ezxrpjhezx.exe
    C:\Temp\i_ezxrpjhezx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbzwromhez.exe ups_run
  2⤵
  PID:1832
- - C:\Temp\hbzwromhez.exe
    C:\Temp\hbzwromhez.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbzwromhez.exe ups_ins
  2⤵
  PID:4176
- - C:\Temp\i_hbzwromhez.exe
    C:\Temp\i_hbzwromhez.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oigbytrljd.exe ups_run
  2⤵
  PID:5092
- - C:\Temp\oigbytrljd.exe
    C:\Temp\oigbytrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oigbytrljd.exe ups_ins
  2⤵
  PID:3536
- - C:\Temp\i_oigbytrljd.exe
    C:\Temp\i_oigbytrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljgaywt.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\wtrljgaywt.exe
    C:\Temp\wtrljgaywt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4608
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3684
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljgaywt.exe ups_ins
  2⤵
  PID:5684
- - C:\Temp\i_wtrljgaywt.exe
    C:\Temp\i_wtrljgaywt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4740

C:\Temp\oigbytrljd.sys
C:\Temp\oigbytrljd.sys
1⤵
- Executes dropped EXE
PID:6068

C:\Temp\wtnlgdywqo.sys
C:\Temp\wtnlgdywqo.sys
1⤵
- Executes dropped EXE
PID:3128

C:\Temp\bvtqljdbvt.sys
C:\Temp\bvtqljdbvt.sys
1⤵
- Executes dropped EXE
PID:4804

C:\Temp\vqnifdavtn.sys
C:\Temp\vqnifdavtn.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\qkicavsnkf.sys
C:\Temp\qkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:4984

C:\Temp\spkhfcausp.sys
C:\Temp\spkhfcausp.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\mhezxrpjhc.sys
C:\Temp\mhezxrpjhc.sys
1⤵
- Executes dropped EXE
PID:5796

C:\Temp\omjezwuomg.sys
C:\Temp\omjezwuomg.sys
1⤵
- Executes dropped EXE
PID:5256

C:\Temp\jhbzwrojgb.sys
C:\Temp\jhbzwrojgb.sys
1⤵
- Executes dropped EXE
PID:2276

C:\Temp\olgeywqoiy.sys
C:\Temp\olgeywqoiy.sys
1⤵
- Executes dropped EXE
PID:2892

C:\Temp\lgdyvqoigd.sys
C:\Temp\lgdyvqoigd.sys
1⤵
PID:5828

C:\Temp\nlfdxvqnig.sys
C:\Temp\nlfdxvqnig.sys
1⤵
PID:5712

C:\Temp\fdxvpnhfdx.sys
C:\Temp\fdxvpnhfdx.sys
1⤵
PID:3648

C:\Temp\sqnkfcausq.sys
C:\Temp\sqnkfcausq.sys
1⤵
PID:108

C:\Temp\fcxupkhcau.sys
C:\Temp\fcxupkhcau.sys
1⤵
PID:5796

C:\Temp\jhczusmkec.sys
C:\Temp\jhczusmkec.sys
1⤵
PID:2444

C:\Temp\bzwuomjhez.sys
C:\Temp\bzwuomjhez.sys
1⤵
PID:1648

C:\Temp\wtrljeywro.sys
C:\Temp\wtrljeywro.sys
1⤵
PID:4352

C:\Temp\ywqoigbywq.sys
C:\Temp\ywqoigbywq.sys
1⤵
PID:704

C:\Temp\gdyvtnliga.sys
C:\Temp\gdyvtnliga.sys
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqljdbvt.sys

Path C:\Temp\bvtqljdbvt.sys
Size 141KB
SHA256 592ff43548abcdde5015c30e5d0ea1b517a2c2ed5e34c59362269d874ffba95a
MD5 9ed1098128c4caedca14f158e8208407
SHA1 b7f9e980ad39cb445c9d58ff49dca501b681d128
SHA512 6f52d9348b52ab66ce45bca6abe761bcf89cc9dba5050325c147945cde42bcd74af3aeeff016d88ecb3029d314b6ba43a6e679f2fb01c9d9fa541230fe763f63
SSDEEP 1536:Da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtrljgb.exe

Path C:\Temp\geywtrljgb.exe
Size 243KB
SHA256 fb207c7b8a12ec8ea8962c0b7c117d09a6a103f559a59322debfad8e7addd314
MD5 829182bd0cf842db58136af52337850d
SHA1 b326342f034875534df1eaac8589f6ee2c6ddf3d
SHA512 c265f9f1b40532ee173711aaafa68bfd80c4c8ef7bf8e8d79e73b39e395753bd5666d152f0da03075c8e1191f9d1708f539e6f310f024192953e46afad55562d
SSDEEP 3072:KCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7U:1vMsLaOa3lLNngoqRttA7U
TLSH
T188345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywtrljgb.exe

Path C:\Temp\i_geywtrljgb.exe
Size 243KB
SHA256 c08005210a469aa618a105b07d7eec5c6e336409e7d21561ee29e7c3d8ef44aa
MD5 7155a627370b2e52d3be5cbf9afa0d34
SHA1 f84c7e2edaba520d41296e18a5422dd3309c2808
SHA512 2c2df5ec2aacde73dc6c38a90968164e798da6dd535d3a8711a9c030c826c21a8dcdd71ff4965b9a40f02c4562a1727ce318847edc7e799756ce44bbbc92775b
SSDEEP 3072:JCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7v:0vMsLaOa3lLNngoqRttA7v
TLSH
T17D345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifdbvsqkig.exe

Path C:\Temp\i_ifdbvsqkig.exe
Size 243KB
SHA256 9f76a643b5ef74356a0c80150d5c15a471b458a7ea3ee23845da3e2114b84a7c
MD5 d0d105717139854b31c46430b08ed91e
SHA1 91acf78a98e6a847105136d8384dd361a51a05b6
SHA512 ef7630d1cbb270884f1525400d3c77e90faa211d19b6b84325d5b58cc4549523741b136faffdc1145d51404d9e19b85df2c64dfecebe4694300d17aa2b87807f
SSDEEP 3072:iCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7o:dvMsLaOa3lLNngoqRttA7o
TLSH
T1E6345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfdxuspnhf.exe

Path C:\Temp\i_kfdxuspnhf.exe
Size 243KB
SHA256 b5578cb5b91c3dec2f60be90e29b8186403fa51ed33f3fa253b0463c7c24090d
MD5 587c7aa019d1e639c85340f1fc4f5d45
SHA1 41bdcff4d333182c9ee9d2b48c3ee31c3411784c
SHA512 83a0b9a4e603f79043d19660bcebf1ebaddc3a5c53be4afd1bdca103595220a974e67b784f41019e6bf9cfe65848e014720ca9654b0a1d2d6aba78fcfad3e636
SSDEEP 3072:2CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7A:ZvMsLaOa3lLNngoqRttA7A
TLSH
T19B345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qkidavqnlf.exe

Path C:\Temp\i_qkidavqnlf.exe
Size 243KB
SHA256 50d72febe3d1cb78e3b2091f45438d1fbd11ec440c6cb3d4155e3ea5b14cacb6
MD5 e92d4c8796d4890af58e22f2186fe9a3
SHA1 5054ef6f89971fdd0d2a6247001d1aefebfce8f1
SHA512 30820155d2b3edb53d685219010e13249c5d2576e2c61d629c79b6a647014f9c07e9a110ae6c305b56008adf9901d5e72ae84f6ec694997b1e67bd39e628f3ac
SSDEEP 3072:zCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7B:2vMsLaOa3lLNngoqRttA7B
TLSH
T146345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjebztrmg.exe

Path C:\Temp\i_rpjebztrmg.exe
Size 243KB
SHA256 9259e8aadfe47609ca817443f17064d1b0f1ef991d16fc4efd555696a4d759c1
MD5 96f91ebeda1b02323f4348cde264360d
SHA1 736206849bbb9194f8cd3b1d8aec66924e5f20e7
SHA512 3c7bdb15e9929149028728e5b03115adf79bca7ed505d1b71925f4f97b30a3140127b7d416e3632ddd8ed4fea08bfd9782c234ad28d66fe0f56ab84ecf0980dc
SSDEEP 3072:0CvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7K:HvMsLaOa3lLNngoqRttA7K
TLSH
T144345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnljdbvtnl.exe

Path C:\Temp\i_tnljdbvtnl.exe
Size 243KB
SHA256 683d9c876662b9b95c44c070f715f28caaec03eba5d95a13ac5b1968a5c055eb
MD5 e070a4179d25e783d64370ea79552ab4
SHA1 49b6b5977423551b2a9fb54993e9d8ecf28f2e24
SHA512 a27218addeafdf66e3c0696f8f4cbce8c7e8326889dec92bbfe48584c7c779662871825365e599dd443b91f185a47b5977c1ca02f803ee47d0f007b794b6922c
SSDEEP 3072:VCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:YvMsLaOa3lLNngoqRttA7n
TLSH
T1C4345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdbvsqkig.exe

Path C:\Temp\ifdbvsqkig.exe
Size 243KB
SHA256 c4fd1a299f5c04fe45392aa697a355b9266998cef563a86dc50f9a58c482c229
MD5 92b319fd0c350dfa32ce856c14d90db7
SHA1 f7aeb080a7218a59002d3de661c50fcfd29430d1
SHA512 db074d16d5b4a6bf356a388b335e33f1cb1be0f7b631aa6a91727af5d74085508611179cbcef5a5a0ba8b8228c500384283dea1651626f41336075d4a6086179
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:evMsLaOa3lLNngoqRttA7R
TLSH
T133345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfdxuspnhf.exe

Path C:\Temp\kfdxuspnhf.exe
Size 243KB
SHA256 5a090814adce6f0df24d6a5b47ae11a7ca659d538657fd2d4357c52cf118bb3b
MD5 cd079c5d9521fd5515064e088646a17a
SHA1 1848a41362037abd93150843672fc2ca9d6860b9
SHA512 81f882d0764745b351817b135f2d3e4aceb2d881e65c10dcae7383a757d3d67254cbdd41ad44469a39fcc8fd5b502a845170afde81d13b1a074fa840cdf5762b
SSDEEP 3072:ECvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA76:XvMsLaOa3lLNngoqRttA76
TLSH
T1A2345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigbytrljd.sys

Path C:\Temp\oigbytrljd.sys
Size 141KB
SHA256 575081f85f9df702e4679b12c8094961e527be8f17a982d097e5333ea88f8315
MD5 ec68dc95670db6cae01fb0a5ff6d9695
SHA1 13fd54784e79712a54ebad6114735d6d8f81b889
SHA512 8f48a750fe1c6ea056a1e4485162dcaf8a1ce46980d1022ce45adf6b93bbbdeea8b54c97ee249243678739fdebb3059a7a19b44ef594230f633d875bf262c2a0
SSDEEP 1536:pa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:pa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A3E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicavsnkf.sys

Path C:\Temp\qkicavsnkf.sys
Size 141KB
SHA256 bb0193fc7dff62e59ba33d5f4c0ff42facb145e9d34e2997ba8b8825b85f1df2
MD5 5a3f60cfdb08c82b296d87da007d1660
SHA1 37df95bffe9e53323639f62c3fd6017b46b028e2
SHA512 53f21c2fa62069ccc58eaecf6fcf568b9c3c5d6498469e861473fb6da416bd161331017d7f295acb5d2b61aca3b5cdbc25c28d395b711ffc3cfcced8ac84daf3
SSDEEP 1536:Ja3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ja3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkidavqnlf.exe

Path C:\Temp\qkidavqnlf.exe
Size 243KB
SHA256 c96bbb6bffd43c49d359f678aba44c2c35d30d6daaa1624c9fe05ccfff5a4c3c
MD5 79e6ffda47ee82aabb3797df6040392a
SHA1 13531bf503f2ff2abc158a2fe5306f8131d8f405
SHA512 c78411e20504421dc4f45ac68668d49264ff05a845b1b46a2a00029c898e689cf3558af93df18384def4be442c10a368a2d6227898e82c7229b683c5761abda0
SSDEEP 3072:rCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7x:evMsLaOa3lLNngoqRttA7x
TLSH
T19C345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjebztrmg.exe

Path C:\Temp\rpjebztrmg.exe
Size 243KB
SHA256 4e95cbace2d02af8af739cd88e748f2eb37cd1934e51c3db1b9c07e839157e83
MD5 452ea870d81e4de24aba77e892717bb1
SHA1 3877c399aa805a196bc52d13aadb6a3700fcf08f
SHA512 cc79b9b59d26791c729f5b29a3d05dd1661088bb5622e2ab3c72b6c8833311d02437dddf56abe1c4c1d21385348846c881b273d0eb5ead2f04c4d3a621c42379
SSDEEP 3072:TCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:WvMsLaOa3lLNngoqRttA7N
TLSH
T186345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljdbvtnl.exe

Path C:\Temp\tnljdbvtnl.exe
Size 243KB
SHA256 2f2a76e71e34a8922983472f4e70c03a1fc7ccfaa2030722a04a26cba7e2525b
MD5 b652168410146471a43c1dfb863d2bd4
SHA1 e0cc01c88d318704e0e2167c335cb7327118a314
SHA512 2ceaf446c272a988f13ce0ba43e337895172ca446e2c6b077ec08fe9ee428ba951756ad03b67525930f05f5da3034414d580053eab09a8e846d1a564dfe1a979
SSDEEP 3072:vCvMsLLOJhH7yBa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7N:6vMsLaOa3lLNngoqRttA7N
TLSH
T1BC345A017281C031E7160B78045AE7A1467EBC384BA5E5CFF7A83B796A712D3A93725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnifdavtn.sys

Path C:\Temp\vqnifdavtn.sys
Size 141KB
SHA256 9b05cb31bae1787bd8ba9423bdba89acf61bd87d948ea1291e36b6412d7c0b8e
MD5 e29536c1f696bf3913947bf46aa8ed74
SHA1 6449e548e55714ba25485070cad3e8e3654c806b
SHA512 34c4e50d9c96a0a5539e7649728b6e6ce7641e16932819a4e97f82d9d4e92fe430aeed5352fe5c4c17ecf27d9a98a4c14efd4240a2d121a6427c48295de3755a
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EDE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtnlgdywqo.sys

Path C:\Temp\wtnlgdywqo.sys
Size 141KB
SHA256 ff0eba9c98d7eedbac7730f412b7a64099e65a88e6dc87c50bf46867a045ba6c
MD5 bb8db42044b89988eb00ab7e6e7f14bd
SHA1 7a25e70c0f892ecdc759ed1afd66ad05e431930a
SHA512 af5aa6510b0013c9879579f22b4cf731af2b9dba864ad1fa6b9321e73e44486ef4878f9755755e38e7843ad63ab24a8a4448f09e234826014a0ebc2ec1578eab
SSDEEP 1536:ia3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ia3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1EEE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e4b0514-19e0-40b8-81fa-a955eb21e217.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e4b0514-19e0-40b8-81fa-a955eb21e217.tmp
Size 36KB
SHA256 3093beb9b545922f576a33c34dbd635b7c3717db6401de4f268a0c6fd1750ba4
MD5 e683d757404d73544152bce17ada39ed
SHA1 d6c7f3898d6fa45fb867b0360a9b84a5b1972190
SHA512 44fca416630ba0c597958031aa15f4a83498601724fa698e0a7604dd02161f58b71bbf6165412122033af934c1349f462a6e65b003aa645c741e112a9f471cbb
SSDEEP 768:mrv+4UNbdw3rVFqmiAam6aQMGdjWca4Ghf9w3C:mbsbC3rdMmaME6pwy
TLSH
T15B03BF30A868D9339CBBA695F25B7A83BFB411A388C40E54D4D96B0D03971CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d72211568069ad2ec615125254b6ed266d50d621cffc8b1c80d4572d547acb49
MD5 a42610220e8cd42d5bb43c0cba0b673a
SHA1 79a7777432a4e1f0aeafc0eadd4c31cac778d8e5
SHA512 96ccc38abbf15fbc7edc86cdd7270a0949d2be62a02dad4146ea771d4d1019f1013542d06eb2d8f040affd472bbbd9f93c0bce7dc1e4229ed05daba8d5ae7154
TLSH
T1B45152A8CB2F0ED2D370D6B15CED46EDB27E4896C6076B1593F122B49B1230F2391861
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5997f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5997f1.TMP
Size 2KB
SHA256 dcdf8ac491082c3dbdb81657483fd4c571212431bf70e1236a7b7efc58de0b0a
MD5 ab496d305ea2fe97d61cda59f702b4a9
SHA1 59142ad2063c64f834b6d3b688c102aeaa102a84
SHA512 9b2e71c9f8f19eadfe5588ae89eef650b4f27f4fbf0f04965af1336043198caa17014dd0cf318aa409d571f89f0b521f26c8443faf36326254dc10c3677cec9f
TLSH
T1975163A8CB2F0ED2D374D2B15CED46EDB27E48D6C6076B1593F122B49B1230F2391461
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c9bebb447020d52471396395191af2d3337cd9079090f70583e247daa953e944
MD5 3a3818b497586c8021def5abf0a0ca2e
SHA1 baab626b0078da28b4f9b29798ab867c3208a34a
SHA512 2b0fb52a864d0fa57958a930208868fdcb5fb7c4a29921c31b177cafc716e6cc285a39cd6795079399381ac6e43b997334bb41a2788ebd2078c82bd9cfe5218b
TLSH
T18441ABF3C3E4856E890156F0AA186E2BCE1C0911432C7D5A88E4EF2B93E2472E14295F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 56435c1b1397d26f5a34a9dfa8715035751d857720c82da1f87a7f81ab4b902d
MD5 aa85727cf816b042cf431655f5926ca8
SHA1 324cd29b5b3808b233dd1f1fb3f7194f0773910d
SHA512 b75a3a5fc637241d71c2b2b15b939f8a1820e270713721eacc7be0c0a42125568a3883181742aa9adfcf3db5bcaafdb3c0e975a6907a281d1ec4a97301e1f4d2
SSDEEP 192:sxRRUR6CCu/fB2s7XqZl0pg85zoA8p9v/g6+WNC63/YZ7tqXsKGCbkIgVgc2GJ:sxROvj/fIs7X8epgDZ/57/wUbIV
TLSH
T1DC42B7566E24AD3B8CCBD61DFB557F53D2F95022A1D11E58ABFC8A1C04EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5743833219f5e3e826c9cb9da919fb3f9b5d33ddc896e37eb7b39adf9b0f974a
MD5 1eb8d0756c9232cb1beae921b83b67c6
SHA1 74030cab747abd923dd1a5f59b9dce199f1c1a3f
SHA512 45de1283d6dc66c0d79d52b59e42eda7ffca1032392edc6d3028fd3efc06a51ec5d8ad04d7e0cf0115514ed5b6badb11f13c0ce6f1b7aa80714f7a764ed01705
SSDEEP 192:sxRsUR6CCu/fB2sL/qZl0pg85zoA8p9v/g6+WNC63/YZ7tSRsKGCbkIgDJgc2GJ:sxRJvj/fIsL/8epgDZ/57/qUbIF
TLSH
T19042C755AD246D3B9CCBD609FB557F13E2F85022A1D11E58ABFC8B1C04E76CE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b3255f71d0f365a1a08c203fc0d250ff8f62dd709fd284a63ab538ef5864850a
MD5 c18a7df0a9ff6166b1b6a5c551cbc472
SHA1 987b0495beef30c675f0d21d8d0d4623a9535b62
SHA512 3acdcd2e6d8dd9ffd8f304897f929acbb0cc4c25390ea5c0706bb05968244323123cb24fd7e1444838c709c6df5c78ae0a4c520cfeda318c157835b2305beeca
SSDEEP 192:sxRsUR6CCu/fB2sLXqZl0pg85zoA8p9v/g6+WNC63/YZ7tqXsKGCbkIgD7gc2GJ:sxRJvj/fIsLX8epgDZ/57/wUbIz
TLSH
T12F42C756AD24AD3B8CCBD619FB557F53D2F85022A1D11E58ABFC9A1C04EB6CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 494fb8224dba1d382287ae31f0faa6697f26e9ad44e17d0f2c737ad7ce901e09
MD5 091fe7dec8c99e0084b39de29a13e7a1
SHA1 241108f092c30ed3dc9e3d7a9a6e91bbc5492c6b
SHA512 edaefa52f4bc51d1c2eabf88a264c17d37c1c3ff88e4effd760bc6ba1415d2d9726bc5b392fa1bf7126908f6bcc82b6f26b864efbece97428b61d9476f583ada
SSDEEP 768:ky2S2Z7pLuLzsvWgd5f/b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeQuSV4qroJ+Q:ky2S2vEzsvWgd5f/bu1jalQuU4BEQ
TLSH
T1B4D2DA7B640CCB7F4F804ADDE8197E9E6DA802CB96D8CD8047FA951C03C6BEB51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 417670b30d95abbfa45aada92b1c6f4ac3c715b5371727d30abfe1f9c5d23150
MD5 99111cfec08c7628de64fc47bc95ceed
SHA1 d1a69f9e53d2b12f8fdc03c2579a5f8fbf4a397f
SHA512 70e0b9e3c960a561889ff3791bdfb08c313d08fe270870ec5a0e5770e2ee0146ffaf1837be0bb2aaa9601bdf50bdd64c0cd637cef6232dea2c995bdece6941c8
SSDEEP 96:Knob8YmCO8myBn0w8K8p0u8YIYh2IhhsfocSmCAmeVT0UAK8V0aAYEUl6vXKK8w4:6ob8YmCOVyB0wUp0uVIYh2IhhsfocSmY
TLSH
T13291309574BA52013C7F294C92A1C66AA68270B37058B53F3BE848B51F6BF160DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38b975f6-774c-41e3-98a1-2dc8ff48758e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\38b975f6-774c-41e3-98a1-2dc8ff48758e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 6dbca9540af2c9dc7045b383948af0f50f349dedd18d8179f7948767d0979014
MD5 4f4cf7c1905286f4e58c25d1b6c66072
SHA1 000890868002b0e43eefc1f0f9921d2b6db36b4a
SHA512 1eb0e9c94b51754cba2e874e79c512720b476604479f4671b7f19651d998858ee66f64984ae3ce8638d6bc89c3f02b1e213ef54e539db6b1f73de40395a20824
SSDEEP 384:nXZcIH38NLRD+Xmivy8Wpd+dfYbRAvp/IWmkA1QiZh6vPqQMQYeJfjWca4G2KCQP:fH35LFqm9Aam6aQMGdjWca4Ghf9wRU
TLSH
T102E29E705C68DD739CAAA685F76B2683FEF0517388C84E44D5EDAB1D029358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 99eb37f694c39d25f94b7af3fafa95daf23087b793170aa832d8c3b06e4e3de9
MD5 05f43b309e0329ea94ea0905d76ed205
SHA1 eb3210b8b9c9f3eea951ed9bc3435e8dc1ecced3
SHA512 aaf744cce3909052ded7d11026a89500b88f083e44d96b02fe3029cbbc9f7d679715278dce6f94bf8357b25d3e6d18050613b55d34b476d96d2b6679f0d9c80a
SSDEEP 768:/rv+4UNbdq3JwqGAAam6aQMGdjWca4GhfBNPeU/:/bsbc32KmaME6pFH
TLSH
T1F8F2BE31A8689973DDB79A99F21B6B43BEF021A385D40E80C9D91B0D43974CE3307D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2155525e7ef959904d3fc7a08b564a68f2744149ee9fbbbbb556a57cab5233e4
MD5 7485acf6838c0d2e5d793a88ac6a7849
SHA1 ec1d668bcc5a4b2e1e6c90f55e83353d5711e77e
SHA512 53f01a4eb3b319ddb9833ee6ce607c79e7146d8538b6951d1e48da449202236edf8c00d9f680d7fc1c11249eb7e8a560b5d8a9dc1704af716876b5e64d455886
SSDEEP 768:6rv+4UNbdq3tDqm0Aam6aQMGdjWca4GhfwwPeU/:6bsbc3DWmaME6pnH
TLSH
T17DF2BF31A86CD9739CF79695F25B6683BEB021A388C40E94D8D96B0D43974CE370BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e52c7be5ee8d437b77e238eb084b458fa6154969921622890d2a98d5e42504fa
MD5 c7bee82fbe15503410ac5311e2803a08
SHA1 37db02c20341407810d2becc13892443befca58a
SHA512 2cd509e23557793ee268c4bfd378aeae96d5d452cc85b78c913175fc2ba71fd307a6eae8d0c6fda0c175c0da609df68e9c4c5c86bc7eb6f9e33a8e73f8311d6d
SSDEEP 768:wFQJ3Owgqnx9Aam6aQMGdjWca4Ghf9wRU:jJ3rpmaME6pwy
TLSH
T1D50307F198D78937D8AE5783A73E6D42ADBCC163B4884984B7D95D0CCD821BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 d52d061d4b888f87801b2964a267966a7e33be64a313a7d970f24bd20ef05552
MD5 26ee2b3b2e94abe258a5c61c141d858a
SHA1 50548a9d0602f62c0e597c4ada61d528cb820301
SHA512 8e4ea92f9c9274c4a9cf5ac0445fa725b795b2dcf0842d9564a8904209db9fe3b91ede3ff6c114a8467b7436908c38a6f0097a07401b22933ee33ef748ef1e04
SSDEEP 384:nsZcIH38NLcD+Xmivy8Wpd+dfYbRAvp/IWmkA1QiZh6vPqQMQYeJfjWca4G2KCQP:6H3WLFqm9Aam6aQMGdjWca4Ghf9wRU
TLSH
T15FE29E705C68DD739CAAA685F76B2683FEF0517388C84E44D4EDAB1D029358E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

4c238068-d8e3-44fc-aff2-c9486e864169.tmp

Path C:\Users\Admin\AppData\Local\Temp\4c238068-d8e3-44fc-aff2-c9486e864169.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5732_215918414\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-668-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/108-680-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/704-727-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1264-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1648-706-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2276-573-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2444-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2788-550-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2892-603-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3128-470-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3648-647-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4352-710-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-498-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-747-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4984-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5256-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5256-558-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-649-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5712-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5796-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5828-615-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6068-419-0x0000000000010000-0x0000000000083000-memory.dmp

Download