710cd211198075feb17ebf841fc72d97cb9e7b7108e625890b89c47a852c3598

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 00:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe
Size 243KB
Sample260831-adap8adh95
SHA256 710cd211198075feb17ebf841fc72d97cb9e7b7108e625890b89c47a852c3598
MD5 fc2f9c4ca06ed809c54d6f5e403030fd
SHA1 968d09803a763be3ae5e24366ce87c50f21e873f
SHA512 db037c01870416e9312c481fe75915bdb8c3e7cd01de183cebdf12d0c7c776e243fbf3c5ee62d9a1629ed94283a633917117c85a4f5bb7fc615ef2166371abe1
SSDEEP 3072:b2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA77:bwD99LB68zowa3lLNngoqRttA77
TLSH
T111345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3924	CP.exe
3300	jebwuomhbw.exe
3636	CP.exe
6116	CP.exe
2108	i_jebwuomhbw.exe
5028	igeywqojge.sys
3192	CP.exe
5944	dbztrljgbv.exe
1504	CP.exe
3496	CP.exe
5544	i_dbztrljgbv.exe
4872	ywqolgdyvt.sys
5288	CP.exe
4364	tqlidbvtqo.exe
480	CP.exe
5892	CP.exe
2940	i_tqlidbvtqo.exe
3528	aytqlidayv.sys
1160	CP.exe
5496	qnlfdavsnl.exe
1988	CP.exe
5160	CP.exe
2724	i_qnlfdavsnl.exe
2948	axvpnicays.sys
5904	CP.exe
528	sqkicavsnk.exe
1400	CP.exe
3260	CP.exe
1084	i_sqkicavsnk.exe
5232	snkicaxspn.sys
6052	CP.exe
2560	usnkiczxvs.exe
4320	CP.exe
3844	CP.exe
1428	i_usnkiczxvs.exe
1116	cxusmkhczx.sys
4948	CP.exe
2108	caxrpkhcau.exe
1980	CP.exe
3672	CP.exe
1332	i_caxrpkhcau.exe
1976	rpkhczusmk.sys
3920	CP.exe
3424	hezxrpkecw.exe
5356	CP.exe
4428	CP.exe
1344	i_hezxrpkecw.exe
2972	uomjecwurm.sys
5268	CP.exe
1536	ojhbztrmje.exe
5424	CP.exe
2816	CP.exe
2940	i_ojhbztrmje.exe
4524	ljebwtomge.sys
4848	CP.exe
1408	dbwtomgezt.exe
5616	CP.exe
6128	CP.exe
3220	i_dbwtomgezt.exe
2680	dbytroigay.sys
4836	CP.exe
2948	bvtolgdywq.exe
5788	CP.exe
5040	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_250767684\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_521298767\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_250767684\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_291924731\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_291924731\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_1680_276846020\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1680_370738705\_locales\ja\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwuomhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhcausmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usnkiczxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtomgezt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqnigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqnigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwuomhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqlidbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xjhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usnkiczxvs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhcausmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xjhczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljgbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgdywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbzurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtomgezt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4168	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5552	ipconfig.exe
2160	ipconfig.exe
1980	ipconfig.exe
3352	ipconfig.exe
2828	ipconfig.exe
3240	ipconfig.exe
936	ipconfig.exe
5240	ipconfig.exe
4628	ipconfig.exe
2336	ipconfig.exe
4548	ipconfig.exe
1060	ipconfig.exe
5152	ipconfig.exe
2344	ipconfig.exe
236	ipconfig.exe
4668	ipconfig.exe
5568	ipconfig.exe
248	ipconfig.exe
3420	ipconfig.exe
2364	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326083250594150"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{42D021EF-74E7-4C1A-82B1-573CB1D6C625}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2108	i_jebwuomhbw.exe
Token: SeDebugPrivilege	5544	i_dbztrljgbv.exe
Token: SeDebugPrivilege	2940	i_tqlidbvtqo.exe
Token: SeDebugPrivilege	2724	i_qnlfdavsnl.exe
Token: SeDebugPrivilege	1084	i_sqkicavsnk.exe
Token: SeDebugPrivilege	1428	i_usnkiczxvs.exe
Token: SeDebugPrivilege	1332	i_caxrpkhcau.exe
Token: SeDebugPrivilege	1344	i_hezxrpkecw.exe
Token: SeDebugPrivilege	2940	i_ojhbztrmje.exe
Token: SeDebugPrivilege	3220	i_dbwtomgezt.exe
Token: SeDebugPrivilege	5964	i_bvtolgdywq.exe
Token: SeDebugPrivilege	2372	i_ayvqnigayv.exe
Token: SeDebugPrivilege	1960	i_lfdxvqnlfd.exe
Token: SeDebugPrivilege	1428	i_fdxvpnhfax.exe
Token: SeDebugPrivilege	3576	i_mkhcausmhf.exe
Token: SeDebugPrivilege	4968	i_xjhczurpjh.exe
Token: SeDebugPrivilege	4464	i_mjhbzurmjh.exe
Token: SeDebugPrivilege	4788	i_rmjecwuomg.exe
Token: SeDebugPrivilege	3168	i_qoljdbywto.exe
Token: SeDebugPrivilege	5488	i_gaytqljdbv.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4952	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	89
PID 4952 wrote to memory of 1680	4952	iexplore.exe	90
PID 1680 wrote to memory of 2856	1680	msedge.exe	91
PID 1680 wrote to memory of 1432	1680	msedge.exe	93
PID 1680 wrote to memory of 4168	1680	msedge.exe	94
PID 1680 wrote to memory of 1432	1680	msedge.exe	93
PID 1680 wrote to memory of 1432	1680	msedge.exe	93
PID 1680 wrote to memory of 372	1680	msedge.exe	95
PID 1680 wrote to memory of 372	1680	msedge.exe	95
PID 1680 wrote to memory of 1172	1680	msedge.exe	96
PID 1680 wrote to memory of 2876	1680	msedge.exe	97
PID 1680 wrote to memory of 1172	1680	msedge.exe	96
PID 1680 wrote to memory of 1172	1680	msedge.exe	96
PID 1680 wrote to memory of 2876	1680	msedge.exe	97
PID 1680 wrote to memory of 2876	1680	msedge.exe	97
PID 1680 wrote to memory of 1080	1680	msedge.exe	98
PID 1680 wrote to memory of 1080	1680	msedge.exe	98
PID 1680 wrote to memory of 1080	1680	msedge.exe	98
PID 1680 wrote to memory of 1084	1680	msedge.exe	99
PID 1680 wrote to memory of 1084	1680	msedge.exe	99
PID 1680 wrote to memory of 1084	1680	msedge.exe	99
PID 1680 wrote to memory of 5972	1680	msedge.exe	101
PID 1680 wrote to memory of 5972	1680	msedge.exe	101
PID 1680 wrote to memory of 2888	1680	msedge.exe	102
PID 1680 wrote to memory of 2888	1680	msedge.exe	102
PID 1680 wrote to memory of 4488	1680	msedge.exe	103
PID 1680 wrote to memory of 4488	1680	msedge.exe	103
PID 3572 wrote to memory of 3924	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	104
PID 3300 wrote to memory of 3636	3300	jebwuomhbw.exe	107
PID 1680 wrote to memory of 5820	1680	msedge.exe	111
PID 1680 wrote to memory of 4572	1680	msedge.exe	112
PID 1680 wrote to memory of 4572	1680	msedge.exe	112
PID 1680 wrote to memory of 1856	1680	msedge.exe	115
PID 1680 wrote to memory of 1856	1680	msedge.exe	115
PID 1680 wrote to memory of 2560	1680	msedge.exe	116
PID 1680 wrote to memory of 2560	1680	msedge.exe	116
PID 1680 wrote to memory of 1780	1680	msedge.exe	117
PID 1680 wrote to memory of 1780	1680	msedge.exe	117
PID 3572 wrote to memory of 6116	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	118
PID 3572 wrote to memory of 3192	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	122
PID 5944 wrote to memory of 1504	5944	dbztrljgbv.exe	124
PID 3572 wrote to memory of 3496	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	127
PID 3572 wrote to memory of 5288	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	131
PID 4364 wrote to memory of 480	4364	tqlidbvtqo.exe	133
PID 3572 wrote to memory of 5892	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	136
PID 3572 wrote to memory of 1160	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	140
PID 5496 wrote to memory of 1988	5496	qnlfdavsnl.exe	142
PID 3572 wrote to memory of 5160	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	145
PID 1680 wrote to memory of 3732	1680	msedge.exe	148
PID 1680 wrote to memory of 3424	1680	msedge.exe	149
PID 1680 wrote to memory of 3668	1680	msedge.exe	150
PID 3572 wrote to memory of 5904	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	153
PID 528 wrote to memory of 1400	528	sqkicavsnk.exe	155
PID 3572 wrote to memory of 3260	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	158
PID 3572 wrote to memory of 6052	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	162
PID 2560 wrote to memory of 4320	2560	usnkiczxvs.exe	164
PID 3572 wrote to memory of 3844	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	167
PID 3572 wrote to memory of 4948	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	171
PID 2108 wrote to memory of 1980	2108	caxrpkhcau.exe	173
PID 3572 wrote to memory of 3672	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	176
PID 3572 wrote to memory of 3920	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	180
PID 3424 wrote to memory of 5356	3424	hezxrpkecw.exe	182
PID 3572 wrote to memory of 4428	3572	2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe	185
PID 1680 wrote to memory of 3224	1680	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_fc2f9c4ca06ed809c54d6f5e403030fd_elex_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffc83cbc188,0x7ffc83cbc194,0x7ffc83cbc1a0
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1972,i,15061114580357542899,13486598455934516096,262144 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,643783151782868576,8372623972418551173,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
      4⤵
      System Time Discovery
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2712,i,10861666325772472550,5682891875576645310,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:13
      4⤵
      PID:372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,16852078235960810625,3507949763119824805,2097152 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
      4⤵
      PID:1172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,5671241745672778933,1248280793781721871,2097152 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
      4⤵
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,10073307952881207189,222888297057835097,2097152 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,14266945185918839669,4320745353917322873,2097152 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:1084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,5258454861113337162,2939051112858666034,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,6146320138190202080,8958512677626199369,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,10710133156856948960,15786355102400189227,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:14
      4⤵
      PID:4488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17371906154870475051,6728864463715504351,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:2784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,17371906154870475051,6728864463715504351,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16468481864580062356,7643136905980625315,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,16469974455174135733,7673068604061007471,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:1856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,12711739526694688196,10746401914595808350,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:2560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,1798069602260279035,11120417644424361330,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,10811178183151827450,3137133027553370902,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=1200 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,15054377226658271033,4174358623186663565,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:14
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,4366336093940304754,425759042903001498,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
      4⤵
      PID:3668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1460,i,8465672285097930212,1441891922379146170,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:14
      4⤵
      PID:3224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,9776567931726682800,9589364420315987320,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1464,i,3272950031809942261,3881495656046239099,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,16150404102521612530,7056817578950319105,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6464,i,3517668939081834440,6471053948405069197,262144 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,4445812287364959733,3032335959158998568,524288 --field-trial-handle=2560,i,3411327020398287210,7333798448343317330,262144 --variations-seed-version --mojo-platform-channel-handle=1356 /prefetch:14
      4⤵
      PID:3232
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jebwuomhbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3924
- - C:\Temp\jebwuomhbw.exe
    C:\Temp\jebwuomhbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jebwuomhbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6116
- - C:\Temp\i_jebwuomhbw.exe
    C:\Temp\i_jebwuomhbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbztrljgbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3192
- - C:\Temp\dbztrljgbv.exe
    C:\Temp\dbztrljgbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1504
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbztrljgbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3496
- - C:\Temp\i_dbztrljgbv.exe
    C:\Temp\i_dbztrljgbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqlidbvtqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5288
- - C:\Temp\tqlidbvtqo.exe
    C:\Temp\tqlidbvtqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqlidbvtqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5892
- - C:\Temp\i_tqlidbvtqo.exe
    C:\Temp\i_tqlidbvtqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1160
- - C:\Temp\qnlfdavsnl.exe
    C:\Temp\qnlfdavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1988
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5160
- - C:\Temp\i_qnlfdavsnl.exe
    C:\Temp\i_qnlfdavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2724
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5904
- - C:\Temp\sqkicavsnk.exe
    C:\Temp\sqkicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1400
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3260
- - C:\Temp\i_sqkicavsnk.exe
    C:\Temp\i_sqkicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1084
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usnkiczxvs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6052
- - C:\Temp\usnkiczxvs.exe
    C:\Temp\usnkiczxvs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4320
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4628
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usnkiczxvs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3844
- - C:\Temp\i_usnkiczxvs.exe
    C:\Temp\i_usnkiczxvs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxrpkhcau.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4948
- - C:\Temp\caxrpkhcau.exe
    C:\Temp\caxrpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1980
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxrpkhcau.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3672
- - C:\Temp\i_caxrpkhcau.exe
    C:\Temp\i_caxrpkhcau.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpkecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3920
- - C:\Temp\hezxrpkecw.exe
    C:\Temp\hezxrpkecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpkecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4428
- - C:\Temp\i_hezxrpkecw.exe
    C:\Temp\i_hezxrpkecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrmje.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5268
- - C:\Temp\ojhbztrmje.exe
    C:\Temp\ojhbztrmje.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5424
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2344
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrmje.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2816
- - C:\Temp\i_ojhbztrmje.exe
    C:\Temp\i_ojhbztrmje.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbwtomgezt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4848
- - C:\Temp\dbwtomgezt.exe
    C:\Temp\dbwtomgezt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5616
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbwtomgezt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6128
- - C:\Temp\i_dbwtomgezt.exe
    C:\Temp\i_dbwtomgezt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bvtolgdywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\bvtolgdywq.exe
    C:\Temp\bvtolgdywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2948
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bvtolgdywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5040
- - C:\Temp\i_bvtolgdywq.exe
    C:\Temp\i_bvtolgdywq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5964
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ayvqnigayv.exe ups_run
  2⤵
  PID:5332
- - C:\Temp\ayvqnigayv.exe
    C:\Temp\ayvqnigayv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4524
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3976
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2336
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ayvqnigayv.exe ups_ins
  2⤵
  PID:4504
- - C:\Temp\i_ayvqnigayv.exe
    C:\Temp\i_ayvqnigayv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqnlfd.exe ups_run
  2⤵
  PID:4256
- - C:\Temp\lfdxvqnlfd.exe
    C:\Temp\lfdxvqnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqnlfd.exe ups_ins
  2⤵
  PID:3024
- - C:\Temp\i_lfdxvqnlfd.exe
    C:\Temp\i_lfdxvqnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnhfax.exe ups_run
  2⤵
  PID:3736
- - C:\Temp\fdxvpnhfax.exe
    C:\Temp\fdxvpnhfax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnhfax.exe ups_ins
  2⤵
  PID:2160
- - C:\Temp\i_fdxvpnhfax.exe
    C:\Temp\i_fdxvpnhfax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhcausmhf.exe ups_run
  2⤵
  PID:3792
- - C:\Temp\mkhcausmhf.exe
    C:\Temp\mkhcausmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5252
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhcausmhf.exe ups_ins
  2⤵
  PID:4488
- - C:\Temp\i_mkhcausmhf.exe
    C:\Temp\i_mkhcausmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3576
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xjhczurpjh.exe ups_run
  2⤵
  PID:3788
- - C:\Temp\xjhczurpjh.exe
    C:\Temp\xjhczurpjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4404
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2724
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xjhczurpjh.exe ups_ins
  2⤵
  PID:2472
- - C:\Temp\i_xjhczurpjh.exe
    C:\Temp\i_xjhczurpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbzurmjh.exe ups_run
  2⤵
  PID:2416
- - C:\Temp\mjhbzurmjh.exe
    C:\Temp\mjhbzurmjh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1176
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbzurmjh.exe ups_ins
  2⤵
  PID:6088
- - C:\Temp\i_mjhbzurmjh.exe
    C:\Temp\i_mjhbzurmjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjecwuomg.exe ups_run
  2⤵
  PID:1228
- - C:\Temp\rmjecwuomg.exe
    C:\Temp\rmjecwuomg.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5284
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1060
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjecwuomg.exe ups_ins
  2⤵
  PID:4700
- - C:\Temp\i_rmjecwuomg.exe
    C:\Temp\i_rmjecwuomg.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4788
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qoljdbywto.exe ups_run
  2⤵
  PID:1632
- - C:\Temp\qoljdbywto.exe
    C:\Temp\qoljdbywto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4332
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2700
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:936
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qoljdbywto.exe ups_ins
  2⤵
  PID:5044
- - C:\Temp\i_qoljdbywto.exe
    C:\Temp\i_qoljdbywto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3168
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gaytqljdbv.exe ups_run
  2⤵
  PID:5280
- - C:\Temp\gaytqljdbv.exe
    C:\Temp\gaytqljdbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2364
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3036
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gaytqljdbv.exe ups_ins
  2⤵
  PID:944
- - C:\Temp\i_gaytqljdbv.exe
    C:\Temp\i_gaytqljdbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2428

C:\Temp\igeywqojge.sys
C:\Temp\igeywqojge.sys
1⤵
- Executes dropped EXE
PID:5028

C:\Temp\ywqolgdyvt.sys
C:\Temp\ywqolgdyvt.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\aytqlidayv.sys
C:\Temp\aytqlidayv.sys
1⤵
- Executes dropped EXE
PID:3528

C:\Temp\axvpnicays.sys
C:\Temp\axvpnicays.sys
1⤵
- Executes dropped EXE
PID:2948

C:\Temp\snkicaxspn.sys
C:\Temp\snkicaxspn.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Temp\cxusmkhczx.sys
C:\Temp\cxusmkhczx.sys
1⤵
- Executes dropped EXE
PID:1116

C:\Temp\rpkhczusmk.sys
C:\Temp\rpkhczusmk.sys
1⤵
- Executes dropped EXE
PID:1976

C:\Temp\uomjecwurm.sys
C:\Temp\uomjecwurm.sys
1⤵
- Executes dropped EXE
PID:2972

C:\Temp\ljebwtomge.sys
C:\Temp\ljebwtomge.sys
1⤵
- Executes dropped EXE
PID:4524

C:\Temp\dbytroigay.sys
C:\Temp\dbytroigay.sys
1⤵
- Executes dropped EXE
PID:2680

C:\Temp\igaywqolgd.sys
C:\Temp\igaywqolgd.sys
1⤵
PID:5464

C:\Temp\lidxvtnlfa.sys
C:\Temp\lidxvtnlfa.sys
1⤵
PID:4332

C:\Temp\kicausqkif.sys
C:\Temp\kicausqkif.sys
1⤵
PID:5156

C:\Temp\nhfcxvpnhf.sys
C:\Temp\nhfcxvpnhf.sys
1⤵
PID:4388

C:\Temp\xupnhfzxup.sys
C:\Temp\xupnhfzxup.sys
1⤵
PID:5968

C:\Temp\usmkecwurp.sys
C:\Temp\usmkecwurp.sys
1⤵
PID:1376

C:\Temp\uomgezwroj.sys
C:\Temp\uomgezwroj.sys
1⤵
PID:236

C:\Temp\eywuomjebo.sys
C:\Temp\eywuomjebo.sys
1⤵
PID:1992

C:\Temp\ebvtqljdbv.sys
C:\Temp\ebvtqljdbv.sys
1⤵
PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axvpnicays.sys

Path C:\Temp\axvpnicays.sys
Size 141KB
SHA256 914e7718ae8bfe064245dbbe9deba95204dd1e04450b9936a516a1a7d21d49c9
MD5 00a352f0dd39b868b03db0188ec49a1a
SHA1 b42799e295feb6e2db6543ee11698ea20ce46016
SHA512 29ddf56bd72e5f0be4ff5828d12cee7b70426254402cc4aabb00a40f3ef71ebe9bcaa02706ca0d4f3ec82520adc55e23b4603392c180d872f911b0c352434900
SSDEEP 1536:Ra3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ra3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T16FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqlidayv.sys

Path C:\Temp\aytqlidayv.sys
Size 141KB
SHA256 7104e46827044fb2bd351620620b666f541ff2c346a210ff558d7e221dfb5def
MD5 a45b8612b9fad671806b235e14f13b18
SHA1 b4cd1bc4247ef94ef32b969603e3c6d9c6563c40
SHA512 dadc704bb5e2dcf06c29f3623a6aa37852c0a7a170feec6a7bbe325babd5bb11a092ebd8135f7459a983f578b9476504a24f73ddf7626cd646da5cd7cafcb675
SSDEEP 1536:+a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:+a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1D3E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljgbv.exe

Path C:\Temp\dbztrljgbv.exe
Size 243KB
SHA256 c38eea9778df61b07bb20ca452a15a1109ce36e9f86d0e15bba2831c8ae5338f
MD5 544a420554962f1a01db4ea8a73a9519
SHA1 a5d6853cfa37a6c7a3e12a945c5bfa95c428857f
SHA512 950e9a6b46de8c45629332c80eea9f8b9aee10c8a63b12a5cd80cbdfd87d83ad06846bf4f831ebe3da76599800ac3f7c472498074d02c9fa235cabdeee24be06
SSDEEP 3072:r2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7/:rwD99LB68zowa3lLNngoqRttA7/
TLSH
T172345A0172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F795A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrljgbv.exe

Path C:\Temp\i_dbztrljgbv.exe
Size 243KB
SHA256 eee6a0a9debf989e0f4a9491f09a293c36e0566fb2c3e756ba4338bbe8405f53
MD5 b7162b45e12b19687601a7f7b8bdd4c7
SHA1 4cdaa7effe8223f2aabe0a4de5c3e82251d465bb
SHA512 0a0dd5356d666c6e1da518d8311a536784f86ef73f7c796a34beb87c0a94bcbc299642a3f3683178dba9efb2ad3d13fb857d8baf3bb4a64189346367cad6cfe2
SSDEEP 3072:v2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7z:vwD99LB68zowa3lLNngoqRttA7z
TLSH
T1CA345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebwuomhbw.exe

Path C:\Temp\i_jebwuomhbw.exe
Size 243KB
SHA256 126b79212598822eae2e9a0defe907b8ce6f080e22b4a597e776218a7570945e
MD5 a77be5aeb4c72d498b723355293bc28d
SHA1 5252dfe3e4516022ef9392b882fb57aa93459fae
SHA512 ddd06349089bec68b6b9b2e4c029ca9ce0aecc6f9a092691a3aa30c4235c1273a2ed171ddf07e233495fb0b55f43cd3f43eb754329b95704a72a732f21008281
SSDEEP 3072:12z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA75:1wD99LB68zowa3lLNngoqRttA75
TLSH
T14D345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdavsnl.exe

Path C:\Temp\i_qnlfdavsnl.exe
Size 243KB
SHA256 9e5095d6e3c7a5ef2e7a42ce62b756ec31ecbf495d9563dcd2932fb4a4b15c51
MD5 f3739b12c3c3195d02144a960f220456
SHA1 94c2c996de680c59c5b190d76e6dbf4db389ce00
SHA512 77d25d1ffe3ce10264c3e1f0b8c010aa361fc47b8480362244861f5592cf67ea0443735e53c77dda721dc771d42c1e769b943e8c41cbe939b38af2e594d2e3da
SSDEEP 3072:p2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:pwD99LB68zowa3lLNngoqRttA71
TLSH
T160345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkicavsnk.exe

Path C:\Temp\i_sqkicavsnk.exe
Size 243KB
SHA256 c5668801390786ace3befe83561d0f0def025f568b5db97dfa5adb435774b06a
MD5 a8fc6034553300e14a6739b787464f7a
SHA1 89982375b1fec3518a8e4d62342641a87a689333
SHA512 56696b0a7f3efabb5e1f2c5f00a4abbc575c3e4c06a393a2a8535c006c329aabcbff3b47dafb7584842b1167051dfb1c9bc033e35c2235b9969ed114659debc5
SSDEEP 3072:/2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7P:/wD99LB68zowa3lLNngoqRttA7P
TLSH
T164345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqlidbvtqo.exe

Path C:\Temp\i_tqlidbvtqo.exe
Size 243KB
SHA256 b346575e2b3d4a36381f58102f2a3b6bcf7b62e26139961bd62e818d047fb69b
MD5 11521a3799986959083dd6d14b923c1f
SHA1 cc94887b1f36b37b79c290fa611a6165bccccbad
SHA512 ee5ca771b66b7e33a16b72ea9fd80cfe94d66b9f73a5a2a2f2672cb890745c092d28a898a1b3dce699be4d4857be872eae30b0c04812117fa6848628f84e53e8
SSDEEP 3072:P2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7D:PwD99LB68zowa3lLNngoqRttA7D
TLSH
T1A9345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_usnkiczxvs.exe

Path C:\Temp\i_usnkiczxvs.exe
Size 243KB
SHA256 689ef3270f30f5707a7f529c18e1631499a21bedd49f7b60edfbea04b4448e5e
MD5 2696923abbc9b23f8c99505a76271e5f
SHA1 2df37267a1a22c096c961a01bb5da027d0c6d698
SHA512 5ed6a6e9c7d4e56627e13ccff8bcc8327a153bc5dcb5ee5ffacd7ef2a015ff44e2ef5c76f06dff8133834fc009ef4e9a566e54a278d179a1d5e21597f3005484
SSDEEP 3072:P2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7n:PwD99LB68zowa3lLNngoqRttA7n
TLSH
T189345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igeywqojge.sys

Path C:\Temp\igeywqojge.sys
Size 141KB
SHA256 1b726df654365e5629552cb9bd5b238473e24d583504ccf1d8886283e485b817
MD5 e2736c4ba93465334f626fbe4f6bb4f0
SHA1 8ff7d15916a33345321e6fd997d48fe12740f35f
SHA512 0b8bb5591017066d52c54046589ad4049f0e74dd5bc19629c5bb175de2aa537c0746064043f517e43a31d29640496e4ba417b14a519f071c178045015f0ed337
SSDEEP 1536:Ua3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ua3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1C4E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomhbw.exe

Path C:\Temp\jebwuomhbw.exe
Size 243KB
SHA256 b6bf4178073fb4e3b7633c69e297743740d98fefbe4b24128ac1f7121823a289
MD5 d3bb4dbc4ca930082a33c6e1a8f91086
SHA1 e7949d7df6af178db75154046964ed012d927166
SHA512 2a3a61736ff26a9c4bb64e004e5b323bc3be0a2a5df2b1ff315009c51fc08af6e2b33b9148f7b6d61ab3949b2926bd595968bc10df0347ff093448d8a7c455c0
SSDEEP 3072:l2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7p:lwD99LB68zowa3lLNngoqRttA7p
TLSH
T17E345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdavsnl.exe

Path C:\Temp\qnlfdavsnl.exe
Size 243KB
SHA256 66855f18fb37faecddd6023bdd8fae42170aff92edb5e5bb100818c1e620637b
MD5 8f551c1e91a07b4ad5273dc91817a216
SHA1 b66b43772c0f603c26328cf4a64671709886c308
SHA512 389bee730868f745d48d2a81f5e30d5a9182924100dcbeb3fedf817d55e92924dc1a2d391836a0df941eed471588098c3bfe5070c91ec4fa7932456d83c7ca64
SSDEEP 3072:t2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA71:twD99LB68zowa3lLNngoqRttA71
TLSH
T1C9345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snkicaxspn.sys

Path C:\Temp\snkicaxspn.sys
Size 141KB
SHA256 90af5f9f07cc24a69c49f62de8009b49d418129310d4ae70d4591ca9b3f97ee9
MD5 97b87136109e32989f4cafff58dfd945
SHA1 50d0f4971c5a83009abbf041d4bd31ba3533e341
SHA512 61715c3a83775b3056cbeadf19124a3b95f40085478f73cf94f25ba89f2d396561802a7e4fa70d8b54e50344931d2de26f156be4a5f14ac221b02a4284072593
SSDEEP 1536:ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E5E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicavsnk.exe

Path C:\Temp\sqkicavsnk.exe
Size 243KB
SHA256 6d3f89ff329927cd12c0dddd3555ba5d7554b133c690abd135c4ebb07c5a393c
MD5 9c24cde91a4d61912c35b784128f839e
SHA1 afe17c4a33a3d5dfbc7d40f1a2885fe24623d5d0
SHA512 271a58eb4e14447fb7a55d9b42462dc7debb25b3ba666aa1af4704140c437aa55bfff58cbab606b9a9e7c2d4022901d95dadab2eb8b22111b467afdd4dd64fc5
SSDEEP 3072:S2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7a:SwD99LB68zowa3lLNngoqRttA7a
TLSH
T13A345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtqo.exe

Path C:\Temp\tqlidbvtqo.exe
Size 243KB
SHA256 fe00b6c6f908c547dee8e5a9d8f4c46ac12624c28d222d258a32fbbfff3c2553
MD5 7bbdcfa047c18ad852e12f777cf463c3
SHA1 89f93782bc2daa21c501b22f64feb83dafd2dd4d
SHA512 a52df1115a7bf6f14d5a9763930887589d3a24e3a6cc8b5955cb85d99bc64c67016796c19ff5ae0b7818ae0d1753d5a458a7481f47564331334672e5e636de76
SSDEEP 3072:62z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7G:6wD99LB68zowa3lLNngoqRttA7G
TLSH
T1D8345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usnkiczxvs.exe

Path C:\Temp\usnkiczxvs.exe
Size 243KB
SHA256 a37cc46d6e768c848ed907579c39e9acbb5d8117bd931e18b2155aec2b1aa123
MD5 baef69d502a73b7a0fcbed0e80f908d0
SHA1 fe6f2878aa477037dbdc5dab8f5ae55a0aa8a2b7
SHA512 7821f1cfdaa84408172b3929aec0ac803188037dd3ed3fa02e4f7c0812316796f86ab4f1457f127b94b1c1094640e8fa99e49be412547d8656036979d3232097
SSDEEP 3072:d2z9J99LB68zVuJh/7yfa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7R:dwD99LB68zowa3lLNngoqRttA7R
TLSH
T1BB345A1172818071E75A0B78046AE7A1467E7C384BA5D5CFF7A83F791A312E3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqolgdyvt.sys

Path C:\Temp\ywqolgdyvt.sys
Size 141KB
SHA256 b49b9b83b6be32417deb60caf4aa6faf2151627e20c25759104ba5cf86d6c39d
MD5 153e4be3e560bb9d567c1f7e4e6cf669
SHA1 aaa2dc002f9a6128c4f37eab2fa5f4fff0d7e588
SHA512 a45d3fe0ba546bc5c2837cde2984b0fcf324827082810e91ecb9e6f82aeb8ede787562ba7b79deabf6e589e65d79fc661b2414bf4b35843a0f9ca747556422c1
SSDEEP 1536:wa3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:wa3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1BFE38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ecfebf0c189719b063188489cf88c6756a3951b5a689cda3d5fbd2559948cf99
MD5 4e76f31060008b85e514f5036d591581
SHA1 597007ba5f9910e97360e47b69f5e0e76b7b60b2
SHA512 d60744737efe4d7b5da448d5f7ea05099d52b572cbfd87d41ba09f3b59b611955b0d1d5ebc612aee0cefb3313c899412083b18bd8a6dbe9c71e8ea95b1e21672
TLSH
T1496186FB63311DD3DFA2477963E1C699B2F78D9101E79E2054425E3E0E02F0555E099B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599c56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599c56.TMP
Size 3KB
SHA256 cf8f19cbd8c4f82818e3a2764b3b254714282c7fe5e30a84e0fee5a155ad0f92
MD5 2e23c2e61b7ded6ddec9d16e19a05900
SHA1 a46dfe63d16081f8e02765401312407c95832971
SHA512 ae2fe1dd50ee552ef591c2a9296c325bb1893e2c7a092bffc2b7ad0e606fc4573a4e0162bc09ceab9d17d59176393eabd08916aceba760ddf60a88bad30ef5a8
TLSH
T1CA6184FB63311DD3DFA287B963E1C6A9B2F78C9101E79E2054425E3E4E06F0525E099B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d585c4c78f8b7e110e0116736911a02fb1e4eb4cb5e5bd9dd714c62d26cd8c45
MD5 530e8193e2fc28e5684af18e6d54c132
SHA1 62aa57fe78573879b8b4b41b80d153a6a7f3e050
SHA512 2a33fd4e97b822893bc665379cf856e3cd855c4eb08772939b73162e2ca4bd9d8e7c22817611d1dbb073d3aca8b09a90db6cac70ed3e9e0037db15e3fc2d216b
TLSH
T10641CEF3C3F8C56E9A0186F0EA146E2BCE2D0515432C7C5A88E49E2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a1b4650ff35fc2026f6a5d0f7980a3e0441ed4f15290c67f3da607d16c443a6f
MD5 9965be84596ae09ecbec12de0756a0d5
SHA1 1e7c73b44548acee72385d5cb1b1c4674a252fff
SHA512 30539f25dddcb880d347654e8da510e5382d906a4c92881925e82288e8750f31fe074f8ed7063419d7453206c15c531a366cd84eec2cbad1bd4dc23a9c600f8b
SSDEEP 192:sxRQOR5CKL/fasu/2ZpGF173zoA8p9J/g6+WNCUy/YlLZdiCGwIgVcwHJ:sxRQOKKL/fasu/ApGF17e3/5o/LGv
TLSH
T16142C8266E68AD3B8CCBD24DFA557F53D2F95032A0D41F48A6FC8A1C14E76CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bc7b84832b4044b59e8c51e84651259552e11a49e689a47a70cf1d6feb232589
MD5 b925844b1ffd93f01137fb575a9b3e3d
SHA1 69cc88490b70aaaf4511f75980a7f68242843ebc
SHA512 a120c6c3777a3ad6ecb0c59e62b7129d1d23967a0c69a4acc49acd281c7fd9e0def9c24af77d9fd0d0f83736671da331171e5a5ca2bc91278c4c53ff06bb7c6f
SSDEEP 192:sxRTOR5CKL/faseCG2ZpGF173zoA8p9J/g6+WNCUy/YlCZDiCGwIgDkcwHJ:sxRTOKKL/faseCGApGF17e3/5o/QGa
TLSH
T1E142C8656E68AD3B8CCBD24DFA557F53E2F99032A0D41F48A6FC8A1C10E76CD620741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 70afb5d38d657dec685b50ca497cbf4f2f4abb83b49737e6f6f6881dcc3dc2c5
MD5 ccdfeb684fe4fea35fe5595c346e1509
SHA1 55fcfc48497c9c7cea041e957e840d8fb18ae7bc
SHA512 44b00356df029ead771c66e669a94ff346866336851a3257fb0d6b0610b541f6ed595c40fd2cb76b52229f697e19424bbda61a71c3372890b4c936b6582dfe74
SSDEEP 192:sxRTOR5CKL/fase/2ZpGF173zoA8p9J/g6+WNCUy/YlLZdiCGwIgD+cwHJ:sxRTOKKL/fase/ApGF17e3/5o/LGs
TLSH
T15942D9266E68AD3B8CCBD24DFA557F53D2F95032A0D41F48A6FC8A1C10E76CD620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 827a12c9d2a1f00d9e9a6c506e30016322b34fb4b4a254a5150a8c8f94710636
MD5 d8a40b98d1e64cd8fb047d582c2b8159
SHA1 4349012dd78cea5fbf7c5c824a90ee120bab69b9
SHA512 e8b6cb6b677797d9767eb2219e2460c06a75780904f51b4d2aea55b09a389f406e75c610f0626af0dab2f985fd87f40c704184492c7e88c48b5aef7c11141bd6
SSDEEP 768:dofALu7pLuLzKxWgg+fJJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk5N1317roTJ:dofALuEzKxWgg+fJJu1jab5Nl1ITJ
TLSH
T1BAD2DA7B640CCB7E4F804ADDEC19BA9F6D6802CB96D8C94047FE941C02C6BEB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3634.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3634.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1b59397f7291df2a405ddded5497a8abc2690c8992125f3cc2cda50696d9463b
MD5 03a1a1aa05a60fb7e572e4e8678f9f4c
SHA1 6d3c9ecbba4dc05c7eab6994a3d0005f37616d51
SHA512 8930eb3d85854edb03de72cde6ece97473771747c1c13a2aa68c1bf2abb2496c0b79ceefd64d3d594dad75229b313b0bbf8e8a0c916d62be6d5eafdfb0ea474a
SSDEEP 384:n3ZcIg38N3UG56Ot5ulzRfY9bYz44cjDQPlLJQXmIkdP9IimIMWEfMbc+HA1X1pm:/g3/a+iJU44e0NHXmTWTbc+HAVyLYC1
TLSH
T10CF2AFB09CE69A37ADFADAC9F60B77076EF8412390D81944C9D9AB0D108759D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 78c11361240828c96ae7eb6e874d63c015c85d48d7fb3bae5c7a74530b682832
MD5 f1031364c73e6dcfe22493dabab80429
SHA1 c1bf0092fc5c09d819131ca75397669fedd33aa6
SHA512 5dfcfad213c30079f0e9bf7ab7358e5c05dfe0f872b46f3f601412a7177f93325a769a958f6e04bee6d1a100aaf0f82e214b1c4bc210dd286361ee2021fc3dcc
SSDEEP 768:FFQU3+wgg3/cU44e4NHXmTWTbc+HAVyLYC1:kU3/4aeWn1giR1
TLSH
T10C1308F198D79637E9AE8B87A73D6E065DBCC153B0885884BBC85D4CDC861BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ec8cd774077886281a3b6ddb824b373b2e567bbd08dc0318b746d6ac6180e6b4
MD5 a77fff5d269c6b36673b5f3850e3a9e8
SHA1 14af91e5726d294bfbff167794c770ee8d3403c9
SHA512 8f997db0715539ae28ec67f8610118535efa2422f3539dcff0ffa0a7b5d741595f081e72a625c5357b034ef42c0d0ae91f3e3d68a1384918273069ed218ded2a
SSDEEP 768:arv+4UNbdM3AIziJU41NHXmTWTbc+/reVH1SvyZ:absb+3dP4DeWn1zEH1dZ
TLSH
T18103CF31ECA98E37ADFA9A88744BBA573EF9116385C40B84C8C96F4E418744D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2bf501e50a0df5a7db8e26a7baa1673d978b90aba737a16a30cb8c37ee1a7f04
MD5 d62287408a63638393493b71f5a37948
SHA1 1402fc555fd311e2e9af6410d5d0030544fdb9dc
SHA512 46776494a6afaa8a4ae28be3c86eb07d83e7c208d5a1f60724440c6ef166e4ef6b5b5eefe3e6825f99cac6a890e78d2cb39736ac7ae1f398766ea090e53de19c
SSDEEP 768:yrv+4UNbdf3M/+iJU44eNNHXmTWTbc+HATp:ybsbh3HP4deWn1gTp
TLSH
T17F03BF71ECA99A379EFA8AC9F50BBA037FF8115350C40A94CDD96B8D118B49D034BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 14d104e876fe5071decae6b30a40d1dfa9e64a04fac22c741ac18a064f470229
MD5 7974c8ed1f28195c7163138ae085f55f
SHA1 5045c92f284c7299a47e7e4179465d0d909192d6
SHA512 0fff3b640a36a131931f53388558f0408aaa8b1b9f8bd33f62d76d626c215441ecc1c6f4eddd12aa3cf300efa2052fa1647835dd49803dfe88ee9361c5fa342b
SSDEEP 768:zrv+4UNbdM3qVEiJU44eZNHXmTWTbc+eAeVH1SvyZ:zbsb+3NP4deWn1TEH1dZ
TLSH
T1D703C071DCA99A37AEF68EC8B44BBA077FB8115341C40A94C8D96F4D118B48D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 523f5cde3f485236e6ac5066441ae24be1ca8638255e6202a95b61a4c397040f
MD5 e617237972a463f7b4e7f44b13e8dcc7
SHA1 62f5aa3b83f2597c4da0fda8ef22b09c0e2de50c
SHA512 1d3c20583612a1dc859ac7b27ff8dac683b5f2a03ce4510ca97e7c2dd0ceb639c51f4ff069cb10e88ffcf314af3125b832b3994b3d064e8b0fcad1e08a4feb07
SSDEEP 384:noZcIg38N3NG56Ot5ulzRfY9bYz44cjDQPlLJQXmIkdP9IimIMWEfMbc+HA1X1pm:Wg3Ma+iJU44e0NHXmTWTbc+HAVyLYC1
TLSH
T1EDF2AFB09CE69A77ADFACAC9E60B77076EF8412390D81944C9DDAB0D108759D034BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f642c8cd-f0d3-4a7b-b6e6-2eff2d970e65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f642c8cd-f0d3-4a7b-b6e6-2eff2d970e65.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5972f4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5972f4.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

d5015bb8-2513-42d4-8af2-8ecc47a4272d.tmp

Path C:\Users\Admin\AppData\Local\Temp\d5015bb8-2513-42d4-8af2-8ecc47a4272d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1680_154063629\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1680_902019876\CRX_INSTALL\_locales\en\messages.json
Size 851B
SHA256 6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c
MD5 07ffbe5f24ca348723ff8c6c488abfb8
SHA1 6dc2851e39b2ee38f88cf5c35a90171dbea5b690
SHA512 7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6
TLSH
T175012506E2516A2B03B2A12775613641F57045EA1200DCBB7A7CD41C9FB6DAB918BBD8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-870-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/236-890-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1116-722-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1116-716-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1376-872-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1976-720-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1992-875-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1992-895-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-769-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2680-790-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2948-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2972-736-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-664-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3528-683-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4332-810-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4388-834-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4508-893-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4524-740-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4872-636-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-589-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5156-814-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5232-690-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5464-789-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5968-845-0x0000000000010000-0x0000000000083000-memory.dmp

Download