edbd5dda044b62aba16fed729b5507e674e37ed00b378d9d641ec844600540ab

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260828-1ct1kstdmf
SHA256 edbd5dda044b62aba16fed729b5507e674e37ed00b378d9d641ec844600540ab
MD5 14c1362830ec23965ab7fc0969d6d494
SHA1 e02852fbae701f3b25537722d9827b3d45835ab6
SHA512 44ab6e94a7b8effecb9e7832389b6b332bcc9a8cbf2f35c8786993ff0585141c55c12a2e3f8af9576fb7b4c0871307cea86546c3bcfe7b1bd3e18aedb8364d91
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T17534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3108	CP.exe
5464	zurmkecwup.exe
2040	CP.exe
2468	CP.exe
5040	i_zurmkecwup.exe
3728	ztrmjhbztr.sys
5628	CP.exe
5756	urljhbwtom.exe
5972	CP.exe
3220	CP.exe
4752	i_urljhbwtom.exe
2600	trmjetoljd.sys
3372	CP.exe
4224	mgebwtrojg.exe
4472	CP.exe
4340	CP.exe
480	i_mgebwtrojg.exe
1980	ywqoigbytq.sys
5012	CP.exe
1220	bwtrljdbwl.exe
3352	CP.exe
3420	CP.exe
6048	i_bwtrljdbwl.exe
3088	ysqlidbvtq.sys
3776	CP.exe
940	oidbysqlid.exe
4516	CP.exe
1000	CP.exe
4088	i_oidbysqlid.exe
6108	tqlidavtni.sys
4924	CP.exe
1868	icavsnlfdx.exe
4432	CP.exe
3124	CP.exe
6088	i_icavsnlfdx.exe
4668	sqkidavtnk.sys
2724	CP.exe
4132	icaxvpnhfa.exe
1404	CP.exe
4380	CP.exe
844	i_icaxvpnhfa.exe
5448	nkiczxvpnk.sys
1008	CP.exe
3700	sqkicausnk.exe
1352	CP.exe
4420	CP.exe
1440	i_sqkicausnk.exe
472	cxupmhfzxr.sys
3336	CP.exe
4160	zxupjhczxr.exe
1828	CP.exe
4860	CP.exe
1372	i_zxupjhczxr.exe
2696	zwrpjhezwr.sys
3164	CP.exe
4656	urpjhbzwur.exe
3780	CP.exe
1652	CP.exe
2476	i_urpjhbzwur.exe
5480	jhezxromge.sys
1860	CP.exe
6048	ywtomjebwr.exe
5376	CP.exe
1540	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4136_1865401692\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1792276324\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1792276324\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1756211254\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_1756211254\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4136_731879009\_locales\ur\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhcztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywrojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupjhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtomjebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtomjebwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidbysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhcztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidbysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxvpnhfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnligdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urljhbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtrljdbwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtrljdbwl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aytnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urljhbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupjhczxr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdbztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aytnlfdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicausmkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojgbzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zurmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausqkidavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfcx.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
440	ipconfig.exe
2988	ipconfig.exe
3836	ipconfig.exe
4772	ipconfig.exe
4376	ipconfig.exe
2096	ipconfig.exe
5376	ipconfig.exe
5656	ipconfig.exe
3484	ipconfig.exe
1692	ipconfig.exe
5892	ipconfig.exe
4364	ipconfig.exe
1512	ipconfig.exe
2004	ipconfig.exe
5072	ipconfig.exe
4516	ipconfig.exe
1700	ipconfig.exe
1396	ipconfig.exe
2644	ipconfig.exe
576	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324262514459195"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{8FD64772-30F3-40A0-AA24-58EE4089AAAC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	i_zurmkecwup.exe
Token: SeDebugPrivilege	4752	i_urljhbwtom.exe
Token: SeDebugPrivilege	480	i_mgebwtrojg.exe
Token: SeDebugPrivilege	6048	i_bwtrljdbwl.exe
Token: SeDebugPrivilege	4088	i_oidbysqlid.exe
Token: SeDebugPrivilege	6088	i_icavsnlfdx.exe
Token: SeDebugPrivilege	844	i_icaxvpnhfa.exe
Token: SeDebugPrivilege	1440	i_sqkicausnk.exe
Token: SeDebugPrivilege	1372	i_zxupjhczxr.exe
Token: SeDebugPrivilege	2476	i_urpjhbzwur.exe
Token: SeDebugPrivilege	6060	i_ywtomjebwr.exe
Token: SeDebugPrivilege	2848	i_tolgdbztrl.exe
Token: SeDebugPrivilege	2400	i_dbvtnligdy.exe
Token: SeDebugPrivilege	2236	i_aytnlfdxvq.exe
Token: SeDebugPrivilege	4848	i_ausqkidavs.exe
Token: SeDebugPrivilege	3736	i_icausnkfcx.exe
Token: SeDebugPrivilege	4720	i_mkicausmkf.exe
Token: SeDebugPrivilege	5752	i_mkeczurpkh.exe
Token: SeDebugPrivilege	2656	i_xrpjhcztrm.exe
Token: SeDebugPrivilege	3132	i_ywrojgbzwr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4136	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 3448	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 3448 wrote to memory of 4136	3448	iexplore.exe	89
PID 4136 wrote to memory of 2828	4136	msedge.exe	90
PID 4136 wrote to memory of 4824	4136	msedge.exe	91
PID 4136 wrote to memory of 5832	4136	msedge.exe	92
PID 4136 wrote to memory of 5832	4136	msedge.exe	92
PID 4136 wrote to memory of 5832	4136	msedge.exe	92
PID 4136 wrote to memory of 4704	4136	msedge.exe	93
PID 4136 wrote to memory of 4704	4136	msedge.exe	93
PID 4136 wrote to memory of 5000	4136	msedge.exe	96
PID 4136 wrote to memory of 2848	4136	msedge.exe	114
PID 4136 wrote to memory of 5000	4136	msedge.exe	96
PID 4136 wrote to memory of 5000	4136	msedge.exe	96
PID 4136 wrote to memory of 2848	4136	msedge.exe	114
PID 4136 wrote to memory of 2848	4136	msedge.exe	114
PID 4136 wrote to memory of 2956	4136	msedge.exe	99
PID 4136 wrote to memory of 4872	4136	msedge.exe	98
PID 4136 wrote to memory of 2956	4136	msedge.exe	99
PID 4136 wrote to memory of 2956	4136	msedge.exe	99
PID 4136 wrote to memory of 4872	4136	msedge.exe	98
PID 4136 wrote to memory of 4872	4136	msedge.exe	98
PID 4136 wrote to memory of 3064	4136	msedge.exe	100
PID 4136 wrote to memory of 3064	4136	msedge.exe	100
PID 3304 wrote to memory of 3108	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 5464 wrote to memory of 2040	5464	zurmkecwup.exe	105
PID 4136 wrote to memory of 2344	4136	msedge.exe	108
PID 4136 wrote to memory of 2168	4136	msedge.exe	109
PID 4136 wrote to memory of 2344	4136	msedge.exe	108
PID 4136 wrote to memory of 2168	4136	msedge.exe	109
PID 4136 wrote to memory of 4928	4136	msedge.exe	111
PID 4136 wrote to memory of 5488	4136	msedge.exe	112
PID 4136 wrote to memory of 5488	4136	msedge.exe	112
PID 4136 wrote to memory of 4280	4136	msedge.exe	113
PID 4136 wrote to memory of 4280	4136	msedge.exe	113
PID 4136 wrote to memory of 4196	4136	msedge.exe	116
PID 4136 wrote to memory of 4196	4136	msedge.exe	116
PID 4136 wrote to memory of 3560	4136	msedge.exe	117
PID 4136 wrote to memory of 3560	4136	msedge.exe	117
PID 3304 wrote to memory of 2468	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 3304 wrote to memory of 5628	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 5756 wrote to memory of 5972	5756	urljhbwtom.exe	124
PID 3304 wrote to memory of 3220	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 3304 wrote to memory of 3372	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 4224 wrote to memory of 4472	4224	mgebwtrojg.exe	133
PID 3304 wrote to memory of 4340	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 3304 wrote to memory of 5012	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 1220 wrote to memory of 3352	1220	bwtrljdbwl.exe	142
PID 3304 wrote to memory of 3420	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 4136 wrote to memory of 4836	4136	msedge.exe	148
PID 4136 wrote to memory of 4464	4136	msedge.exe	149
PID 4136 wrote to memory of 1352	4136	msedge.exe	150
PID 3304 wrote to memory of 3776	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 940 wrote to memory of 4516	940	oidbysqlid.exe	155
PID 3304 wrote to memory of 1000	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 3304 wrote to memory of 4924	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 1868 wrote to memory of 4432	1868	icavsnlfdx.exe	164
PID 3304 wrote to memory of 3124	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 3304 wrote to memory of 2724	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 4132 wrote to memory of 1404	4132	icaxvpnhfa.exe	173
PID 3304 wrote to memory of 4380	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 3304 wrote to memory of 1008	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 3700 wrote to memory of 1352	3700	sqkicausnk.exe	182
PID 3304 wrote to memory of 4420	3304	2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 4136 wrote to memory of 3940	4136	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_14c1362830ec23965ab7fc0969d6d494_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x308,0x7ffdb110c188,0x7ffdb110c194,0x7ffdb110c1a0
      4⤵
      PID:2828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,1414581489726831148,1697566328846883760,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:11
      4⤵
      System Time Discovery
      PID:4824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,8160400425077380284,12072821417902663959,262144 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
      4⤵
      PID:5832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,13544694067534323327,11271071691546432617,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:13
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,11411191530110038383,5412779416588370505,2097152 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,10947290893321902095,11233612850802602846,2097152 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:5000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,10206932914232631817,17135195854998377119,2097152 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,14785163705305643970,14158320601212548322,2097152 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:9
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,5815929799467349846,15854824333949486703,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,5825349088681638341,1589292536762761964,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:2344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,14472491318006160619,7732024520184859706,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:2168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4124610998436638,6095618920573131078,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,4124610998436638,6095618920573131078,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,610089564575453775,3972682404990473559,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:5488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,8862855581008511461,15291329915776004135,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8225916329834836930,9005136334147958833,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,14515032844000549585,6613920821156164305,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,1839897856244251278,6270527985533017972,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:14
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,7480819849330022589,11087133574694336370,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,14575851773139182177,15042720573743537402,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
      4⤵
      PID:1352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,12654291388134461537,17525175939157975161,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:14
      4⤵
      PID:3940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,2313645391815231596,8062217372694086218,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,10606238787104592692,16098161909056452041,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:14
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16823374643940222862,12196579891377533305,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
      4⤵
      PID:2232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,11620995858169799421,6893989918302335545,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:5452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5544,i,5204221454212216194,855045730129183018,262144 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4105505808005367471,6988407374083990270,524288 --field-trial-handle=2388,i,18386376119682408235,5672200877588354317,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:200
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zurmkecwup.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3108
- - C:\Temp\zurmkecwup.exe
    C:\Temp\zurmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2040
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zurmkecwup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2468
- - C:\Temp\i_zurmkecwup.exe
    C:\Temp\i_zurmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urljhbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5628
- - C:\Temp\urljhbwtom.exe
    C:\Temp\urljhbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5972
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urljhbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3220
- - C:\Temp\i_urljhbwtom.exe
    C:\Temp\i_urljhbwtom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgebwtrojg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3372
- - C:\Temp\mgebwtrojg.exe
    C:\Temp\mgebwtrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgebwtrojg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4340
- - C:\Temp\i_mgebwtrojg.exe
    C:\Temp\i_mgebwtrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bwtrljdbwl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\bwtrljdbwl.exe
    C:\Temp\bwtrljdbwl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1700
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bwtrljdbwl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3420
- - C:\Temp\i_bwtrljdbwl.exe
    C:\Temp\i_bwtrljdbwl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidbysqlid.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3776
- - C:\Temp\oidbysqlid.exe
    C:\Temp\oidbysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidbysqlid.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1000
- - C:\Temp\i_oidbysqlid.exe
    C:\Temp\i_oidbysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icavsnlfdx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4924
- - C:\Temp\icavsnlfdx.exe
    C:\Temp\icavsnlfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icavsnlfdx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3124
- - C:\Temp\i_icavsnlfdx.exe
    C:\Temp\i_icavsnlfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaxvpnhfa.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2724
- - C:\Temp\icaxvpnhfa.exe
    C:\Temp\icaxvpnhfa.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaxvpnhfa.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4380
- - C:\Temp\i_icaxvpnhfa.exe
    C:\Temp\i_icaxvpnhfa.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:844
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicausnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1008
- - C:\Temp\sqkicausnk.exe
    C:\Temp\sqkicausnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3700
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1352
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicausnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4420
- - C:\Temp\i_sqkicausnk.exe
    C:\Temp\i_sqkicausnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zxupjhczxr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3336
- - C:\Temp\zxupjhczxr.exe
    C:\Temp\zxupjhczxr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4160
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zxupjhczxr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4860
- - C:\Temp\i_zxupjhczxr.exe
    C:\Temp\i_zxupjhczxr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbzwur.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3164
- - C:\Temp\urpjhbzwur.exe
    C:\Temp\urpjhbzwur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4656
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbzwur.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1652
- - C:\Temp\i_urpjhbzwur.exe
    C:\Temp\i_urpjhbzwur.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywtomjebwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1860
- - C:\Temp\ywtomjebwr.exe
    C:\Temp\ywtomjebwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6048
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5376
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywtomjebwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1540
- - C:\Temp\i_ywtomjebwr.exe
    C:\Temp\i_ywtomjebwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tolgdbztrl.exe ups_run
  2⤵
  PID:4948
- - C:\Temp\tolgdbztrl.exe
    C:\Temp\tolgdbztrl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5076
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tolgdbztrl.exe ups_ins
  2⤵
  PID:1216
- - C:\Temp\i_tolgdbztrl.exe
    C:\Temp\i_tolgdbztrl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtnligdy.exe ups_run
  2⤵
  PID:4760
- - C:\Temp\dbvtnligdy.exe
    C:\Temp\dbvtnligdy.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1796
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtnligdy.exe ups_ins
  2⤵
  PID:3464
- - C:\Temp\i_dbvtnligdy.exe
    C:\Temp\i_dbvtnligdy.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aytnlfdxvq.exe ups_run
  2⤵
  PID:2032
- - C:\Temp\aytnlfdxvq.exe
    C:\Temp\aytnlfdxvq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3348
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aytnlfdxvq.exe ups_ins
  2⤵
  PID:1372
- - C:\Temp\i_aytnlfdxvq.exe
    C:\Temp\i_aytnlfdxvq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausqkidavs.exe ups_run
  2⤵
  PID:2736
- - C:\Temp\ausqkidavs.exe
    C:\Temp\ausqkidavs.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausqkidavs.exe ups_ins
  2⤵
  PID:3316
- - C:\Temp\i_ausqkidavs.exe
    C:\Temp\i_ausqkidavs.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfcx.exe ups_run
  2⤵
  PID:2508
- - C:\Temp\icausnkfcx.exe
    C:\Temp\icausnkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfcx.exe ups_ins
  2⤵
  PID:3864
- - C:\Temp\i_icausnkfcx.exe
    C:\Temp\i_icausnkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3736
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkicausmkf.exe ups_run
  2⤵
  PID:5748
- - C:\Temp\mkicausmkf.exe
    C:\Temp\mkicausmkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3796
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkicausmkf.exe ups_ins
  2⤵
  PID:4316
- - C:\Temp\i_mkicausmkf.exe
    C:\Temp\i_mkicausmkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkeczurpkh.exe ups_run
  2⤵
  PID:2456
- - C:\Temp\mkeczurpkh.exe
    C:\Temp\mkeczurpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkeczurpkh.exe ups_ins
  2⤵
  PID:5448
- - C:\Temp\i_mkeczurpkh.exe
    C:\Temp\i_mkeczurpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xrpjhcztrm.exe ups_run
  2⤵
  PID:2560
- - C:\Temp\xrpjhcztrm.exe
    C:\Temp\xrpjhcztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4532
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xrpjhcztrm.exe ups_ins
  2⤵
  PID:2644
- - C:\Temp\i_xrpjhcztrm.exe
    C:\Temp\i_xrpjhcztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywrojgbzwr.exe ups_run
  2⤵
  PID:944
- - C:\Temp\ywrojgbzwr.exe
    C:\Temp\ywrojgbzwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:900
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywrojgbzwr.exe ups_ins
  2⤵
  PID:3732
- - C:\Temp\i_ywrojgbzwr.exe
    C:\Temp\i_ywrojgbzwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3236

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1248

C:\Temp\ztrmjhbztr.sys
C:\Temp\ztrmjhbztr.sys
1⤵
- Executes dropped EXE
PID:3728

C:\Temp\trmjetoljd.sys
C:\Temp\trmjetoljd.sys
1⤵
- Executes dropped EXE
PID:2600

C:\Temp\ywqoigbytq.sys
C:\Temp\ywqoigbytq.sys
1⤵
- Executes dropped EXE
PID:1980

C:\Temp\ysqlidbvtq.sys
C:\Temp\ysqlidbvtq.sys
1⤵
- Executes dropped EXE
PID:3088

C:\Temp\tqlidavtni.sys
C:\Temp\tqlidavtni.sys
1⤵
- Executes dropped EXE
PID:6108

C:\Temp\sqkidavtnk.sys
C:\Temp\sqkidavtnk.sys
1⤵
- Executes dropped EXE
PID:4668

C:\Temp\nkiczxvpnk.sys
C:\Temp\nkiczxvpnk.sys
1⤵
- Executes dropped EXE
PID:5448

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:472

C:\Temp\zwrpjhezwr.sys
C:\Temp\zwrpjhezwr.sys
1⤵
- Executes dropped EXE
PID:2696

C:\Temp\jhezxromge.sys
C:\Temp\jhezxromge.sys
1⤵
- Executes dropped EXE
PID:5480

C:\Temp\tomgeywtom.sys
C:\Temp\tomgeywtom.sys
1⤵
PID:2032

C:\Temp\bytqoigdyw.sys
C:\Temp\bytqoigdyw.sys
1⤵
PID:2188

C:\Temp\gaysqligav.sys
C:\Temp\gaysqligav.sys
1⤵
PID:2820

C:\Temp\nlidbvtnlf.sys
C:\Temp\nlidbvtnlf.sys
1⤵
PID:2588

C:\Temp\kicausqkif.sys
C:\Temp\kicausqkif.sys
1⤵
PID:3340

C:\Temp\mkhcausmke.sys
C:\Temp\mkhcausmke.sys
1⤵
PID:3484

C:\Temp\xupmhfzxuk.sys
C:\Temp\xupmhfzxuk.sys
1⤵
PID:1576

C:\Temp\xrpjheczur.sys
C:\Temp\xrpjheczur.sys
1⤵
PID:4376

C:\Temp\ebztrmjebw.sys
C:\Temp\ebztrmjebw.sys
1⤵
PID:1456

C:\Temp\dbztrljdbw.sys
C:\Temp\dbztrljdbw.sys
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtrljdbwl.exe

Path C:\Temp\bwtrljdbwl.exe
Size 226KB
SHA256 01863efa07c6756e8b04e6086160d28c1921a43185c86e82d11a8e2a45ee34ba
MD5 b48dbf709f5eb41dfc7324959b35bf8c
SHA1 7a4d07e290b20dc117215f6202e95cdce174de16
SHA512 d84359ef71009a35ee356395f0e6940cdb957630288d9eff286d497fc84c1722432f5f37d8b5854f018fb35546b08db71e87591270b8d11ed432bc7ee6fc0c62
SSDEEP 3072:lGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:EXY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bwtrljdbwl.exe

Path C:\Temp\i_bwtrljdbwl.exe
Size 226KB
SHA256 3773657a129d44923c1a5baacf7e56d8c9dab4ff259402590e9d411ee26c4842
MD5 d29680cc1df35c0fef1199829881e875
SHA1 c377250326f3f2c746639f01e19b8aa60f435258
SHA512 8c29ddc9a2f043005918fa37e12ae808681a2912741682f32f46f7e728bf1a93ec7483a320e71ae4aa29f6f57bf885f844bc30d88cbfb1488c7dc26b62db5a05
SSDEEP 3072:NGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:sXY4LK+a3lLNngoqRttA7
TLSH
T17534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgebwtrojg.exe

Path C:\Temp\i_mgebwtrojg.exe
Size 226KB
SHA256 b21a17ea01c486d70f1effc32a31094b922946a3aa6346098c659d591ce66cb7
MD5 5ae2f3bc39aa7f27b375dbe69c5eb85f
SHA1 c7fbef76b0e9cbff552284a6fe814b000cacbc88
SHA512 66bedd41c2bf44e307ed5dbc537e1a208d70b44302e510d186e089fc13a8b42288dfa59c1bd0ff28da90e2069d6d25687a519d3eb4968c59d05f7853cfb551d5
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T10E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oidbysqlid.exe

Path C:\Temp\i_oidbysqlid.exe
Size 226KB
SHA256 df4c56de2c2fb0440589922ebb38f97bc757909bf4397c199a11d7a02d0dbe8d
MD5 59f968ff633b94aeae71cec424b29c7d
SHA1 1de22019e3aebf14961db4638695631ea1d82060
SHA512 e457c6f562b5c916940427ef05ab2a47be27af986f5081bdd466620ae9d1523701b90991f4e6c8a540a40d6e419399b5dab6389f40892259d968d6525f563239
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T17D34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urljhbwtom.exe

Path C:\Temp\i_urljhbwtom.exe
Size 226KB
SHA256 6a5124ae5afcc2d352ca0696089274b01101b3efc009da10d2224bbc7efa1876
MD5 f2b701f477c16fec0ae8f8a8827d2a12
SHA1 b9d1ff4a1994461bce69a6d08cf6c06e5dbbc27e
SHA512 02e130984fb5c89eaf2460b474bdb1cb7de90ee0be81921b4a85010ff93a600b73cc524c2d4f3d8de5368390452d85eca3f561477952a9b5a2f60712acfa4c99
SSDEEP 3072:oGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:vXY4LK+a3lLNngoqRttA7
TLSH
T10E34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zurmkecwup.exe

Path C:\Temp\i_zurmkecwup.exe
Size 226KB
SHA256 25486997d3c28f8a616deb5cc45fb1dab07aba6ec4c4e6ff9ead10901f91f42e
MD5 91d1bf55dd5fb45a39f436f2cb3d3f13
SHA1 bc12a0c528acce4e6b5c244a3a1d9e698cb5fb0b
SHA512 6809948ee59cf641dfb6c579bbbabcd2516fe819672f226605f1cd799db9110273f8b2e056b9947160bcc99cb4bf5c9de2e0e77b6cd65ec549f8b72dc7aaff31
SSDEEP 3072:sGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:zXY4LK+a3lLNngoqRttA7
TLSH
T14134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfdx.exe

Path C:\Temp\icavsnlfdx.exe
Size 226KB
SHA256 cf1329d4aa78ae9cc3853b4e9f62009aa3b5832108c6e91f1dcb383122c99bac
MD5 811b4dee2cc60db575b58a69aa1f5c36
SHA1 38f16ec0a9571e31c0fba024d522babe5a67bc01
SHA512 0ce653f3249d0a8642af2f5399530153bb69785bebc3bd7bbc7978f411a94396c1d05dccfeb23d1576a9465b26ec1ac42c158126ecdacad7e2241eab0ab94921
SSDEEP 3072:DGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:iXY4LK+a3lLNngoqRttA7
TLSH
T16F34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgebwtrojg.exe

Path C:\Temp\mgebwtrojg.exe
Size 226KB
SHA256 e032bf1e5255f864098582a18fd6b0722f88c631169bcd72afe8e9ae22665c81
MD5 d8e8ef3c9db649392c894251ecac7c42
SHA1 01282660ba8b521b956a8f6fd82d6eceb41dd498
SHA512 44284fc6f58ce63bd05328f343df5bedbeb9aaaf5c802299171d24e91290f749c85a8afc69cbb948bfc0203679c136127311f47b63eb01964b06cfbad8e72f1f
SSDEEP 3072:SGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:5XY4LK+a3lLNngoqRttA7
TLSH
T1BA34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidbysqlid.exe

Path C:\Temp\oidbysqlid.exe
Size 226KB
SHA256 dcdefd8898d2eb15e311ba01016e852bcc35c4b23146b9f2b8b4038094259619
MD5 02c547a0cf307dfb41be80cc80db2dd3
SHA1 0674c9419d5702dce5af61eafbedf34d1b860b07
SHA512 8aa9c65957b0d5d6cf6f6ff96ce3592eae3c5255be070dec4bf151683aa65827236ffc9779dc9776d2d93e5d081f1c93781497bfe18564cc1b753cc0e38985cb
SSDEEP 3072:OGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:lXY4LK+a3lLNngoqRttA7
TLSH
T18434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidavtni.sys

Path C:\Temp\tqlidavtni.sys
Size 141KB
SHA256 ba69fb1faa0048ebc04e0427bb3df69d0dec662b62d02b32cff31ddab5466397
MD5 d48ebab7ac10c324b32c79474e4f1212
SHA1 968e5288917beca44d31e05f5bd12c7ee944a92d
SHA512 8205195395e646ea95ee782abe8ed3f48daccffd17f54a7cc6d6bc2732728fb0186ec82434e4bc9de7828e659ed29d6bb0b677dd51557a88bef8787c5e0dc2a2
SSDEEP 1536:Sa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Sa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T112E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjetoljd.sys

Path C:\Temp\trmjetoljd.sys
Size 141KB
SHA256 d08634f229922429feb782b38e8e440fe830424188f9ed1c3e15f10935abb269
MD5 919ac6b34ee21fd3cdd35809f65224d3
SHA1 32cefba12cbf8e374c0642c36f04cae7d696ca12
SHA512 5211d5626b362dc3319c6c851642435432b21b68a4a44ce3ca6001cc6270ea0aeb2beb402a950cbdc1ca3851225a9dcc09d36ce2d4346acffc824880f75d8edc
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1A7E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urljhbwtom.exe

Path C:\Temp\urljhbwtom.exe
Size 226KB
SHA256 3dda6c93d120aa9aeee69946ad3dd8b8e47c6934440a2d26e38da5c4e704b4c2
MD5 99eefea9e4ebc4c1238a5bebe3846275
SHA1 f03616fd05ad1b89a2c06a5969ca6a31c9a2f152
SHA512 5ebbb41264d5dd45026c3623f1cd2f9b8434581f3a0ba52f614ed0d20f15ec9a05587bd91dfa79b1a289f3be9c02713e025be1e90f4d888979b771137709216a
SSDEEP 3072:4GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:/XY4LK+a3lLNngoqRttA7
TLSH
T1B034490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidbvtq.sys

Path C:\Temp\ysqlidbvtq.sys
Size 141KB
SHA256 c80d030a7c7ddff4703321d77b3b8536345e691330724aed601bbd7020e808ae
MD5 9897b21176775f595f1d61fd42e3d076
SHA1 2866be1e46f5561c93c3e5ddd903f5fe48df8377
SHA512 197b79ced22119cd47c78e8a5d0769ba85debfbf5d7d28e0c1a8149a6e5396591bb952d7722d3b8f988911217f8bfab58b363d942fb04fec6d9d816c1a23cda0
SSDEEP 1536:Wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T116E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytq.sys

Path C:\Temp\ywqoigbytq.sys
Size 141KB
SHA256 0c51e9c7e701d4e29cc90fca74849108f0ca4ff1623dd33ed4048fa1231d31bd
MD5 2bc8f217caaf30971331b8d7316ec792
SHA1 8c4d942fdfbe0a10d73a07fe1cedb0f95acc70ac
SHA512 9650738f184cb1010c37ce693f91e45929926bf708a900c4df976ba975aab30128690f62a8a126e74af8c9d2a44b3f46b7b9b597ac47f4c2b0bb128fa1522b0d
SSDEEP 1536:fa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:fa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T123E38C12B2D2D172D4A608B8106EC72196BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjhbztr.sys

Path C:\Temp\ztrmjhbztr.sys
Size 141KB
SHA256 b764c704b45ffd1917262ed0ac397da2d6072fac4f85db4d9c0239136f172b78
MD5 580905f0604c9901a8e269cd536bf545
SHA1 cf6e616ca77dda9f0e8b35e1676ea7aedd3212ae
SHA512 295d18898c447ef818a49c683ed08ce4198e4fa0b0c0f186be15af0e93cebc931763e848c89fdf06807509a88478e05db1cf192498a4f1b69a240f162aea8b17
SSDEEP 3072:Qa3rV3dZPFvOAngoRUAFa1nxayHdXkbm:Qa3lLNngoqRt
TLSH
T120E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zurmkecwup.exe

Path C:\Temp\zurmkecwup.exe
Size 226KB
SHA256 6a91e3be4ee9fc3b28c51e0a7c23e0587d876c1282df474cebd1570ee10cf507
MD5 06fa06c0e3a60e305452153c1e1e69a2
SHA1 241a4bc594e8ef6d87b98d5617ad6d7c0a53134a
SHA512 0cda96ceb7a4392ae0232a522ff1c0eab53a605e6778115aeef42c0c1d2bef16b1fead4c4e96dc03b5dddd5215745914db4159182908e86da4a7807369db436b
SSDEEP 3072:7GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:6XY4LK+a3lLNngoqRttA7
TLSH
T17134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

2264c4ff-b4b6-46f7-b072-eebfaab70694.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2264c4ff-b4b6-46f7-b072-eebfaab70694.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88c7eab90c89de1044d5d8748ca0f9beb411d2f84f969fce128d55d798fd33bd
MD5 550675dc6e0a468da3eb1d72cfe2dab8
SHA1 0d78de2c51ac3e2bcb7e6cfb7a9748e46deba260
SHA512 3eea3fdadd0ef3d0df904c8951b3f2af431b6d83bc69c59c7b80aa6c17efde8479375d4ff2162dac5fb69969d60d803fcee42e5c82cbfbf1f336d79dfe965ffb
TLSH
T15951FA90936739A1D7A9C6F2B9D15F683AFC84660D0F3A28555CAF343486F1F61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596d27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596d27.TMP
Size 3KB
SHA256 247022f6a677ffb36b35710151f20ee44a57e39667fc17f897f0a657c678ed4b
MD5 dffa25bfdd264655303b1f25c93f1242
SHA1 598bbed05644e35dce6cdfe314083f8d17c01da7
SHA512 a947ceea24f3dc894e28d882f220e91afebcb8f00efdada0eb690753f8e99a331e5c70e9db72af662136d33740b1ce706085eba5d7795361ba2c98c84e7023d5
TLSH
T19751FA94936739A1D7A9C5F2B9E05F683AFC84660D0F3A28455CAF343486F1F61E00E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 02fb2216e8fc90388971b5c44b7838e044dbe9ca173a0298fad4a1148893b400
MD5 f33fcd3af69431a07c5a98596a42454c
SHA1 ebec9e47c34c6269f4238f01930146a3e9c9736f
SHA512 a8b6dd411e31aa223c15992b5a03e170ec33df7afd0d905d5ca4c6119f23a6c3d2cc02bfeb863a597a6ed3f61aafb58cf9d6bd6cee7a4f1ea82295c960dcd21e
TLSH
T1FC41CCF7C3E8856E8A0196F0AA146E1FCE2C0915432C7D5AC9E4AF2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 413240675c029560959c02323f0e48b62a106a1edb3ce23ffbb3a68a963d8785
MD5 b05882bec19db55437f0863c3d67301c
SHA1 a7aa79785d222a0b90628ac21e0124e3abfe3dc6
SHA512 3bbfa648d6d8338755d4b501af7e2dd7880cf9f9d0708e2d41283b513ebf8f1c839fc74f060fbc0b148c21b223396753b0c29fc386ed16c19e58f94721761b3e
SSDEEP 192:sxRsR3CW/fQsQzVhZmBzoA8p9k/g6+WNCfQ/YnNS5hvG5KIgDjbjlJ:sxRsAW/fQs0Vv1i/5T/M6IKv
TLSH
T1B142E9166A28A93B5CC7E21DFB557F53E3F95132A0D51E08ABFC8A1C04E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6e2b0a413f5643770447fbc0014139be481f6cd1f7fab5ceb97e5b18d9a9a86b
MD5 fff3fc5fe9e074667b0b642ee7e19a26
SHA1 ac4694714d1477e74dfc5455516b710ac043688d
SHA512 6f302f59bc99b5521c0628114d65f3d3b8076486402d2c9af3422e157cd8229f3ab788de1e41273cd0b1d6e236e6c52d51861b0ca65e3930e8bb33ccc842b626
SSDEEP 192:sxR7R3CW/fQsnzRhZmBzoA8p9k/g6+WNCfQ/YnNUBhvG5KIgVbjlJ:sxR7AW/fQszRv1i/5T/MCIKp
TLSH
T10D42D8166A28A93B4CC7E21DFB657F53D2F95132A0D41E48EAFC8A1C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2ca2b1acebdfb57b32a2eae9f2cde1ab6bca0921c678b1607dd2ba2c455a9509
MD5 6ead0e2b7d265e66aeb6c6a9dd076edd
SHA1 b8db5074ba366779b88ed7e990693b2aafcb899e
SHA512 c9a00c8954852f7b1f543157b0d0452ba9540fb091a62e3a5f754e6742cba2763e32038ae6dab6ceed6ca318e3dd9ac7e2a46fd9cd0aeef76042d0fe94e5d428
SSDEEP 192:sxRsR3CW/fQsQzRhZmBzoA8p9k/g6+WNCfQ/YnNUBhvG5KIgDJbjlJ:sxRsAW/fQs0Rv1i/5T/MCIKZ
TLSH
T18942D9166A28A93B4CC7E21DFB557F53D3F95132A0D41E48AAFC8A5C04E76DD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 b0783e5778acf24da62a96d8641182c2fac4a3415be4c456720fa76b093525e7
MD5 402e2ceaa4019ba67e1ffa4926302a4b
SHA1 ab8a73cfe9a7ae2cf419604942e6060075025121
SHA512 89e6da1a737003122be0a83be4e3623bc565995e063222c1937bf6e79e45bcbbc0a5b43a763d01c13d74722b262818d5aa279cac9f9fe4adb9fa473e65bd6f78
SSDEEP 768:wb8d+B7pLuLzR6Wgouf6M8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUAmu46arohqmcx:wb8d+3EzR6Wgouf6Mu1jaTAmV6R45x
TLSH
T131D2E97B640DCB7E4F800ADDEC19BE9F6DA802CB96D8CD4447FA941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7030c8603b630f9812d0736d29b18684fa1310f59f18b784567f8e32d95d14d0
MD5 6b3f3beb25dc234db66474401a1eedd0
SHA1 4846af8c83c95f868a792a62405321660d407a53
SHA512 7d79c0f3749292c9fcbb3681fdac216624844bcf16bcaed93c73f95486c09d1c8662fb3694450f19294029a1e2fa96ae3845e06c01775dc5f59e805139b594d6
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHwBUAyeSIWWLbgIIK4Ng6Icoob6PXyK4c1:CeTieYgQxAl+eODgc1W+9M+XHwBUAyeJ
TLSH
T19591260070B612513D7F650C90B9A82FA68178637118F92B3FA811B34F6BE079DFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0919.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0919.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 b5bcb9aab2c9d20a417a2f93699c0086b2736a55cdbfa13cf8468ea69178beb3
MD5 c9ec13183a7607c6f05a2caf2ae47bbc
SHA1 04114a256742e6f0d7d6cb3f76a6ce7a00dcf101
SHA512 cce9a8715c06cb0a04b2d238f77566e8c504ac799ce41222fabdb93784c32eebd9137318d1a0b6be5a49d9b2911b2e829e3ac811b12fe06eda6dd3de8b584821
SSDEEP 768:PFQm3QwgXoZU5O0tqNzc4ReyIsPdVyL+Rf:Sm3gqtc44bs1ikf
TLSH
T1331317F598E3897BE8AD5783A73D2E429DBCC163B1885884B7D55E0CCC861BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 71344d75a40425b9c30ae0cd0ec1733616f78007b8e9d13e2375d5c2713675c3
MD5 0ac2c2e2ba6e9f0963b53345fe82d78b
SHA1 d73043de912eb5552a75910a83e884bede7f00a9
SHA512 8ad9ea62b4b295dd2b8cbf7ce7b99600be97eb3f53eaef61d177687a99ad21400e4627f4b4f058470fd8603f47a4b1711841dc2f06860bb2190fdd0c2a11a2df
SSDEEP 384:nxZcIB38NlYdUXRFJDZNfNoXOVSUUEqig3jpETRzcoXfK86sfxEZxxsIj4lB6i1X:ZB3IZDZIO0tONzc4ReyIsPdVyL+Rf
TLSH
T106F2BF70AC759D67ACF9A286F64B3643BEF41127C1C82D84D9E99F0C094729E1B1F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 54aa60a97e60bd172a1977d299db91108d5609129811237f21f89578e224c024
MD5 e5a8b05370fda39f8dbf101b80b27031
SHA1 89a8eef48cf63f8d58947b0c52282b109ea28843
SHA512 51c54158e2497614cf0612136e89b9cbe17dce0cf8d8b48196a44a5008f72ecd40515a8005023571dda012f1a0ddbbb81ed88ab4d24f7afa7e3cfe5f5bdc774b
SSDEEP 768:6rv+4UNbds3woDZIO0toNzc4ReyIsXKeVH1S5D:6bsbS3kotc44bs6EH1Y
TLSH
T16F03CF32A8788A77ACF66785B54776537EF8512BC2881A84C5DE5F0C4A8B1ED130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 41d40a60c839462044dcd369b9815d1020ffc4af4266a2319c7b47a387f38ed3
MD5 bcabdd524e63ed401104817fdc82eb5d
SHA1 047da40f96bd2bc2c836f147e52b55c78be19919
SHA512 70d46c60daac3f184c7e77fc4850021a26a1ad9412201020a74e0f34e64b52624eec5a035bfbdaa6df40545d686d5ab1b3c9e053efeb0e3379b425f8ce92b42c
SSDEEP 384:nDZcIB38NlddNZRFJDZNfNoXOVSUUEqig3jdETRzcoXfK86sfxEZxxsIj4lB6i1X:bB3qZDZIO0t6Nzc4ReyIsPdVyL+Rf
TLSH
T165F2AE70AC75DD67ACF9A286F64B36827EF41127C1C82D84D9E99F0C094729E1B1F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 057e4c040959d9273f7d5e39f4ba29b5617186bb6835ad86173398bcd7deab12
MD5 d017a1f6b2532d24aafaf2df6b5759ee
SHA1 f06ca64b88a53e9aecc695020e7224153dc74e18
SHA512 e6dd141d8be0f437edd805727a3595ff64c61f6b2e3e0829c624f1f9a164c9489e72fcf9f349cdff2d1ef00ac325f5837b91f9cc9312f4938fe2859714fee0d7
SSDEEP 768:Xrv+4UNbds38vDZIO0tnNzc4ReyIs2deVH1S5D:XbsbS3Tntc44bsmEH1Y
TLSH
T19403DF31A879CD73ACE66785F44776933EF8216B81880E98C8DA9F4C4A4B1DD170F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb44f231-7f15-4072-93a5-a2970d978661.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\eb44f231-7f15-4072-93a5-a2970d978661.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

b7e375ce-c65a-4e18-b7b2-f4a7c4644879.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7e375ce-c65a-4e18-b7b2-f4a7c4644879.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5944df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5944df.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

aeee519f-8d80-404a-a9b2-6391dce03fd2.tmp

Path C:\Users\Admin\AppData\Local\Temp\aeee519f-8d80-404a-a9b2-6391dce03fd2.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4136_1135661337\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/472-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1456-719-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1576-698-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1588-723-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1980-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-607-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-634-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2188-632-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2588-661-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2600-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2696-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2820-641-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3088-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3340-665-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3484-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3728-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4376-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4668-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5448-546-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5480-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6108-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download