79d3c193befa20c0fa292d78221a51ba3b788b07369675e1ba18dddab9dd0f4d

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
Size 243KB
Sample260828-eamylaswhy
SHA256 79d3c193befa20c0fa292d78221a51ba3b788b07369675e1ba18dddab9dd0f4d
MD5 e473ff9e05504510749d7b4bb6e5b737
SHA1 789af2a96657f197fb26cdf49e70a440f6a9c5ed
SHA512 8bcae98a053d6133bdf8a92f4621d3c4a686b9bea021db1205a05d1612cb58b9501451e0fda198e3059833dc213979d49fcab0aa9ce218bd9c706ed80a6d3985
SSDEEP 3072:Whn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA74:qn7nLQka3lLNngoqRttA74
TLSH
T13F34590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4920	CP.exe
1156	zpjhczusnh.exe
5752	CP.exe
1144	CP.exe
4512	i_zpjhczusnh.exe
4764	czurmkecwu.sys
3752	CP.exe
6116	rpjhfzxrpm.exe
6060	CP.exe
4588	CP.exe
5184	i_rpjhfzxrpm.exe
5208	jhezwrojhb.sys
4128	CP.exe
1720	mgezwrpjhb.exe
3408	CP.exe
5088	CP.exe
4788	i_mgezwrpjhb.exe
6020	lgeywqojgb.sys
3780	CP.exe
2372	lgeywqoigb.exe
3532	CP.exe
3460	CP.exe
5780	i_lgeywqoigb.exe
5488	ljdbywqoig.sys
2272	CP.exe
4104	ywqoigbytq.exe
488	CP.exe
3348	CP.exe
4928	i_ywqoigbytq.exe
1756	gaytqljdbv.sys
3428	CP.exe
1960	vtqlidbvtn.exe
2880	CP.exe
4408	CP.exe
5916	i_vtqlidbvtn.exe
1068	vsqkidaysq.sys
1740	CP.exe
4584	vpnlfdaysp.exe
2668	CP.exe
4340	CP.exe
4556	i_vpnlfdaysp.exe
1088	axvpnhfzxs.sys
3364	CP.exe
4564	fdxvpnhfax.exe
3904	CP.exe
6132	CP.exe
4376	i_fdxvpnhfax.exe
3380	kfcxupnkfc.sys
572	CP.exe
4680	ausmhfzxrp.exe
1804	CP.exe
1904	CP.exe
5296	i_ausmhfzxrp.exe
4952	ecwupmhfzx.sys
1680	CP.exe
4816	wuspkhczus.exe
5768	CP.exe
3132	CP.exe
5892	i_wuspkhczus.exe
4796	zurmjecwuo.sys
5256	CP.exe
1468	uomgezxrpj.exe
1448	CP.exe
2020	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5412_282377542\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_137315511\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_53337579\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1052180121\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_137315511\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_1052180121\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_141886333\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5412_858620412\_locales\el\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomgezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmhfzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zpjhczusnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuspkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zpjhczusnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgeywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxusnkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmhfzurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuspkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaywqolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhfzxrpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnlfdaysp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkifdbvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxusnkics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxrpnhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgebwtrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnlfdaysp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgebwtrpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2692	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
764	ipconfig.exe
1064	ipconfig.exe
3112	ipconfig.exe
2752	ipconfig.exe
5808	ipconfig.exe
3560	ipconfig.exe
4860	ipconfig.exe
4828	ipconfig.exe
2444	ipconfig.exe
2880	ipconfig.exe
4808	ipconfig.exe
2252	ipconfig.exe
5928	ipconfig.exe
960	ipconfig.exe
2088	ipconfig.exe
5944	ipconfig.exe
5480	ipconfig.exe
2668	ipconfig.exe
3380	ipconfig.exe
6000	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323622673847331"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{D4482F60-069A-4F0D-ADF7-8EFEE6FF1EA3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	i_zpjhczusnh.exe
Token: SeDebugPrivilege	5184	i_rpjhfzxrpm.exe
Token: SeDebugPrivilege	4788	i_mgezwrpjhb.exe
Token: SeDebugPrivilege	5780	i_lgeywqoigb.exe
Token: SeDebugPrivilege	4928	i_ywqoigbytq.exe
Token: SeDebugPrivilege	5916	i_vtqlidbvtn.exe
Token: SeDebugPrivilege	4556	i_vpnlfdaysp.exe
Token: SeDebugPrivilege	4376	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	5296	i_ausmhfzxrp.exe
Token: SeDebugPrivilege	5892	i_wuspkhczus.exe
Token: SeDebugPrivilege	1168	i_uomgezxrpj.exe
Token: SeDebugPrivilege	1288	i_wtrljebwto.exe
Token: SeDebugPrivilege	3472	i_eywqolgeyw.exe
Token: SeDebugPrivilege	2744	i_igaywqolge.exe
Token: SeDebugPrivilege	5356	i_qkifdbvtnl.exe
Token: SeDebugPrivilege	4796	i_vpnkicavsn.exe
Token: SeDebugPrivilege	804	i_fcxusnkics.exe
Token: SeDebugPrivilege	5096	i_khfzxrpnhe.exe
Token: SeDebugPrivilege	5516	i_upmhfzurmk.exe
Token: SeDebugPrivilege	5928	i_mgebwtrpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5412	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2460	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	89
PID 2460 wrote to memory of 5412	2460	iexplore.exe	90
PID 5412 wrote to memory of 2860	5412	msedge.exe	91
PID 5412 wrote to memory of 2476	5412	msedge.exe	92
PID 5412 wrote to memory of 2692	5412	msedge.exe	93
PID 5412 wrote to memory of 2476	5412	msedge.exe	92
PID 5412 wrote to memory of 2476	5412	msedge.exe	92
PID 5412 wrote to memory of 2932	5412	msedge.exe	94
PID 5412 wrote to memory of 2932	5412	msedge.exe	94
PID 5412 wrote to memory of 2892	5412	msedge.exe	95
PID 5412 wrote to memory of 3064	5412	msedge.exe	96
PID 5412 wrote to memory of 2892	5412	msedge.exe	95
PID 5412 wrote to memory of 2892	5412	msedge.exe	95
PID 5412 wrote to memory of 3064	5412	msedge.exe	96
PID 5412 wrote to memory of 3064	5412	msedge.exe	96
PID 5412 wrote to memory of 1096	5412	msedge.exe	98
PID 5412 wrote to memory of 1952	5412	msedge.exe	99
PID 5412 wrote to memory of 1096	5412	msedge.exe	98
PID 5412 wrote to memory of 1096	5412	msedge.exe	98
PID 5412 wrote to memory of 1952	5412	msedge.exe	99
PID 5412 wrote to memory of 1952	5412	msedge.exe	99
PID 5412 wrote to memory of 4080	5412	msedge.exe	101
PID 5412 wrote to memory of 4080	5412	msedge.exe	101
PID 5412 wrote to memory of 3684	5412	msedge.exe	102
PID 5412 wrote to memory of 916	5412	msedge.exe	103
PID 5412 wrote to memory of 3684	5412	msedge.exe	102
PID 5412 wrote to memory of 916	5412	msedge.exe	103
PID 5412 wrote to memory of 4344	5412	msedge.exe	105
PID 5412 wrote to memory of 2272	5412	msedge.exe	106
PID 5412 wrote to memory of 2272	5412	msedge.exe	106
PID 5412 wrote to memory of 2804	5412	msedge.exe	107
PID 5412 wrote to memory of 2804	5412	msedge.exe	107
PID 2760 wrote to memory of 4920	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	108
PID 1156 wrote to memory of 5752	1156	zpjhczusnh.exe	113
PID 5412 wrote to memory of 5424	5412	msedge.exe	116
PID 5412 wrote to memory of 5424	5412	msedge.exe	116
PID 5412 wrote to memory of 3460	5412	msedge.exe	117
PID 5412 wrote to memory of 3460	5412	msedge.exe	117
PID 2760 wrote to memory of 1144	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	118
PID 2760 wrote to memory of 3752	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	122
PID 6116 wrote to memory of 6060	6116	rpjhfzxrpm.exe	124
PID 2760 wrote to memory of 4588	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	127
PID 2760 wrote to memory of 4128	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	131
PID 1720 wrote to memory of 3408	1720	mgezwrpjhb.exe	133
PID 2760 wrote to memory of 5088	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	136
PID 2760 wrote to memory of 3780	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	140
PID 2372 wrote to memory of 3532	2372	lgeywqoigb.exe	142
PID 2760 wrote to memory of 3460	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	145
PID 5412 wrote to memory of 1620	5412	msedge.exe	148
PID 5412 wrote to memory of 2972	5412	msedge.exe	149
PID 5412 wrote to memory of 608	5412	msedge.exe	150
PID 2760 wrote to memory of 2272	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	153
PID 4104 wrote to memory of 488	4104	ywqoigbytq.exe	155
PID 2760 wrote to memory of 3348	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	158
PID 2760 wrote to memory of 3428	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	162
PID 1960 wrote to memory of 2880	1960	vtqlidbvtn.exe	164
PID 2760 wrote to memory of 4408	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	167
PID 2760 wrote to memory of 1740	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	171
PID 4584 wrote to memory of 2668	4584	vpnlfdaysp.exe	173
PID 2760 wrote to memory of 4340	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	176
PID 2760 wrote to memory of 3364	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	180
PID 4564 wrote to memory of 3904	4564	fdxvpnhfax.exe	182
PID 2760 wrote to memory of 6132	2760	2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe	185
PID 5412 wrote to memory of 1052	5412	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e473ff9e05504510749d7b4bb6e5b737_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffcf3bac188,0x7ffcf3bac194,0x7ffcf3bac1a0
      4⤵
      PID:2860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6929022924021046805,9503564920684282371,262144 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
      4⤵
      PID:2476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,12729094090737985160,17349211884438744531,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:11
      4⤵
      System Time Discovery
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,3953187587324636046,6862749561369525275,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,16807510419006355271,4225675343661189873,2097152 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:2892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,18110306227030798623,17887108133981838877,2097152 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:3064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,6083204970869581799,9096250424897303533,2097152 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
      4⤵
      PID:1096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,1489106363635833882,12291678677663092099,2097152 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15978565931514621516,1896689026575427709,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5552485237846744220,6353380113689709465,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:3684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,9000850017487686784,12633543562929106074,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16068054228464187885,4758682194950415328,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16068054228464187885,4758682194950415328,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:4344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,11220203676755884324,13227497653217472737,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:2272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,16186695707593136225,9537681769176222593,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,13377860651756306651,5356859552402542680,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,12129173872885490195,14497793494326130002,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:3460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,1331027351844199445,17584622790352763746,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
      4⤵
      PID:1620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,9402979122024800402,473644280706028905,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
      4⤵
      PID:2972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4660,i,9129569186687547755,14108314309487480377,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,12014312066950861500,8537001426939989073,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
      4⤵
      PID:1052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12113428143571277979,12808579404118851793,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,18135672157454446278,15665102439259939840,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:14
      4⤵
      PID:1484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,7442183177937462329,12951808752869413773,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
      4⤵
      PID:776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,10018335721877436736,5809015751269044234,262144 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,4229073873166572044,4921677201319164101,524288 --field-trial-handle=2344,i,6703233947229852024,15594660595392952177,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5520
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zpjhczusnh.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920
- - C:\Temp\zpjhczusnh.exe
    C:\Temp\zpjhczusnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zpjhczusnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1144
- - C:\Temp\i_zpjhczusnh.exe
    C:\Temp\i_zpjhczusnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rpjhfzxrpm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3752
- - C:\Temp\rpjhfzxrpm.exe
    C:\Temp\rpjhfzxrpm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6116
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6060
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rpjhfzxrpm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4588
- - C:\Temp\i_rpjhfzxrpm.exe
    C:\Temp\i_rpjhfzxrpm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrpjhb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4128
- - C:\Temp\mgezwrpjhb.exe
    C:\Temp\mgezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2880
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrpjhb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5088
- - C:\Temp\i_mgezwrpjhb.exe
    C:\Temp\i_mgezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lgeywqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3780
- - C:\Temp\lgeywqoigb.exe
    C:\Temp\lgeywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3532
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lgeywqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3460
- - C:\Temp\i_lgeywqoigb.exe
    C:\Temp\i_lgeywqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5780
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2272
- - C:\Temp\ywqoigbytq.exe
    C:\Temp\ywqoigbytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:488
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3348
- - C:\Temp\i_ywqoigbytq.exe
    C:\Temp\i_ywqoigbytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3428
- - C:\Temp\vtqlidbvtn.exe
    C:\Temp\vtqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2880
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4408
- - C:\Temp\i_vtqlidbvtn.exe
    C:\Temp\i_vtqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnlfdaysp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\vpnlfdaysp.exe
    C:\Temp\vpnlfdaysp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4584
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2668
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnlfdaysp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4340
- - C:\Temp\i_vpnlfdaysp.exe
    C:\Temp\i_vpnlfdaysp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3364
- - C:\Temp\fdxvpnhfax.exe
    C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3904
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6000
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6132
- - C:\Temp\i_fdxvpnhfax.exe
    C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmhfzxrp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:572
- - C:\Temp\ausmhfzxrp.exe
    C:\Temp\ausmhfzxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1804
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmhfzxrp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1904
- - C:\Temp\i_ausmhfzxrp.exe
    C:\Temp\i_ausmhfzxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuspkhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1680
- - C:\Temp\wuspkhczus.exe
    C:\Temp\wuspkhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4816
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5768
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuspkhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3132
- - C:\Temp\i_wuspkhczus.exe
    C:\Temp\i_wuspkhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uomgezxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5256
- - C:\Temp\uomgezxrpj.exe
    C:\Temp\uomgezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1468
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5808
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uomgezxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2020
- - C:\Temp\i_uomgezxrpj.exe
    C:\Temp\i_uomgezxrpj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrljebwto.exe ups_run
  2⤵
  PID:4140
- - C:\Temp\wtrljebwto.exe
    C:\Temp\wtrljebwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrljebwto.exe ups_ins
  2⤵
  PID:6064
- - C:\Temp\i_wtrljebwto.exe
    C:\Temp\i_wtrljebwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\eywqolgeyw.exe ups_run
  2⤵
  PID:4228
- - C:\Temp\eywqolgeyw.exe
    C:\Temp\eywqolgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_eywqolgeyw.exe ups_ins
  2⤵
  PID:2972
- - C:\Temp\i_eywqolgeyw.exe
    C:\Temp\i_eywqolgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaywqolge.exe ups_run
  2⤵
  PID:2280
- - C:\Temp\igaywqolge.exe
    C:\Temp\igaywqolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1236
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5928
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaywqolge.exe ups_ins
  2⤵
  PID:476
- - C:\Temp\i_igaywqolge.exe
    C:\Temp\i_igaywqolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qkifdbvtnl.exe ups_run
  2⤵
  PID:5528
- - C:\Temp\qkifdbvtnl.exe
    C:\Temp\qkifdbvtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qkifdbvtnl.exe ups_ins
  2⤵
  PID:3068
- - C:\Temp\i_qkifdbvtnl.exe
    C:\Temp\i_qkifdbvtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5356
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vpnkicavsn.exe ups_run
  2⤵
  PID:5696
- - C:\Temp\vpnkicavsn.exe
    C:\Temp\vpnkicavsn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1928
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vpnkicavsn.exe ups_ins
  2⤵
  PID:5892
- - C:\Temp\i_vpnkicavsn.exe
    C:\Temp\i_vpnkicavsn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fcxusnkics.exe ups_run
  2⤵
  PID:4848
- - C:\Temp\fcxusnkics.exe
    C:\Temp\fcxusnkics.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fcxusnkics.exe ups_ins
  2⤵
  PID:3708
- - C:\Temp\i_fcxusnkics.exe
    C:\Temp\i_fcxusnkics.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\khfzxrpnhe.exe ups_run
  2⤵
  PID:864
- - C:\Temp\khfzxrpnhe.exe
    C:\Temp\khfzxrpnhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4548
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4932
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_khfzxrpnhe.exe ups_ins
  2⤵
  PID:1744
- - C:\Temp\i_khfzxrpnhe.exe
    C:\Temp\i_khfzxrpnhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\upmhfzurmk.exe ups_run
  2⤵
  PID:5276
- - C:\Temp\upmhfzurmk.exe
    C:\Temp\upmhfzurmk.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1444
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_upmhfzurmk.exe ups_ins
  2⤵
  PID:2252
- - C:\Temp\i_upmhfzurmk.exe
    C:\Temp\i_upmhfzurmk.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5516
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgebwtrpjh.exe ups_run
  2⤵
  PID:2924
- - C:\Temp\mgebwtrpjh.exe
    C:\Temp\mgebwtrpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgebwtrpjh.exe ups_ins
  2⤵
  PID:4796
- - C:\Temp\i_mgebwtrpjh.exe
    C:\Temp\i_mgebwtrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5876

C:\Temp\czurmkecwu.sys
C:\Temp\czurmkecwu.sys
1⤵
- Executes dropped EXE
PID:4764

C:\Temp\jhezwrojhb.sys
C:\Temp\jhezwrojhb.sys
1⤵
- Executes dropped EXE
PID:5208

C:\Temp\lgeywqojgb.sys
C:\Temp\lgeywqojgb.sys
1⤵
- Executes dropped EXE
PID:6020

C:\Temp\ljdbywqoig.sys
C:\Temp\ljdbywqoig.sys
1⤵
- Executes dropped EXE
PID:5488

C:\Temp\gaytqljdbv.sys
C:\Temp\gaytqljdbv.sys
1⤵
- Executes dropped EXE
PID:1756

C:\Temp\vsqkidaysq.sys
C:\Temp\vsqkidaysq.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Temp\axvpnhfzxs.sys
C:\Temp\axvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:1088

C:\Temp\kfcxupnkfc.sys
C:\Temp\kfcxupnkfc.sys
1⤵
- Executes dropped EXE
PID:3380

C:\Temp\ecwupmhfzx.sys
C:\Temp\ecwupmhfzx.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\zurmjecwuo.sys
C:\Temp\zurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:4796

C:\Temp\wuomgebzwq.sys
C:\Temp\wuomgebzwq.sys
1⤵
PID:4804

C:\Temp\ljgbywrljd.sys
C:\Temp\ljgbywrljd.sys
1⤵
PID:1064

C:\Temp\rljdbvtolg.sys
C:\Temp\rljdbvtolg.sys
1⤵
PID:1228

C:\Temp\nlidayvqnl.sys
C:\Temp\nlidayvqnl.sys
1⤵
PID:4848

C:\Temp\fdxvqfaxsq.sys
C:\Temp\fdxvqfaxsq.sys
1⤵
PID:5944

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
PID:5208

C:\Temp\nhfzxusmkh.sys
C:\Temp\nhfzxusmkh.sys
1⤵
PID:5368

C:\Temp\wuomhezxrp.sys
C:\Temp\wuomhezxrp.sys
1⤵
PID:5300

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czurmkecwu.sys

Path C:\Temp\czurmkecwu.sys
Size 141KB
SHA256 3899455d96b8698396ce787883709cadfbdb77dcda364dfb19abc3b4186b3975
MD5 fc8cfec191179ca565e3e1e3fa355119
SHA1 c1c7e36418d6488ee80d2e3af2530b5c7ace090b
SHA512 5395fa8e760c944581da2f655f36221842c87b077ae1e252e694d0f9ad08c7a1858840165c7ec1c4f16782059461c251dd1e949b4b42e1fcc991eba90e5adfd6
SSDEEP 1536:Ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T109E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaytqljdbv.sys

Path C:\Temp\gaytqljdbv.sys
Size 141KB
SHA256 789e6c6b046164f32eb0d063ffdfd5b9c80d56c184d960f0590a32850adfed08
MD5 11db7c48411ca49f1b0b95cf689453cb
SHA1 93ff152b3d01a65614ba2cd1688aac92aeea3df0
SHA512 3248654babc02e6a2f70371dc318f0e77c749144b241df341293c5eebf79ef09f1ada258a2d7f5b5d3c5896a2b120e65da224b9ffd2979ae799618760185be6f
SSDEEP 1536:va3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:va3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16DE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lgeywqoigb.exe

Path C:\Temp\i_lgeywqoigb.exe
Size 243KB
SHA256 fb2cb69dbddc4caf3bd86a0a4f47ebada09cbd2847dd490ed9d0f2ada295f58f
MD5 933e570b9d488ac7f16ead335dc93d5b
SHA1 fab2fc8859e56cf2406214178ef11eaafd97e419
SHA512 d000bf3c74a35c0c6b74148c039454a5bdfdb1e3f230b8627559956960a1c7c78141dc671e60da96b87d5376db080cefd3f99b9c022c9ecc5a4bafc654c33596
SSDEEP 3072:qhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA70:2n7nLQka3lLNngoqRttA70
TLSH
T1C234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mgezwrpjhb.exe

Path C:\Temp\i_mgezwrpjhb.exe
Size 243KB
SHA256 4472839507872279d99a30a9b3324536f7879ec86ef8d2844e991683b1877054
MD5 1c0ef808c487d7abb89cde5ad676bf6d
SHA1 6ccc5d014cdfbde61b37ad3ca9d298cba00cbe96
SHA512 75166c972556a0bed83033247e092c5d666f0d2c3b8ec410ca9a95398f736df087b08b77d3c42bb6fdf61a13630798bf209b1bc7882097bc136e904fa3b10ffb
SSDEEP 3072:Rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:fn7nLQka3lLNngoqRttA77
TLSH
T13334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpjhfzxrpm.exe

Path C:\Temp\i_rpjhfzxrpm.exe
Size 243KB
SHA256 b251bad6d050ce5c7c93f678137d69ce95625f143801c1dd9cf787cccc185a1d
MD5 bc3d83b4e08144aa373e0f3723afe06e
SHA1 3bf1876825b9f4acba26388da0da50bc9f97d4df
SHA512 85894925a984105abfb54ab8ed9452e8b1b0193c94bc4f2635f8a966d3c96afc4b38bb736db20da29c400023679f5649e0994d01b9666fe845e70d3bbbef3215
SSDEEP 3072:BYhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/k:Cn7nLQka3lLNngoqRttA78
TLSH
T16734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqlidbvtn.exe

Path C:\Temp\i_vtqlidbvtn.exe
Size 243KB
SHA256 34c477588a213afc488564fe17104310c7dbc83abe3f34e9234fb18f006d9cc0
MD5 fcdec2e47d419e6ce667c6b71a51c5bd
SHA1 95f679e4a848ee68a91bfe7bc3b44d68aed589d1
SHA512 540b2bd659120fc4cb40ce9d598535ee787acce4c821b1f7e2f4935e3beda2594200b08470e8fe8cd232bdac391b1fe0bae9da14d46e57f8e67e0b66fe44339e
SSDEEP 3072:ehn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7w:Cn7nLQka3lLNngoqRttA7w
TLSH
T11234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywqoigbytq.exe

Path C:\Temp\i_ywqoigbytq.exe
Size 243KB
SHA256 ae934c63ca24fa00e2763fe0b860519bf6a2ad9d3ed56d631ad965d1807410c7
MD5 5826302032392fbc0b9f043c854c87e3
SHA1 fd5b79a7488c136dd89fe7a98b6d040dd0f4bf72
SHA512 2a31e52a43be4f4893b8b50c90972fbf2911829efeb6c3c6bd44dd33d86943da6daa75b53be82d12f84b2522c4fc3f7a1106a4ab1c00621184908b0809c1a8c9
SSDEEP 3072:uhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA78:Sn7nLQka3lLNngoqRttA78
TLSH
T1D834590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zpjhczusnh.exe

Path C:\Temp\i_zpjhczusnh.exe
Size 243KB
SHA256 9c46e9e70656eaf34554e44f471acc7b62319efdcb28378d8ed940eccbcb5d04
MD5 5c2f1ae58986236c8ca84cac8a99037e
SHA1 6cd633c960545c446ed76c204e0a1e531b0d2992
SHA512 116c7bc3ca80921273d0dc1d4ea4cc6953d01cf80431dee2f558b3f72d8aa6e9480dd4f6d0baed6bd45aab5e35bafa58e1be4ee2250c2a78bef8d7f1948704d8
SSDEEP 3072:Xhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7h:Rn7nLQka3lLNngoqRttA7h
TLSH
T1B034590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhezwrojhb.sys

Path C:\Temp\jhezwrojhb.sys
Size 141KB
SHA256 5b6b5c4e38debc2a2e7821e38252760aeab7e6b14257053cfe5affe2d291a1f1
MD5 190176a6963075f40fc3ef4a83ba3733
SHA1 0032359f51055b8ad92f5a7218a3cc86482bc7f9
SHA512 6564ca44b4b278ae50f57240a2e50d6dfdbf514d34e826c38d8a69d32575f5de1d6728b6aff055e8cc433bb786f80a1a0a8075fe54104699edf03b035937841d
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T129E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqoigb.exe

Path C:\Temp\lgeywqoigb.exe
Size 243KB
SHA256 c639a4d3bc946b4d14bd95b65a8e5e26f481ec0136c8e1a1e8be30fc9f83127b
MD5 e64a1a1b3b5d9148a75a453c2b77e036
SHA1 5db74390ccac711faeb7651f67754e3c942bccf3
SHA512 42d6518573f46cd5ce22c0a62d04ed63a9ccfc0290c733a9e2eaa0138d9e75cc5b34cafaf11d45f34a5979ff9fd949fb7834fc0fc239cc2c42b3fd3c85c54b59
SSDEEP 3072:Yhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7+:gn7nLQka3lLNngoqRttA7+
TLSH
T12434590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lgeywqojgb.sys

Path C:\Temp\lgeywqojgb.sys
Size 141KB
SHA256 882abbb19c7aa138a45e33a28b8390c331625618a169674dd88371327e715fe0
MD5 c30bcfa78a5e2986d3eae710392e85c4
SHA1 4a42f3fc55da009811b066c63294050ba5b9efbb
SHA512 255da80b749b32e4b47790485180131605de93704e57bc225c54951c80970397227b5d1e09eef188b92fbd6588294b76d5ccdb114169093a48d54530efb8e6d3
SSDEEP 1536:La3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:La3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E1E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbywqoig.sys

Path C:\Temp\ljdbywqoig.sys
Size 141KB
SHA256 59e01e5601fac27081446d20f4252ab3cd5db10125180fd4f325cf304b44abb2
MD5 5e17419aaf74dc23178be9e6e091967f
SHA1 8920a7f4b174c92c303c261c2b8c0363230868a6
SHA512 ba5eb7b6c22f7e8d377e9b3eeaeb59c7eced0d98b3d67aa5ffa56f16055cadb0267c563ba5aa95933fd3442f170f40db04703b22b5980e6b2a92fc53dcbb15e2
SSDEEP 1536:Za3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Za3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T184E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgezwrpjhb.exe

Path C:\Temp\mgezwrpjhb.exe
Size 243KB
SHA256 25cf25846e65dd0ae6bb1e73eda30d9ec8567590013a2749e9800e98c166ef4e
MD5 c9d31b92dda77394adb22ea052c9590a
SHA1 8623dab3fe4a83a9f618351fd798f049eb02f848
SHA512 f0474f6b0c032f5e13b9ce99772773184d47af2c744fd6fb69491c933765e16e9b1c10b04ddcb7f8bd13c921fe291a72e51d39ee4ebe8c7351fd753531c7e448
SSDEEP 3072:yhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7Y:un7nLQka3lLNngoqRttA7Y
TLSH
T1B334590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhfzxrpm.exe

Path C:\Temp\rpjhfzxrpm.exe
Size 243KB
SHA256 023bd3a43a576e18aa49adf80737deb288ed8133abe644185913fa09e85f4937
MD5 d0413457e3633c64b202aa397f0373b7
SHA1 ce1b9a35ea8b58ef0ce4f51484374ebad88ca165
SHA512 40f1cf3785ec7d90feda029cfe0df6b8a76bf2fad9f255d5b851358079deca84d3e4875fc571e1e674b9f59e3e69df4104720cd01b973feb84e9eb3268753e00
SSDEEP 3072:rhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:tn7nLQka3lLNngoqRttA71
TLSH
T1D734590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqlidbvtn.exe

Path C:\Temp\vtqlidbvtn.exe
Size 243KB
SHA256 ee2dae996f0b1dee317c0a4ab8ada186346e31916672d268ad571be80f630819
MD5 9cfae7ddd21b7da4a595f4672ee6fb0e
SHA1 d77af45c08c2c0c308dc1072e0edc5c39612a95d
SHA512 e9c3030e65e7e4f6201deec5ba7dedbe18df338fa1acca86be06276211ebb3b509503edde14a118a6dad89a20d9eaa6ee61c1b8f8212e4ff26d56248ef19f93d
SSDEEP 3072:Ahn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7S:4n7nLQka3lLNngoqRttA7S
TLSH
T18234590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytq.exe

Path C:\Temp\ywqoigbytq.exe
Size 243KB
SHA256 c3635c5cbf31037e7418066e4c8fa29b90169ceb8fa291c3ea5bb0cf0ec52451
MD5 21a241df12791cd84ce567e1cb299d50
SHA1 cf95bae583c8cf0fa13b1a3ada50df3be3844027
SHA512 d61a7fcafc20fc905bd8a7325e842b18db9f82825a656502add2a94adeb4696ae73520701af682dfba4193403b5ebdd89e949fb33a8cfa577641badcac4a7610
SSDEEP 3072:phn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:nn7nLQka3lLNngoqRttA7D
TLSH
T13134590272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zpjhczusnh.exe

Path C:\Temp\zpjhczusnh.exe
Size 243KB
SHA256 5d7269e270e5d92cd2a1d365a7c18631753bc55a663d6976bb2db1aaf49ff12b
MD5 dc44a2ef5a831499cc1f1dc8ef5d72c0
SHA1 d1efdaf7efe112716f687d1e90d0cd73d4bcc5c6
SHA512 727f5d48502c3d2603d8560c4cbdacd5d75b2db8a4baaf1b41955a49a426338503f6096ec0d483aafac2d0f0b81425cae47946e3cd4de42f5df5aee248c18fe4
SSDEEP 3072:Zhn7nLFKJh7/7yra3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7f:Xn7nLQka3lLNngoqRttA7f
TLSH
T14034490272818031E75A0B78055AE7A1467E7D384BA5E5CFF7A83F791A312D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8ab4a8ac15a7a324139852cb4cb0241350dc66b26182fd38fee1e65d57a93860
MD5 7d6336b8865899882aacaead194cf51d
SHA1 329f81d4348867a4fa09ebbc9231d1ae08712f52
SHA512 5b97b04521966af50fe21075235bcaf1b654c0a4c20f329f6e8ecc7bab5038f239cca9cbed957a0a488c29b15aae79132edc4e9a94d83ce2bb4c64e9734a0d8c
TLSH
T1F64177644B6209DFE7A649B907F140BA32F5BC7E830BDEDD1290ADBC0542F2361E605B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0eef26b04f8e1fea2c49c0aceca827af236775971da1c14e5f52075699ca68fb
MD5 c029c8c8001e3a9d70c149318cf8ac70
SHA1 f6055584857ab62e32f432bb1209bbcdfc07e8b1
SHA512 f209500d7b40ada0f3c46c4fd85f03be7194f3a140121dfcc5b2914fe1f04f6c7d1f3842af7478e95070a4bfd40e83ad1b333e6762a54a6c18453adc4106453d
TLSH
T11A419DF7C3E8856D890156F0BA146E2BCE2D0915432C7D5AC9E4AF2B93E3472E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ab7de772-f3a1-47de-8d37-ad5c57aab3d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab7de772-f3a1-47de-8d37-ad5c57aab3d8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 014df54ce62c66d5a29794edac0fcb6e5fa45ea63b9a9d5309e198707fcbf7ea
MD5 d93bca9838d5c55feef3f54526310b05
SHA1 752a8681180a275120780584f35c30bb24b64377
SHA512 83a77046598ceba3b6ed646af0d16eec5bb5891c79bc13982f1e5011bab993601c065eb2570ec13bcb994a835c4db077dedbeb2e27d1dc2a32eba95cbbf9936b
SSDEEP 192:sxR+7RRC5v/ftHsvxZv8ZFOszoA8p9U/g6+WNCSg/Yo9G3YdGTIgDSsIiJ:sxR+7K5v/fdsvXvCYdC/5s/ELv
TLSH
T1D342C916AE78993B5CC7D21DFB557F53D2F96032A0952E48A6FC8A1C04E7ACD230B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 407788b5063348349afa77f0d61c2e276b29981dbfcf8776e4bd31f5dd03c1a5
MD5 5822b6098489df2dab3c322f42e2d277
SHA1 35a1dab1faae07c0c033a7bcaf887c62f846b3f7
SHA512 d79a057dfcf8d8e6958d8a7481b51f61515e8a905f487fd704e657a4c3cb4194efe4b5a9418864bce71c212dd693b01dada3ff6889a2eff08a219d209808f185
SSDEEP 192:sxRn7RRC5v/ftHsFxFv8ZFOszoA8p9U/g6+WNCSg/YoNI3YdGTIgVsIiJ:sxRn7K5v/fdsFPvCYdC/5s/aLo
TLSH
T1EB42B9166E78A93B5CC7D21DFB557F53D2F92032A0D56E48A6FC8A1C04E6ACD230B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b220dfc68579e15bf4de749a25740aa265829c886cbdc5a6ffbcee1b0e795c77
MD5 1487ff551043aed92b169c6e36c1ada9
SHA1 58370584e0c9a19e76e695933c4627c1558de31e
SHA512 49acbe7cf1fc1cdca86b1a171b466ca74909216380dd9d52a9c8ec38295ed45888d3b5fb134cf849e1deaa00431f950a0dae624640362ca5a3ca744932f4aad5
SSDEEP 192:sxR+7RRC5v/ftHsvxFv8ZFOszoA8p9U/g6+WNCSg/YoNI3YdGTIgDAsIiJ:sxR+7K5v/fdsvPvCYdC/5s/aLh
TLSH
T1C142B9166E78993B5CC7D21DFB557F53D2F92032A0D52E48A6FC8A1C04E66CD230B41B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 7f541215374e0e523557b42de38e34c792030e08617222084b5fa6f1955d04c0
MD5 bd26283623af49d0248c12525fb857a0
SHA1 66b649d103adf1a3f40c15fc99919abe76cd1ba3
SHA512 de440046e9210948614678e9535a8d071f86d320c6d9fa9a615ee4bcafc4e70c63a1ff1de6817aa070e3a0d10d8d008c4624716fdda95993db389bc66ecb969d
SSDEEP 768:j26Hkh7pLuLz6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVh6BVuw8ro91e0/:j26HkXEz6RWgs2f02u1ja66B4wnQE
TLSH
T18BD2DB7B640DCABF4F800ADDDC197E9F6D6802CB9698CD8447FE941C02C6BEA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d3c5dfc244b3d6b5a567fd44b949e2ef8b51e5fe5c2b380d4c312222122f5bd7
MD5 590ee7f0bcd843beed23b69432952fc8
SHA1 55cc1f33ad454d03b054a6d8ca0d386c4dd0846b
SHA512 62aaba9527698621fc17aebc435f849839c8f6845646f79e810dfad2b68fd2d112f749d040dd693e264aef1d095bb3555e89cfe4a74ca78770d42b3d45d928d2
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUn5WISWkF:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpLE
TLSH
T11D91520431BE52C03C7FEA4D82E5986A93C274A63615E42B7BB805A74F67E135DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59f12c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59f12c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 c8e3b11b7cba53c65811fbaa9c0d1fc1984e866834ff1ce533382f15908842e3
MD5 20aea449f7ebd35e95824385ecfc9505
SHA1 83a59bc45952ae24bf4beb82b84527a232e52258
SHA512 4e1191cba98dab5b2742b667b860c23a73968141c7fa22cb0360cbb10132c4737b5e3c2a3a2ccee7fd3b531654677f2ba3ce7e9d214970ff5003eaccfe3237cc
SSDEEP 768:Mrv+4UNbdO3HSfZNb/TBOWMUtm0St8ONXyer1IRCzni9tVyLCG:MbsbE3HSfBSIqn+iJ
TLSH
T13B03BF32A698DE338CF2E295F18777837FF8206384C40694EAD62B4D059799E270F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e4f94d3f643b3ac0bf64aa920051a7e695a8779ee228b1e5f8b9fea0c5dc52eb
MD5 cfe39fd1a45a4053cb7ffe26325c91f5
SHA1 13c2ed38aedf49ce287b69685840d2417a865fac
SHA512 723c6da813c2269d9142c35b55777b05786f35448dbadb3b9aa609cb86b752fd336d6ad925fe26fdee06c6e51f65a88e422738c2a0a6ce1bb95ee5991cf3f4cd
SSDEEP 768:ZB38SfaNb/TBOWMUtm0SteONXyer1IRCzni9tVyLCDs:ZB38SYNSIqn+iKs
TLSH
T126F2B071AA919D334CF5E3D6F2477383AEF42063C4C85A50EADA6B1E0593A5E270F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7b1438c71f64a225dcbc7132a186389c1a0752984f3b8451768e774aeb7d9d07
MD5 06e3a7319a7b5931781ad0acd8cce6ac
SHA1 262e2854b36fda6869e3cc8c99c1adb954c57844
SHA512 ab57d146ffc40e61fead25dfa1381f290b4e2674b77d334c24fe77ae89aa1dd18c78a0e597d825aa331b289ebffbd86c5ca1f8ee18aa64f42a518404238cb263
SSDEEP 768:hrv+4UNbdz3Hc/TBOWMUtm2ONXyer1IRCzniBOeVH1SK7:hbsbV385SIqnREH1l
TLSH
T11E03CF32A5949E338DE2A3D6B047B2437FB86057C6840790E9DE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 3bf3844fb45fe587bf0b4920f4aa96af04154a786572e48ffaba87ace6dba2b3
MD5 a2d36a023e33308b00b3ac3f4f741528
SHA1 b46c66784a0ea54c1f964e29d6df666337cf7d09
SHA512 ed3ce8101b8ccff89bad7c1d295d1aba7ecb2279872ac7f75b4eb83538d5983f8228b2fb91befa0065c5c48bbed5b47dc9efe3e4d726d4c59e9079532b1904e4
SSDEEP 768:xFQP3JwgySfkN8xsOWMUtm0StTONXyer1IRCzni9tVyLCDs:AP3qSFjSIqn+iKs
TLSH
T1F01328F699D38937D8AD9383A37D6E469DBCD063B4889480B7D51E0DCC825BFD30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bdc45bbc019c810646ef4674b1a0c5e6a0dbeb17139611585316768011097c3a
MD5 5de138ba75f25202eabfebffcc302496
SHA1 d040f9c91d486e02d552fa0e2ef1275184849fdb
SHA512 30a7cd0e985012632cb9d49aff9a404e115030820677e32fad957f620861a3a3eb8edb6c054ecba2dd914c56a1551bbe718894c32b0c5065d4eb129b7edc91c9
SSDEEP 768:oB3HSfaNb/TBOWMUtm0SteONXyer1IRCzni9tVyLCDs:oB3HSYNSIqn+iKs
TLSH
T1F2F2B071AA919D334CF5E395F2477383AEF42063C4C85A50EADA6B1E0593A5E270F817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 7cd09d128e97cc3f22bf7126a393b5f40522fb53a1dd2bdc06420a886b7ff620
MD5 f68e5cb89fda14cc80b29536b5fbd7de
SHA1 fa00e0fa7fba74194ee07c3b1b076723d3777601
SHA512 b6f03f513fe6d897e186e6c41cf54cab7bc56412a03533f85024a4a0772d727325dfed6b177ba67ba156f6df5f18da159984a708411c8309e6e982839c0fa28c
SSDEEP 768:mrv+4UNbdz3vNJ/TBOWMUtm0St8ONXyer1IRCzniwteVH1SK7:mbsbV3XBSIqnhEH1l
TLSH
T17F03B032A598DE334DF2A396B047B3837FB82067C5840A90E9DA1F4D059759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

6bc92920-1968-407b-9b8c-7fc3f013a4fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6bc92920-1968-407b-9b8c-7fc3f013a4fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe592d6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe592d6f.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

696698e9-01fe-449d-8f3d-79486d4ed6ae.tmp

Path C:\Users\Admin\AppData\Local\Temp\696698e9-01fe-449d-8f3d-79486d4ed6ae.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5412_409669623\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1064-635-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1068-542-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1088-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1228-639-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1756-515-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1756-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3380-562-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-718-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4764-417-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4796-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4804-607-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-672-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4848-659-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4952-566-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-675-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5208-495-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5300-701-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5368-697-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5488-502-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5488-537-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5944-670-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6020-489-0x0000000000010000-0x0000000000083000-memory.dmp

Download