d1ba30285cf5854463f3b6dc7fb58d39350c55f349bb6f4e58c0bbb34e7bc69f

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe
Size 226KB
Sample260831-myabeahk7s
SHA256 d1ba30285cf5854463f3b6dc7fb58d39350c55f349bb6f4e58c0bbb34e7bc69f
MD5 5ca9fbc37396607b13d096713b83777c
SHA1 fd7da29869e5b3f2e8b05a688366dd36925778b5
SHA512 30d16695fac5207504c105e71ce4ab73bdd22984f3d5af5eb9c931934095a23df96c3becad97420f5fe467e55eb43d6516cdf6a0198c64403d5cc6e964c56b74
SSDEEP 3072:TGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:yXY4LK+a3lLNngoqRttA7
TLSH
T12534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1536	CP.exe
4148	gecwrojhbw.exe
2816	CP.exe
2492	CP.exe
2776	i_gecwrojhbw.exe
2464	gdbztroigb.sys
5420	CP.exe
1288	bztrljdbzt.exe
3680	CP.exe
3792	CP.exe
2904	i_bztrljdbzt.exe
5680	ytqligaytq.sys
2456	CP.exe
5688	vtqljdbvqo.exe
4460	CP.exe
5452	CP.exe
5572	i_vtqljdbvqo.exe
5352	dyvtnlfdyv.sys
1392	CP.exe
2408	vqkfdxvqni.exe
2432	CP.exe
4596	CP.exe
2776	i_vqkfdxvqni.exe
2760	xvpnlidays.sys
4660	CP.exe
3940	qnifaysqki.exe
6028	CP.exe
5764	CP.exe
1248	i_qnifaysqki.exe
5304	pnkfcxvpnh.sys
4812	CP.exe
2196	pnhfausqki.exe
2116	CP.exe
5572	CP.exe
2652	i_pnhfausqki.exe
4248	pkhfzxupnh.sys
252	CP.exe
5752	mkhfzxurpj.exe
5944	CP.exe
5056	CP.exe
708	i_mkhfzxurpj.exe
3360	hfzxupmhfz.sys
2564	CP.exe
5804	cwuomgezwr.exe
5708	CP.exe
4960	CP.exe
1264	i_cwuomgezwr.exe
8	jhezwrpjhb.sys
4500	CP.exe
476	heztomjecw.exe
2092	CP.exe
932	CP.exe
3796	i_heztomjecw.exe
5636	ywrojheywq.sys
4556	CP.exe
3932	wuomgeywto.exe
4244	CP.exe
2156	CP.exe
1912	i_wuomgeywto.exe
4828	olgdywqoig.sys
4944	CP.exe
2872	geywqoigay.exe
5840	CP.exe
1308	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_1870694708\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_1870694708\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_3324_1514667801\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_109_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_2113869550\_locales\lo\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqkfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicaxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytqljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkhfzxurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecausmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gecwrojhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnifaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heztomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xkhczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgeywtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqljdbvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqkfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkhfzxurpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gecwrojhbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfausqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heztomjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xkhczurpmh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecausmki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgeywtroj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfausqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicaxvpni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytqljdbvt.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1892	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
560	ipconfig.exe
4492	ipconfig.exe
2092	ipconfig.exe
2396	ipconfig.exe
4456	ipconfig.exe
5268	ipconfig.exe
6052	ipconfig.exe
5900	ipconfig.exe
3660	ipconfig.exe
4468	ipconfig.exe
4908	ipconfig.exe
5836	ipconfig.exe
2904	ipconfig.exe
108	ipconfig.exe
4860	ipconfig.exe
1260	ipconfig.exe
620	ipconfig.exe
3432	ipconfig.exe
3248	ipconfig.exe
716	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326471201540837"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{A1A5B0A4-DB55-4A71-BEE0-7340E5C2566E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3304	msedge.exe
3304	msedge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe
3324	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2776	i_gecwrojhbw.exe
Token: SeDebugPrivilege	2904	i_bztrljdbzt.exe
Token: SeDebugPrivilege	5572	i_vtqljdbvqo.exe
Token: SeDebugPrivilege	2776	i_vqkfdxvqni.exe
Token: SeDebugPrivilege	1248	i_qnifaysqki.exe
Token: SeDebugPrivilege	2652	i_pnhfausqki.exe
Token: SeDebugPrivilege	708	i_mkhfzxurpj.exe
Token: SeDebugPrivilege	1264	i_cwuomgezwr.exe
Token: SeDebugPrivilege	3796	i_heztomjecw.exe
Token: SeDebugPrivilege	1912	i_wuomgeywto.exe
Token: SeDebugPrivilege	4532	i_geywqoigay.exe
Token: SeDebugPrivilege	4996	i_lidxvtnlfd.exe
Token: SeDebugPrivilege	1048	i_sqkidavtnl.exe
Token: SeDebugPrivilege	5992	i_nkicaxvpni.exe
Token: SeDebugPrivilege	4728	i_mkecausmki.exe
Token: SeDebugPrivilege	4112	i_xkhczurpmh.exe
Token: SeDebugPrivilege	3420	i_romkecwuom.exe
Token: SeDebugPrivilege	1284	i_ljebztrlje.exe
Token: SeDebugPrivilege	2328	i_olgeywtroj.exe
Token: SeDebugPrivilege	2964	i_bytqljdbvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5316 wrote to memory of 996	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 996 wrote to memory of 3324	996	iexplore.exe	90
PID 3324 wrote to memory of 3916	3324	msedge.exe	91
PID 3324 wrote to memory of 3468	3324	msedge.exe	93
PID 3324 wrote to memory of 1892	3324	msedge.exe	94
PID 3324 wrote to memory of 3468	3324	msedge.exe	93
PID 3324 wrote to memory of 3468	3324	msedge.exe	93
PID 3324 wrote to memory of 5640	3324	msedge.exe	95
PID 3324 wrote to memory of 5640	3324	msedge.exe	95
PID 3324 wrote to memory of 5936	3324	msedge.exe	96
PID 3324 wrote to memory of 5936	3324	msedge.exe	96
PID 3324 wrote to memory of 5984	3324	msedge.exe	97
PID 3324 wrote to memory of 5936	3324	msedge.exe	96
PID 3324 wrote to memory of 5984	3324	msedge.exe	97
PID 3324 wrote to memory of 5984	3324	msedge.exe	97
PID 3324 wrote to memory of 5700	3324	msedge.exe	98
PID 3324 wrote to memory of 5700	3324	msedge.exe	98
PID 3324 wrote to memory of 5700	3324	msedge.exe	98
PID 3324 wrote to memory of 4280	3324	msedge.exe	99
PID 3324 wrote to memory of 4280	3324	msedge.exe	99
PID 3324 wrote to memory of 4280	3324	msedge.exe	99
PID 3324 wrote to memory of 4636	3324	msedge.exe	101
PID 3324 wrote to memory of 4636	3324	msedge.exe	101
PID 5316 wrote to memory of 1536	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 3324 wrote to memory of 1644	3324	msedge.exe	103
PID 3324 wrote to memory of 1644	3324	msedge.exe	103
PID 3324 wrote to memory of 3348	3324	msedge.exe	104
PID 3324 wrote to memory of 3348	3324	msedge.exe	104
PID 3324 wrote to memory of 4920	3324	msedge.exe	107
PID 4148 wrote to memory of 2816	4148	gecwrojhbw.exe	109
PID 3324 wrote to memory of 6052	3324	msedge.exe	112
PID 3324 wrote to memory of 6052	3324	msedge.exe	112
PID 3324 wrote to memory of 4068	3324	msedge.exe	113
PID 3324 wrote to memory of 4068	3324	msedge.exe	113
PID 3324 wrote to memory of 3792	3324	msedge.exe	127
PID 3324 wrote to memory of 5752	3324	msedge.exe	117
PID 3324 wrote to memory of 3792	3324	msedge.exe	127
PID 3324 wrote to memory of 5752	3324	msedge.exe	117
PID 5316 wrote to memory of 2492	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 5316 wrote to memory of 5420	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	122
PID 1288 wrote to memory of 3680	1288	bztrljdbzt.exe	124
PID 5316 wrote to memory of 3792	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 5316 wrote to memory of 2456	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	131
PID 5688 wrote to memory of 4460	5688	vtqljdbvqo.exe	133
PID 5316 wrote to memory of 5452	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 5316 wrote to memory of 1392	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	140
PID 2408 wrote to memory of 2432	2408	vqkfdxvqni.exe	142
PID 5316 wrote to memory of 4596	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	145
PID 3324 wrote to memory of 4256	3324	msedge.exe	148
PID 3324 wrote to memory of 1912	3324	msedge.exe	149
PID 3324 wrote to memory of 4636	3324	msedge.exe	150
PID 5316 wrote to memory of 4660	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 3940 wrote to memory of 6028	3940	qnifaysqki.exe	155
PID 5316 wrote to memory of 5764	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 5316 wrote to memory of 4812	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 2196 wrote to memory of 2116	2196	pnhfausqki.exe	164
PID 5316 wrote to memory of 5572	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	167
PID 5316 wrote to memory of 252	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	171
PID 5752 wrote to memory of 5944	5752	mkhfzxurpj.exe	173
PID 5316 wrote to memory of 5056	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	176
PID 5316 wrote to memory of 2564	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	180
PID 5804 wrote to memory of 5708	5804	cwuomgezwr.exe	182
PID 5316 wrote to memory of 4960	5316	2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe	185
PID 3324 wrote to memory of 2912	3324	msedge.exe	187

C:\Users\Admin\AppData\Local\Temp\2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_5ca9fbc37396607b13d096713b83777c_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5316
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x320,0x7fff263ec188,0x7fff263ec194,0x7fff263ec1a0
      4⤵
      PID:3916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,11643982713631344597,3921424484400928879,262144 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
      4⤵
      PID:3468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9481949494740321777,9403958358385036679,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:11
      4⤵
      System Time Discovery
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,8853634596993134277,14977952262531786411,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:13
      4⤵
      PID:5640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,2260512943713183031,871009498318887696,2097152 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,9798911305054550850,6997651337068496526,2097152 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1632,i,17114820084379606225,6499368408034319095,2097152 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,2995985818451668112,14218730304634873587,2097152 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,16009429724780399675,4426354530531278343,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,11540419589562864713,6266044421122206560,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,9764979572417934345,12136613560997937740,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:3348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,15352706616059187576,11922677711343547148,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:5636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,15352706616059187576,11922677711343547148,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,4510850915536482386,5898821500843534626,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3185857785629120430,13573042073986832056,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6283147279804551059,11720749229733659767,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
      4⤵
      PID:3792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,16836947338275664448,13520014870966222323,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,17877695731855147433,887287136762473813,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
      4⤵
      PID:4256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,8265970556333033542,10179335910198320030,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:14
      4⤵
      PID:1912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,16516775438167613158,14346556944684322039,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:14
      4⤵
      PID:4636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,1331298896586449242,5710248092718761987,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,15710071956791967695,8685489880108437276,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,4191990319490850350,6254266081938013180,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:3360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6990122959996583134,7262060085538330360,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:14
      4⤵
      PID:4132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6848,i,10540684242481098832,8659856552896965056,262144 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=800,i,14090082296470287797,13133203482350605258,524288 --field-trial-handle=2420,i,9631409507148387291,15391690545770660886,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:14
      4⤵
      PID:240
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gecwrojhbw.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1536
- - C:\Temp\gecwrojhbw.exe
    C:\Temp\gecwrojhbw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4148
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2816
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:560
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gecwrojhbw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2492
- - C:\Temp\i_gecwrojhbw.exe
    C:\Temp\i_gecwrojhbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljdbzt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5420
- - C:\Temp\bztrljdbzt.exe
    C:\Temp\bztrljdbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljdbzt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Temp\i_bztrljdbzt.exe
    C:\Temp\i_bztrljdbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqljdbvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2456
- - C:\Temp\vtqljdbvqo.exe
    C:\Temp\vtqljdbvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5688
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4460
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2092
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqljdbvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5452
- - C:\Temp\i_vtqljdbvqo.exe
    C:\Temp\i_vtqljdbvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5572
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqkfdxvqni.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1392
- - C:\Temp\vqkfdxvqni.exe
    C:\Temp\vqkfdxvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2432
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqkfdxvqni.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4596
- - C:\Temp\i_vqkfdxvqni.exe
    C:\Temp\i_vqkfdxvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnifaysqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Temp\qnifaysqki.exe
    C:\Temp\qnifaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4860
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnifaysqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5764
- - C:\Temp\i_qnifaysqki.exe
    C:\Temp\i_qnifaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfausqki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4812
- - C:\Temp\pnhfausqki.exe
    C:\Temp\pnhfausqki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2196
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2116
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfausqki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5572
- - C:\Temp\i_pnhfausqki.exe
    C:\Temp\i_pnhfausqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkhfzxurpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:252
- - C:\Temp\mkhfzxurpj.exe
    C:\Temp\mkhfzxurpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5752
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4908
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkhfzxurpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5056
- - C:\Temp\i_mkhfzxurpj.exe
    C:\Temp\i_mkhfzxurpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:708
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuomgezwr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2564
- - C:\Temp\cwuomgezwr.exe
    C:\Temp\cwuomgezwr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5708
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5836
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuomgezwr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4960
- - C:\Temp\i_cwuomgezwr.exe
    C:\Temp\i_cwuomgezwr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\heztomjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4500
- - C:\Temp\heztomjecw.exe
    C:\Temp\heztomjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:476
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2092
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_heztomjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:932
- - C:\Temp\i_heztomjecw.exe
    C:\Temp\i_heztomjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3796
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wuomgeywto.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Temp\wuomgeywto.exe
    C:\Temp\wuomgeywto.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wuomgeywto.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2156
- - C:\Temp\i_wuomgeywto.exe
    C:\Temp\i_wuomgeywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\geywqoigay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4944
- - C:\Temp\geywqoigay.exe
    C:\Temp\geywqoigay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5840
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2904
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_geywqoigay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1308
- - C:\Temp\i_geywqoigay.exe
    C:\Temp\i_geywqoigay.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lidxvtnlfd.exe ups_run
  2⤵
  PID:5596
- - C:\Temp\lidxvtnlfd.exe
    C:\Temp\lidxvtnlfd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3368
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lidxvtnlfd.exe ups_ins
  2⤵
  PID:3700
- - C:\Temp\i_lidxvtnlfd.exe
    C:\Temp\i_lidxvtnlfd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkidavtnl.exe ups_run
  2⤵
  PID:2364
- - C:\Temp\sqkidavtnl.exe
    C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:544
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkidavtnl.exe ups_ins
  2⤵
  PID:696
- - C:\Temp\i_sqkidavtnl.exe
    C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1048
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkicaxvpni.exe ups_run
  2⤵
  PID:5820
- - C:\Temp\nkicaxvpni.exe
    C:\Temp\nkicaxvpni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5828
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkicaxvpni.exe ups_ins
  2⤵
  PID:4212
- - C:\Temp\i_nkicaxvpni.exe
    C:\Temp\i_nkicaxvpni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecausmki.exe ups_run
  2⤵
  PID:3196
- - C:\Temp\mkecausmki.exe
    C:\Temp\mkecausmki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:200
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6088
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:108
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecausmki.exe ups_ins
  2⤵
  PID:2600
- - C:\Temp\i_mkecausmki.exe
    C:\Temp\i_mkecausmki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xkhczurpmh.exe ups_run
  2⤵
  PID:3248
- - C:\Temp\xkhczurpmh.exe
    C:\Temp\xkhczurpmh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5516
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xkhczurpmh.exe ups_ins
  2⤵
  PID:4712
- - C:\Temp\i_xkhczurpmh.exe
    C:\Temp\i_xkhczurpmh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4112
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romkecwuom.exe ups_run
  2⤵
  PID:2160
- - C:\Temp\romkecwuom.exe
    C:\Temp\romkecwuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6052
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romkecwuom.exe ups_ins
  2⤵
  PID:4448
- - C:\Temp\i_romkecwuom.exe
    C:\Temp\i_romkecwuom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljebztrlje.exe ups_run
  2⤵
  PID:5264
- - C:\Temp\ljebztrlje.exe
    C:\Temp\ljebztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5144
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6104
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljebztrlje.exe ups_ins
  2⤵
  PID:1588
- - C:\Temp\i_ljebztrlje.exe
    C:\Temp\i_ljebztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\olgeywtroj.exe ups_run
  2⤵
  PID:4572
- - C:\Temp\olgeywtroj.exe
    C:\Temp\olgeywtroj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1864
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_olgeywtroj.exe ups_ins
  2⤵
  PID:5528
- - C:\Temp\i_olgeywtroj.exe
    C:\Temp\i_olgeywtroj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytqljdbvt.exe ups_run
  2⤵
  PID:4048
- - C:\Temp\bytqljdbvt.exe
    C:\Temp\bytqljdbvt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1180
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytqljdbvt.exe ups_ins
  2⤵
  PID:3628
- - C:\Temp\i_bytqljdbvt.exe
    C:\Temp\i_bytqljdbvt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2156

C:\Temp\gdbztroigb.sys
C:\Temp\gdbztroigb.sys
1⤵
- Executes dropped EXE
PID:2464

C:\Temp\ytqligaytq.sys
C:\Temp\ytqligaytq.sys
1⤵
- Executes dropped EXE
PID:5680

C:\Temp\dyvtnlfdyv.sys
C:\Temp\dyvtnlfdyv.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\xvpnlidays.sys
C:\Temp\xvpnlidays.sys
1⤵
- Executes dropped EXE
PID:2760

C:\Temp\pnkfcxvpnh.sys
C:\Temp\pnkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:5304

C:\Temp\pkhfzxupnh.sys
C:\Temp\pkhfzxupnh.sys
1⤵
- Executes dropped EXE
PID:4248

C:\Temp\hfzxupmhfz.sys
C:\Temp\hfzxupmhfz.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\jhezwrpjhb.sys
C:\Temp\jhezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:8

C:\Temp\ywrojheywq.sys
C:\Temp\ywrojheywq.sys
1⤵
- Executes dropped EXE
PID:5636

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:4828

C:\Temp\oigeyvtqoi.sys
C:\Temp\oigeyvtqoi.sys
1⤵
PID:4504

C:\Temp\tqkigaysql.sys
C:\Temp\tqkigaysql.sys
1⤵
PID:5484

C:\Temp\qnlfdayspn.sys
C:\Temp\qnlfdayspn.sys
1⤵
PID:2904

C:\Temp\nkecaxvpnh.sys
C:\Temp\nkecaxvpnh.sys
1⤵
PID:6124

C:\Temp\zxupnhfzxr.sys
C:\Temp\zxupnhfzxr.sys
1⤵
PID:2200

C:\Temp\zwupmkecwu.sys
C:\Temp\zwupmkecwu.sys
1⤵
PID:620

C:\Temp\omgezwrojh.sys
C:\Temp\omgezwrojh.sys
1⤵
PID:2396

C:\Temp\wrojgebolj.sys
C:\Temp\wrojgebolj.sys
1⤵
PID:2984

C:\Temp\ywqoljdbwt.sys
C:\Temp\ywqoljdbwt.sys
1⤵
PID:1072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 88d1f04b969503b4d87d7c986ed8f2f830a9f85073fbea644e380692ab3d997c
MD5 0da87487a46ac0b219dfc10ebb7dbc09
SHA1 a58ed225df243160327f19f2d03ccb60693c562b
SHA512 cbcae2c33b3e87e76b34a228115178a587797620e0047704d3d50ad39ea453b32a544bbc6c229347ee3e658d3dcc656c46fe42e90d3210383ad5c76852e198f4
SSDEEP 48:ieNHLtrCgTU534sKXG5BrBfdQSBe2nLB8JsU:dLlS3tpJ5un
TLSH
T12C91202301A68471C8BD8FF7118759C9FA7B51348311210C4AB30FD6E770A77456CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbzt.exe

Path C:\Temp\bztrljdbzt.exe
Size 226KB
SHA256 3f66caf9f6dc0f80330d81c0ef8141ae3e93691b8e894e072219d22fdaeefac3
MD5 620eeaf111ea65f56317f2a743b98522
SHA1 19406d0adc611d63484a7a6b474ddcc06f010002
SHA512 8c41bbd295d30504a96994cafc9a77693a65e3e3185e4e9d410b59e605f456e69585fb7a0c1f8fb24f4a103abb88c816ee8bb1e8950789b6ecc8a09acdabbabe
SSDEEP 3072:8GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:DXY4LK+a3lLNngoqRttA7
TLSH
T18134490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvtnlfdyv.sys

Path C:\Temp\dyvtnlfdyv.sys
Size 141KB
SHA256 9d2af0d745602d89dee7bf83c3d5c5afe7c8283f788ab1616c1d3f9d33ea4ffe
MD5 4be5113e5349e44c88591e8c02acaf41
SHA1 3c46ad9f0b09f19521747b26b603e73c00e7920e
SHA512 27997e1e0729f98d7a9e72b46fb319ba49b8c4ca041c5d55e8dc271885b3f48f4c49c18d17413e26bdd58a4a467f5ac339ca798a24d0df98573d62c256277cb3
SSDEEP 1536:4a3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:4a3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1E0E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbztroigb.sys

Path C:\Temp\gdbztroigb.sys
Size 141KB
SHA256 55afd4be98fb50fe53eccabdf924b14c010320b1f87a7db99792d8c937e196b8
MD5 8d3f77b117ed92c44c5232838e28b9af
SHA1 3bcb379a74610f2b882c3e980f737427fc2f5e2c
SHA512 5d4b4e40d2142be77f115e375428be6b44c0c8e193b80ea0d45249d5ab828e09bbb7f00ca563d78e3e80a278eaece08a341b8fd94b3c6b8ccbad65299ae83ef0
SSDEEP 1536:ga3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ga3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T165E38C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gecwrojhbw.exe

Path C:\Temp\gecwrojhbw.exe
Size 226KB
SHA256 ad586a50c13c38b115b9fbeeb94d09c96bea3cc326132985da73bb4a96ff454c
MD5 b7a482a86689791e9e9a12bd1ee8194f
SHA1 35e521e527ca125c747805752c6297c052665820
SHA512 8f7f8d47854db208ed9b9d14ea2e7bb8f9dbfb7eee3c8e96d3c4bbbf42af72eea52896c3c09b1dac1e699fac452b94377d15da265b6b174037a3776900cd561d
SSDEEP 3072:uGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:FXY4LK+a3lLNngoqRttA7
TLSH
T18334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztrljdbzt.exe

Path C:\Temp\i_bztrljdbzt.exe
Size 226KB
SHA256 56c1672c844905d11b4b817fc878be8e62c73afe6c5584e71e7c84d0332ba7ef
MD5 58546e9d84972380b042c4238339c769
SHA1 8984bfb79ba0f00be94ac24f6aafe4ba375fdeb9
SHA512 fed69f74bdb198c5e48bb75d97e26c67695aa1ed2cd4f84aee96b65a69777360059155e3d5f11f028c47ea69debee35dcb32d9980d9d1466a426f30dfbf319b9
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T10334490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gecwrojhbw.exe

Path C:\Temp\i_gecwrojhbw.exe
Size 226KB
SHA256 1175e40f43aefa7530bebc57f47f31e9f14d2ecfa3ca0e5d11e2cfa8f0b4ddd6
MD5 4ba74b9d8e6d5d817c86646f7896a91f
SHA1 7369a4725a3974d407545c84e1f6f5b1472a218a
SHA512 0190d6c57181f061a7864fc4265736836ca2b5eab8a192c0b6bc65a388d7a37ab15b5c80a2bfe68c830bfa85c25107896a31b8f47f2dc985d717871314bb678f
SSDEEP 3072:kGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:LXY4LK+a3lLNngoqRttA7
TLSH
T15434490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfausqki.exe

Path C:\Temp\i_pnhfausqki.exe
Size 226KB
SHA256 8c7fd89a62361744edb7de3a4568cf0681324dba5f00b80c01600b67452467df
MD5 d9e0bfc3240c6243d56bf31ea81ad609
SHA1 95c9cfbb257048df1b76980639cb0dfb40b1436b
SHA512 ac6af61fd12a6912496357deb8c28c6b60a4bd35e5e31e3a1c163a03ef731adcde271d7dfc30e1c65388274d3761935c74ea92c8bee2ae910a8f6c8dd9a0b3c4
SSDEEP 3072:+GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:VXY4LK+a3lLNngoqRttA7
TLSH
T1A934490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnifaysqki.exe

Path C:\Temp\i_qnifaysqki.exe
Size 226KB
SHA256 95646dd08f673388db0ddd9563e8f20461e7c488d9c66f287a284ce786b0e5e1
MD5 f4328e7aaeefe77afc648a69f63361a8
SHA1 b2aacb5be97775ec57d2f098b7b5914f480260f1
SHA512 d54ec85f0e02e265c4d004603c5ac20c68132018267da353e4c1d086f5ea973e94fb4c6a383a41b80ff8f5984a88e195c6d297f76047d5ced0007dfc60489b4f
SSDEEP 3072:1GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:UXY4LK+a3lLNngoqRttA7
TLSH
T17C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683F795A312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vqkfdxvqni.exe

Path C:\Temp\i_vqkfdxvqni.exe
Size 226KB
SHA256 13a639d51fa1d970fbe984d539e8fa7bcdda2a5735157fb3b7fc90d18db167de
MD5 c83fb7a9f164e8508833c41f230e656a
SHA1 336be983bcf2afc7ea7a3ee751e419d6fd8a2925
SHA512 142e64c064d406b37923825bb37e3f7773637aaf8ff8769a3617db72b36e90b3a6fcf6389650c2575ae26c71cdcf57aa77ef8dee9ed34e31e3b529f414551ff2
SSDEEP 3072:iGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:JXY4LK+a3lLNngoqRttA7
TLSH
T15534490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqljdbvqo.exe

Path C:\Temp\i_vtqljdbvqo.exe
Size 226KB
SHA256 4cdbbc4678b9db738e37826259d8e465842b1934c0467c37035a8152c79168e5
MD5 fa5c022e00f34fa1cfb5dff444ef91ca
SHA1 909cbc89afad794089d87b72f3bc9124f997293e
SHA512 a6987917fb22e29e3bd1bc3f26af2e8d8f5d9f190940f7ac20dbcbdfe07347e737142d8f8ede9ceefaff54a5c1f8da89388d6c51f6b9c0f88056f08bdad16fda
SSDEEP 3072:PGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:uXY4LK+a3lLNngoqRttA7
TLSH
T11834490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfausqki.exe

Path C:\Temp\pnhfausqki.exe
Size 226KB
SHA256 7917255bb0382a6a11a580a34a4bab4608efa39931b27dbdfd9c0430770c8975
MD5 60d7dea146dc9f218a4c808e5f862fde
SHA1 e180cf590bc12a010220a3f18ce553863243bc40
SHA512 2143a3c56cab9ea1f9d6c811be1a8dc07e6c8584179d3a74e7af5e71c4980a9487df7c9951006c864f6754d6f3af0e71a45bd9fa8dcdfbd45745ff370fd4c19a
SSDEEP 3072:aGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:hXY4LK+a3lLNngoqRttA7
TLSH
T19C34490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnkfcxvpnh.sys

Path C:\Temp\pnkfcxvpnh.sys
Size 141KB
SHA256 f97d0cfe5bab2e4ecefc496f4c00a33acfd8aaeb92e66f661cc5ba08c8a2dbd9
MD5 574c2636aebd7d8342f0383d98dfc1e5
SHA1 0c75bc4812846600b6e738d83a512c2da7a11d43
SHA512 1262dc48810a3f8e93443c470890c5b343a27fec547b9321e11c329a1fac14c2103dd9fbf23c9e83361d6e58ce004ed1771498723f0c62c8f999885c79605258
SSDEEP 1536:da3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:da3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T175E37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnifaysqki.exe

Path C:\Temp\qnifaysqki.exe
Size 226KB
SHA256 6b11318df7809a4145b6885251cfeba04acf05b640a7debeeea343524af4477f
MD5 3eedd394023f7d6be810e6577261da08
SHA1 779b337d1ffbf91619d4c3dc32f8385715f9f21a
SHA512 2277f3ba7e33f4048693a1c0acd336b33233ce38c56575d4c38a6f22837dac9632093d8848f489a34fba66186352ec3e101998dbc957837559ac44e1aa07cb32
SSDEEP 3072:qGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:xXY4LK+a3lLNngoqRttA7
TLSH
T15634490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqkfdxvqni.exe

Path C:\Temp\vqkfdxvqni.exe
Size 226KB
SHA256 60b6d7f8195671e5ecd9fb6401b65f58869ca5b1520a6b1620b94fdfa3963830
MD5 2f159292b58d6ee66981712a7a2dcbf1
SHA1 fb39fb3eaa9adcfd68c6127be558f6ba16113a99
SHA512 61508b838e1bfe2ab52ee0f97f2c61863a88210aa56729e2e2f9cdf97edd66ef24aa8dbac313680e4524acb9d3f2d5e05b2b55bf8b0011370894f66ca44f128d
SSDEEP 3072:3GSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:WXY4LK+a3lLNngoqRttA7
TLSH
T1D734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqljdbvqo.exe

Path C:\Temp\vtqljdbvqo.exe
Size 226KB
SHA256 56f45b2097eac3a60e1db5420b5c03df83bb0e97941486cf88de9994108f423d
MD5 ae6645576322c04b73ac740e210fea0c
SHA1 4f9e11791c06e35d201e0ae44a783dc139a12e2a
SHA512 13ab40b9de91ff6cc5c0d7dca9e1fc7aff68d510d4799a9437f378b8524543f0286d948daae4e62f5f12c3569cfbb77168ea08407b6a4a8363eb0a70a73e8cff
SSDEEP 3072:xGSyY4L+c2JhX7ypa3rV3dZPFvOAngoRUAFa1nxayHdXkb5kA7:AXY4LK+a3lLNngoqRttA7
TLSH
T1C734490272818071E7560B78046AE7A1467E7C384BA5E68FF7683B795E312D3AD3721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnlidays.sys

Path C:\Temp\xvpnlidays.sys
Size 141KB
SHA256 dbef1f9e2a90ef592f09f76a83e42946ac5e4e25c651d88a71c50c18f2fd214b
MD5 f5754cd3a3705ef41eb16c841480abd7
SHA1 808659b8da787002b8341b318f9806f41642ece9
SHA512 89ac32cc9b999fce6bcad580d65581bf4e339dcfb0727280b839f370cba6b662c9ef9085baa6863bbd095cf2e9faf17c1ef7639dc22e64fb33f3d721b19366b5
SSDEEP 1536:Ma3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:Ma3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T1FAE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqligaytq.sys

Path C:\Temp\ytqligaytq.sys
Size 141KB
SHA256 fa693cb6876bccd5f6a76a6c81c89610b4b5bdaa7f3dea28cca536e144f00586
MD5 be8dcef5e1f61ca525298251584e548a
SHA1 c810972ee135aed7eda1dfa50a10f883cbc22d51
SHA512 07d8cb20901974d406f96e9c4e473fa35005bebeeb8c2a19ff6aa82d48979b8c29840f4e25b7ee2d004c2c63460e7bbeae83d6a380fec99e718507d88b8b7973
SSDEEP 1536:ha3rVFFMwYJmGCtPpLSuLSWoNAAq3pgoRWNRrH/vxc6tAFB7QruSk8pxayHdXltw:ha3rV3dZPFvOAngoRUAFa1nxayHdXkb
TLSH
T14FE37C12B2D2D172D4A608B8106EC72296BE79304F7AD9C7FB940BAD5E642D0BD3531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 318b54fae9cd7c51f3fec39f10e4ca0a9499dd975fbf1714a838503bb3712ce9
MD5 59f35db22d47024978d79a56a918e7e1
SHA1 bd25b7b2df337f1781805c0c6f7e5845835d19c0
SHA512 4363becde2097dabedef7d058b84989630bc45ba3d555e9bd9ea9863fc853359ae986910f7323ef34f6da7395de09e16ff60c8318a0c26da9cc6f5526b4884da
TLSH
T1CE51528203263AC1E77955F29BE944C8B7F9B3A9490B5EFA120C1C7A5E4EF4480C812F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599bd9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599bd9.TMP
Size 2KB
SHA256 9db02b4197a41c9cfd69ea3392f81166782c2cce840e8164e0050b9052a636ce
MD5 8ed0fdf1c9ef7c249127afd9f0e2bc3e
SHA1 d2364f42f363580ede487e67c2af78e31078c5b6
SHA512 7b82e2120e82ed6ce8ec904267ef8ad6e0ddc5efa4f68f2ddd27929b82afd962e7b5d3ea238860e83e11dc54949ca0eb2802858f4ab1c666102587ded96b71a0
TLSH
T1CD51548203263AC1E77954F297E844C8B7F9B399480B5EFA120C1C7A4D4EF4490C812F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ec2906ca00ffeee7ff367e9c5d67c9d1326582aac6e392b9ecfca255972365a0
MD5 febf40ff7383b315849cebfd80ed775f
SHA1 7b4d98207166454be5f967d7d63c0433c54bbdbc
SHA512 ed1badbe6774c4f85358d12031b622e93f9c1f2e1673b9c78d4eb8431c29fc123cdddad7e6bc0fbb63029a5202aea807a9935b494aac11b207b94a97aa57a36c
TLSH
T1E5419FF3C3F8867E8A0196F4EA146E2BCE1D0925432C7D5AC5E49E2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0eb2c01c80588cf057ca3e866723fe7c76b170fdf03475e32ba475fbfcf46d55
MD5 b717457521cb52bf32da639ad501e60f
SHA1 96b926d38de8651896fa27fa2a697f370ecdc66e
SHA512 8b1534ace50548da566b2e40fd1580903f383e94fb7900c7617ebac91835adb6a7fec9f8beddf5020b1ecfb12f1797dbf242e64727ed0c03c4e9229c9855e1e9
SSDEEP 192:sxRfRkyM/jK1Ml8wC7/f1sIqRKZrMrzoD8p9g/g6+WNCYw/YCtfuOYG1IgVhFiyJ:sxRfi87/f1sIqRcwTu/5y/JVgO
TLSH
T13562D905AA345D7BCCDBD20CFA557F53D6F85162A2905E44AAFC8A1C04EABEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3eb4f5fbe62cbc4ad758f2bf2ca2a78bd2ddd94cea5224dacecfe413b66b4865
MD5 e0bf5582b6d296c8b57a4ae2430318bd
SHA1 4235c6588022ebc412d768376d243d638c758b7b
SHA512 081bc98413ad767fe1a90e0a3899a672cd6a1dc1e2d6b60ccae3e346435d7aa072f906a5cc53e3a0ba1d094a53a6038527831f340538cd6031d6f3b0e3d5bcdf
SSDEEP 192:sxRMRkyM/jK1Ml8UQjC7/f1sMqlKZrMrzoD8prg/g6+WNCYw/YCm1uOYG1IgDPhT:sxRMiqm7/f1sMqlcwTE/5y/KVCO
TLSH
T18262F915AA389D7BCCDBD20CFA51BF53D6F8517291914E44AAFC8A1C04EABDC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2495796b8fbf165dc5b46546138f0d365c19eec4bd105f326c62959d5c31eec
MD5 900d7c6c4da5dab63d9eca23752a652f
SHA1 d1b79a89aaf600d9aca5e49548e4459fd3837807
SHA512 486caca2dd90be14364cbcce54bd0efe092cc181b76cba9f75842e0ea814669c626d46625e23d894222b6d936b4e5cc81ddebcbd448a9e857f6b80f95c91aae7
SSDEEP 192:sxRMRkyM/jK1Ml8wC7/f1sMqRKZrMrzoD8p9g/g6+WNCYw/YCtfuOYG1IgD1hFiO:sxRMi87/f1sMqRcwTu/5y/JV8O
TLSH
T10F62E905AA345D7BCCDBD20CFA517F53D6F85172A2905E44AAFC8A1C04EABEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 37a332a35759808e7db7ae7d27a2e6c81d24d5cf5df49cd833f5af335b9b7fd0
MD5 6d3357303f18d13b88cfab89552c54cd
SHA1 e6c5085f3b6718764145de645a2d4eadd939e9f4
SHA512 2a0bf8351b584a0e185749bc79f49a1ea2fbca4e7078b3414b0ce13882c95e6340cdbd77f791d726d51927fb4853292ae3ebda272dd2fdda9b9e5d1621d47309
SSDEEP 768:j/8vD77pLuLzfQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVKoMQqqBrov8:j/8vDNEzfQWgQ+fB+u1jaNoMVq6k
TLSH
T11DE2FC7B680CCB7E4F404E9DEC29BE9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 80501f36bf55165569ad5ba7f5020b08c5ebf20ec06ac5a291bef627643a646e
MD5 1cfd878e67a3e7386b42e0c538f21405
SHA1 47fb2b8a3aa8a8744c107f90c8be56719965ea5a
SHA512 1a6ad8fd39b639e20c248dffc8250d751ae27e67adf51861080f5ccf71b89e7b51aaee11572786df208e925fc658edcc28bb66debe2b4c4694cc80381df16579
SSDEEP 96:KRbEBVj5J1WdSIg91K4EgT1c7j6dJOHuDSOowg2Ww19gO2K4TgM2cmut8unr+DSq:CbEBVj5JAdSp9/EgTK7j6dJOHuDSOowP
TLSH
T1C7914800B17E42413C3E660DC079883E8A857477745DB96F3FA945660FABE42AEFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b7e88d5-cbc1-4c31-b7f1-41dd8d6db015.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1b7e88d5-cbc1-4c31-b7f1-41dd8d6db015.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 885a73c156c1289de5cccc035af892a236a5949d836ecca80a50e92663dc854f
MD5 96f040de845205070b123685f503b114
SHA1 62656343e541d7b246917857efd7432ec2c0e8d1
SHA512 6a37c0f56d899f0f56b2e4b23a4f1c3db9b909cde85363eb9e4658a8060afa21a32c4af69eb9a45ed1ad6a845ac4da3ef4a7c77fd4b37124e0248d6d49e4a2b5
SSDEEP 768:tF3GYXhzp8+p3bd66j+4BRv86aLIWT2X3rD:tF3ZhF8+p3Z6n4ydg3P
TLSH
T140F29EB1ECA9ED734CEAD644B1467743AFF810A395C05DD8D9DCAB1E108725E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1ebb52cb6f87caea7139d6cf6cb8eb46d2d389ba4c16797093925cfa0543cdcb
MD5 f4c4f3c624692729ae62baec262250b9
SHA1 e748f9961ba95a48c5be08d4195acd1ae944c4b1
SHA512 554f77ff3967b70f803cc895a4628252e4c932331c26a41642b0fe5367299892b1fbf8894fea10962042c33055ebb01ab8618dbcebd19845f1ac98166c779a22
SSDEEP 768:Irv+4UNbdD30ccNp8+p3bd66j+4BRv86aLIiE2bwCl1:Ibsbp3AL8+p3Z6n4yC0ww
TLSH
T12C03CE73F8A899739CE6C644B2467A437FF851A3A6C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 2062a681c3fb2ab889a8009351823af31bf76d7a26fa01d4500097b9f0c35fcd
MD5 806edf87762c97eb8263fa562837fbcc
SHA1 97e446c4f741b3ecc5d826a549de2c7240c8ede3
SHA512 4eb89af0ca88c245f8c4ec03f5c75536b0fcd6d1d3bf4dc71a3be6296e85b28425ef2cc95960924bf04f1390940608f3576cd5b24a46803271fe415a8831d841
SSDEEP 768:Srv+4UNbdD3P2XhNp8+p3bd66j+4BRv86aLITT2bwCl1:Sbsbp3YhL8+p3Z6n4yq0ww
TLSH
T11C03BF72F498E9739CEAC644B14677837FF821A399C10EC4D5D96B8E004A29E370B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 495f642d60fdebcfd084c8e224d6416aac4720e74c14f7c6a0571b2e6d8dcbab
MD5 05e13e91caef93ce05154df3413404f9
SHA1 a88e47589462f0f6104c008eca3d89510800bff4
SHA512 c44e485280df670db6684e1ca63f4265c1b543dd488580fb194466f7db4e06be5818fe2b77df9daf60f3af26e6e99e133e6ad2926deebfe92e3a9d5434eb857a
SSDEEP 768:crv+4UNbdu3YYXhcp8+p3bd66j+4BRv86aLIWT2X3ra:cbsbQ3bh68+p3Z6n4ydg3+
TLSH
T1CE03AE71F8A9ED738CEAC644B15777437FF824A399C01DD8E9C86B4D118A19E270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 ba66964d569608488c32188f471ea92f1aa01495c6ab369eae9f054307c72167
MD5 a7a28a3b900aeb1b0440f67f22371200
SHA1 53ef493151b0d064697015204cc98f642a56905e
SHA512 78358abc79f1026ec5930cc84db384da9ffb7d84deb275f7c1514b5ee5903033e3fb48605a076c5ddf9e9c57f411ce8e631ffc466a03fe04ab2137f1d9a76e0f
SSDEEP 768:bFQt38wgxP+Cp8+p3bd66j+4BRv86aLIWT2X3rD:ut3Zc8+p3Z6n4ydg3P
TLSH
T1061317F198D79936D8AE8743A33D6E429EBCD0A3B5845884F7C85E0DDC861BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d15a06779cd532d87836a422296a0b9a8aa5a7c9e020999f5dbe43aba56ce2cf
MD5 6da4add393aca61f31bcd97303d90a89
SHA1 c6fdf59988b68af40239e8d87020acaa07369980
SHA512 7c47beb854670732bae5de5180cc84eb2910c119bef3c27ba5e854adace8c48802596ca4183161499960d7757ae40121211ebc83bf676a8b56e9801359cb6240
SSDEEP 768:4F3LYXhzp8+p3bd66j+4BRv86aLIWT2X3rD:4F3ehF8+p3Z6n4ydg3P
TLSH
T128F2AEB1ECA9ED734CEAD644B1467743AFF810A395C05DD8D9DCAB1E108725E1B0B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

31d1337a-8a92-42e6-9e4a-2d919f2b56d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\31d1337a-8a92-42e6-9e4a-2d919f2b56d8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json~RFe5973a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5973a0.TMP
Size 132B
SHA256 a0b1a35a86cbd2e671521525fc6903162d450e3b301948d913d05ef458794c20
MD5 22215f69c4a5231b8c568620e783d7fe
SHA1 c64663b6efe0023ca5978374d785f1202d924d1b
SHA512 9e38513132672de4a65c01a6eca3c8c3a878cc6e11e2c0d2235798b78e3338c9a13a15d261c4b4fc6c60657f42407b98c8435aa4352366d1809843ddda068e22
TLSH
T1A5C02B79481924CC2B00043C6004012B19B0560023C413F48C1B8D80007537CD30817F
MD5 SHA1 SHA512 TLSH

Submit Download

c86f7575-91c1-4420-ada7-175ea815fbcf.tmp

Path C:\Users\Admin\AppData\Local\Temp\c86f7575-91c1-4420-ada7-175ea815fbcf.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3324_1314680818\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/8-551-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/8-585-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/620-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1072-730-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2200-674-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2396-701-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2464-416-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2760-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-642-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2984-713-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-563-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4248-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4504-610-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4828-597-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5304-517-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5352-492-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5484-644-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5484-631-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5636-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5636-567-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5680-464-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-676-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6124-663-0x0000000000010000-0x0000000000083000-memory.dmp

Download