systex | 0ebcde3473ddc1d91ddcc95dec550f3175e5ad571698164142ec97ac0b81562f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260415-mkyrvaex81
SHA256 0ebcde3473ddc1d91ddcc95dec550f3175e5ad571698164142ec97ac0b81562f
MD5 377548aab113ef9b319905007549f3e2
SHA1 16bfc71aff7ee01331780c14ca58645587087d95
SHA512 09f502895330a7108ae6286256189ca33cbe37acf0eb9235c472b6321f09f1569683c658d40c6c2026dc20d5abdd8756522dab0193e0d30c637c7156e7a2affc
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T100344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Detects executables containing bas64 encoded gzip files 1 IoCs

resource	yara_rule
behavioral2/memory/4604-849-0x0000000000010000-0x0000000000083000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File

Executes dropped EXE 64 IoCs

pid	Process
4568	CP.exe
2508	pnhfzxspki.exe
3848	CP.exe
3948	CP.exe
1620	i_pnhfzxspki.exe
3680	hcaxspkhcz.sys
3904	CP.exe
2228	ausmkecxus.exe
4872	CP.exe
3092	CP.exe
3004	i_ausmkecxus.exe
2064	czusmkecxr.sys
4864	CP.exe
3664	smjecwuomh.exe
4204	CP.exe
4836	CP.exe
2120	i_smjecwuomh.exe
1912	hezxrpjhbz.sys
4696	CP.exe
3708	omgezwrpjh.exe
2324	CP.exe
704	CP.exe
1468	i_omgezwrpjh.exe
2976	mhbztrljeb.sys
4320	CP.exe
3680	ztrdbwtrlj.exe
1604	CP.exe
1692	CP.exe
2740	i_ztrdbwtrlj.exe
1384	tqojgbytrl.sys
3544	CP.exe
2972	jdbvtoljdb.exe
1912	CP.exe
5028	CP.exe
228	i_jdbvtoljdb.exe
4400	dbvtnlgdyv.sys
984	CP.exe
2660	vtqlidbvtn.exe
2232	CP.exe
2688	CP.exe
3624	i_vtqlidbvtn.exe
2064	vifaysqlfd.sys
2968	CP.exe
5052	avsqkicavs.exe
1868	CP.exe
1224	CP.exe
5104	i_avsqkicavs.exe
3360	fdxvpnicay.sys
2368	CP.exe
4040	mkicaxspkf.exe
4996	CP.exe
4436	CP.exe
4352	i_mkicaxspkf.exe
3496	snkecxupnh.sys
1340	CP.exe
2788	causmkecxu.exe
2620	CP.exe
1524	CP.exe
3340	i_causmkecxu.exe
5008	zxrpjhczus.sys
2460	CP.exe
4516	omhezxrpjh.exe
1456	CP.exe
2488	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1715319955\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1950791000\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1950791000\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2010252461\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_992117852\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_992117852\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1715319955\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1950791000\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jeywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkicaxspkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smjecwuomh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqoigbytr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gavtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrdbwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gavtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnidavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxspki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeywqojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnidavsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnifax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrdbwtrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkicaxspkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1056	ipconfig.exe
912	ipconfig.exe
2488	ipconfig.exe
2784	ipconfig.exe
3420	ipconfig.exe
4340	ipconfig.exe
1848	ipconfig.exe
564	ipconfig.exe
1160	ipconfig.exe
236	ipconfig.exe
1668	ipconfig.exe
4248	ipconfig.exe
4900	ipconfig.exe
1404	ipconfig.exe
4332	ipconfig.exe
3108	ipconfig.exe
4968	ipconfig.exe
3396	ipconfig.exe
1404	ipconfig.exe
2128	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 49 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2576730512"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247584"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207227325821548"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3119821332-640943685-2562343641-1000\{FC4DC2C2-8C61-4442-A8FF-619F2FF2CC19}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe
2508	pnhfzxspki.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1620	i_pnhfzxspki.exe
Token: SeDebugPrivilege	3004	i_ausmkecxus.exe
Token: SeDebugPrivilege	2120	i_smjecwuomh.exe
Token: SeDebugPrivilege	1468	i_omgezwrpjh.exe
Token: SeDebugPrivilege	2740	i_ztrdbwtrlj.exe
Token: SeDebugPrivilege	228	i_jdbvtoljdb.exe
Token: SeDebugPrivilege	3624	i_vtqlidbvtn.exe
Token: SeDebugPrivilege	5104	i_avsqkicavs.exe
Token: SeDebugPrivilege	4352	i_mkicaxspkf.exe
Token: SeDebugPrivilege	3340	i_causmkecxu.exe
Token: SeDebugPrivilege	3224	i_omhezxrpjh.exe
Token: SeDebugPrivilege	4428	i_wtrmjecwuo.exe
Token: SeDebugPrivilege	2416	i_jeywqojgbz.exe
Token: SeDebugPrivilege	3496	i_ywqoigbytr.exe
Token: SeDebugPrivilege	1020	i_gavtnlfdyv.exe
Token: SeDebugPrivilege	1500	i_qnidavsqki.exe
Token: SeDebugPrivilege	1872	i_fdxvpnifax.exe
Token: SeDebugPrivilege	2208	i_caxspkicau.exe
Token: SeDebugPrivilege	2124	i_pkecwupmhf.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 1660	4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 4504 wrote to memory of 4412	4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 1660 wrote to memory of 4844	1660	iexplore.exe	81
PID 4412 wrote to memory of 1656	4412	iexplore.exe	82
PID 4844 wrote to memory of 1644	4844	msedge.exe	83
PID 4844 wrote to memory of 3276	4844	msedge.exe	84
PID 4844 wrote to memory of 2028	4844	msedge.exe	85
PID 4844 wrote to memory of 2028	4844	msedge.exe	85
PID 4844 wrote to memory of 2028	4844	msedge.exe	85
PID 4844 wrote to memory of 240	4844	msedge.exe	87
PID 4844 wrote to memory of 240	4844	msedge.exe	87
PID 4844 wrote to memory of 1404	4844	msedge.exe	88
PID 4844 wrote to memory of 1404	4844	msedge.exe	88
PID 4844 wrote to memory of 1404	4844	msedge.exe	88
PID 4844 wrote to memory of 1456	4844	msedge.exe	89
PID 4844 wrote to memory of 1456	4844	msedge.exe	89
PID 4844 wrote to memory of 1456	4844	msedge.exe	89
PID 4844 wrote to memory of 4960	4844	msedge.exe	91
PID 4844 wrote to memory of 3560	4844	msedge.exe	92
PID 4844 wrote to memory of 4960	4844	msedge.exe	91
PID 4844 wrote to memory of 4960	4844	msedge.exe	91
PID 4844 wrote to memory of 1020	4844	msedge.exe	93
PID 4844 wrote to memory of 3560	4844	msedge.exe	92
PID 4844 wrote to memory of 3560	4844	msedge.exe	92
PID 4844 wrote to memory of 244	4844	msedge.exe	94
PID 4844 wrote to memory of 1020	4844	msedge.exe	93
PID 4844 wrote to memory of 1020	4844	msedge.exe	93
PID 4844 wrote to memory of 244	4844	msedge.exe	94
PID 4844 wrote to memory of 244	4844	msedge.exe	94
PID 4844 wrote to memory of 888	4844	msedge.exe	95
PID 4844 wrote to memory of 888	4844	msedge.exe	95
PID 4844 wrote to memory of 888	4844	msedge.exe	95
PID 4844 wrote to memory of 1632	4844	msedge.exe	96
PID 4844 wrote to memory of 1632	4844	msedge.exe	96
PID 4844 wrote to memory of 3340	4844	msedge.exe	98
PID 4844 wrote to memory of 3340	4844	msedge.exe	98
PID 4504 wrote to memory of 4568	4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe	99
PID 2508 wrote to memory of 3848	2508	pnhfzxspki.exe	102
PID 4844 wrote to memory of 4904	4844	msedge.exe	105
PID 4844 wrote to memory of 1676	4844	msedge.exe	106
PID 4844 wrote to memory of 4904	4844	msedge.exe	105
PID 4844 wrote to memory of 1676	4844	msedge.exe	106
PID 4844 wrote to memory of 1820	4844	msedge.exe	108
PID 4844 wrote to memory of 1220	4844	msedge.exe	109
PID 1220 wrote to memory of 1604	1220	msedge.exe	110
PID 4844 wrote to memory of 3084	4844	msedge.exe	111
PID 4844 wrote to memory of 3084	4844	msedge.exe	111
PID 4844 wrote to memory of 4936	4844	msedge.exe	112
PID 4844 wrote to memory of 4936	4844	msedge.exe	112
PID 4844 wrote to memory of 3672	4844	msedge.exe	113
PID 4844 wrote to memory of 3672	4844	msedge.exe	113
PID 4844 wrote to memory of 4984	4844	msedge.exe	114
PID 4844 wrote to memory of 4984	4844	msedge.exe	114
PID 4844 wrote to memory of 4560	4844	msedge.exe	115
PID 4844 wrote to memory of 4560	4844	msedge.exe	115
PID 4504 wrote to memory of 3948	4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe	116
PID 4504 wrote to memory of 3904	4504	2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe	120
PID 2228 wrote to memory of 4872	2228	ausmkecxus.exe	122
PID 4844 wrote to memory of 2872	4844	msedge.exe	125
PID 4844 wrote to memory of 2872	4844	msedge.exe	125
PID 4844 wrote to memory of 2872	4844	msedge.exe	125
PID 4844 wrote to memory of 4996	4844	msedge.exe	126
PID 4844 wrote to memory of 4996	4844	msedge.exe	126
PID 4844 wrote to memory of 4996	4844	msedge.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_377548aab113ef9b319905007549f3e2_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffe7c29c188,0x7ffe7c29c194,0x7ffe7c29c1a0
      4⤵
      PID:1644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,6060269181962374067,7750894567382485554,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
      4⤵
      System Time Discovery
      PID:3276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,11371795375363114981,15130201593647094142,262144 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:2
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,6654040859655489086,622791004102763740,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:13
      4⤵
      PID:240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,8325728181469153369,14148472486940418225,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,5872760509269843097,4240559941817105414,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,476530951819657073,1495854326454065214,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
      4⤵
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,5574094064777316055,13032240849602891278,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:9
      4⤵
      PID:3560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,4533699905825196367,6213915907328178884,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
      4⤵
      PID:1020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4196,i,17709747527482428997,3977864921307772525,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4780,i,6600642995728172996,10301088131584735150,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:1
      4⤵
      PID:888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,387821357863899259,13456326701063723014,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:1632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,18085958561679609164,7896632097313565804,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:14
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,11350256154789286443,932915543247964824,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,13117150446555179242,13174636310529070467,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:14
      4⤵
      PID:1676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3015295038862242989,12823760924121139118,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,3015295038862242989,12823760924121139118,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,8892140006949363428,7892692946480424279,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        5⤵
        
        PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,1382973761271483757,11335268283396258689,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,15584777427213969172,10605167637802020555,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
      4⤵
      PID:4936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,1114650839949287731,5457434550266983040,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
      4⤵
      PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,12640406392576546434,3540782079456785302,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7578297350462836102,1221583183672741912,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6936,i,5742637081517114947,11471265362249610765,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
      4⤵
      PID:2872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3948,i,732707271577468019,2728931946395946674,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
      4⤵
      PID:4996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6580,i,11776739696766550753,6210383165136164256,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
      4⤵
      PID:1684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,8529271229739839226,2970066498329302225,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:14
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,2662847305888861727,7341100382550586629,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:14
      4⤵
      PID:1580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,12514510193283773128,3366819949285697496,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5560,i,2924303167614700555,16352560967650556693,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:3220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,13527813150650608510,2930653320745733693,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:14
      4⤵
      PID:2896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,4131348282193640982,14473421421734544735,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:14
      4⤵
      PID:3796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,1193362949146066777,15846971912744486312,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3441135628305131741,15931692850670722697,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:14
      4⤵
      PID:1884
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,14032927371329084316,2426590039847531498,262144 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:10
      4⤵
      PID:752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=2368,i,497713514642894034,16829228672333556733,2097152 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,17184052153505898119,4282781753535603952,524288 --field-trial-handle=2132,i,5436110444398179825,2522857178398189592,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
      4⤵
      PID:3912
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:1656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxspki.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4568
- - C:\Temp\pnhfzxspki.exe
    C:\Temp\pnhfzxspki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3848
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:236
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxspki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3948
- - C:\Temp\i_pnhfzxspki.exe
    C:\Temp\i_pnhfzxspki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3904
- - C:\Temp\ausmkecxus.exe
    C:\Temp\ausmkecxus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4872
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4968
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3092
- - C:\Temp\i_ausmkecxus.exe
    C:\Temp\i_ausmkecxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smjecwuomh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Temp\smjecwuomh.exe
    C:\Temp\smjecwuomh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3664
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1056
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smjecwuomh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\i_smjecwuomh.exe
    C:\Temp\i_smjecwuomh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omgezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4696
- - C:\Temp\omgezwrpjh.exe
    C:\Temp\omgezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3708
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omgezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:704
- - C:\Temp\i_omgezwrpjh.exe
    C:\Temp\i_omgezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrdbwtrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4320
- - C:\Temp\ztrdbwtrlj.exe
    C:\Temp\ztrdbwtrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3680
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1604
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1668
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrdbwtrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Temp\i_ztrdbwtrlj.exe
    C:\Temp\i_ztrdbwtrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2740
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jdbvtoljdb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3544
- - C:\Temp\jdbvtoljdb.exe
    C:\Temp\jdbvtoljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2972
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1912
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jdbvtoljdb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Temp\i_jdbvtoljdb.exe
    C:\Temp\i_jdbvtoljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtqlidbvtn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:984
- - C:\Temp\vtqlidbvtn.exe
    C:\Temp\vtqlidbvtn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3396
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtqlidbvtn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2688
- - C:\Temp\i_vtqlidbvtn.exe
    C:\Temp\i_vtqlidbvtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3624
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2968
- - C:\Temp\avsqkicavs.exe
    C:\Temp\avsqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5052
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1868
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:912
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1224
- - C:\Temp\i_avsqkicavs.exe
    C:\Temp\i_avsqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkicaxspkf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2368
- - C:\Temp\mkicaxspkf.exe
    C:\Temp\mkicaxspkf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4040
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4996
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2488
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkicaxspkf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4436
- - C:\Temp\i_mkicaxspkf.exe
    C:\Temp\i_mkicaxspkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\causmkecxu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1340
- - C:\Temp\causmkecxu.exe
    C:\Temp\causmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2620
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_causmkecxu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1524
- - C:\Temp\i_causmkecxu.exe
    C:\Temp\i_causmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezxrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2460
- - C:\Temp\omhezxrpjh.exe
    C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4516
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezxrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2488
- - C:\Temp\i_omhezxrpjh.exe
    C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3224
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wtrmjecwuo.exe ups_run
  2⤵
  PID:3596
- - C:\Temp\wtrmjecwuo.exe
    C:\Temp\wtrmjecwuo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4248
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wtrmjecwuo.exe ups_ins
  2⤵
  PID:4480
- - C:\Temp\i_wtrmjecwuo.exe
    C:\Temp\i_wtrmjecwuo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4428
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jeywqojgbz.exe ups_run
  2⤵
  PID:5008
- - C:\Temp\jeywqojgbz.exe
    C:\Temp\jeywqojgbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2436
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jeywqojgbz.exe ups_ins
  2⤵
  PID:3144
- - C:\Temp\i_jeywqojgbz.exe
    C:\Temp\i_jeywqojgbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ywqoigbytr.exe ups_run
  2⤵
  PID:4520
- - C:\Temp\ywqoigbytr.exe
    C:\Temp\ywqoigbytr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1992
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ywqoigbytr.exe ups_ins
  2⤵
  PID:3624
- - C:\Temp\i_ywqoigbytr.exe
    C:\Temp\i_ywqoigbytr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gavtnlfdyv.exe ups_run
  2⤵
  PID:2832
- - C:\Temp\gavtnlfdyv.exe
    C:\Temp\gavtnlfdyv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1508
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4356
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gavtnlfdyv.exe ups_ins
  2⤵
  PID:4968
- - C:\Temp\i_gavtnlfdyv.exe
    C:\Temp\i_gavtnlfdyv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnidavsqki.exe ups_run
  2⤵
  PID:772
- - C:\Temp\qnidavsqki.exe
    C:\Temp\qnidavsqki.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3244
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3240
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2128
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnidavsqki.exe ups_ins
  2⤵
  PID:3860
- - C:\Temp\i_qnidavsqki.exe
    C:\Temp\i_qnidavsqki.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdxvpnifax.exe ups_run
  2⤵
  PID:1284
- - C:\Temp\fdxvpnifax.exe
    C:\Temp\fdxvpnifax.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3756
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2292
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdxvpnifax.exe ups_ins
  2⤵
  PID:3428
- - C:\Temp\i_fdxvpnifax.exe
    C:\Temp\i_fdxvpnifax.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\caxspkicau.exe ups_run
  2⤵
  PID:4848
- - C:\Temp\caxspkicau.exe
    C:\Temp\caxspkicau.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1804
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2004
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4332
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_caxspkicau.exe ups_ins
  2⤵
  PID:412
- - C:\Temp\i_caxspkicau.exe
    C:\Temp\i_caxspkicau.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2208
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pkecwupmhf.exe ups_run
  2⤵
  PID:744
- - C:\Temp\pkecwupmhf.exe
    C:\Temp\pkecwupmhf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1020
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pkecwupmhf.exe ups_ins
  2⤵
  PID:1872
- - C:\Temp\i_pkecwupmhf.exe
    C:\Temp\i_pkecwupmhf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2124
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezwrpjhbzt.exe ups_run
  2⤵
  PID:1860
- - C:\Temp\ezwrpjhbzt.exe
    C:\Temp\ezwrpjhbzt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3264
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4324
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

C:\Temp\hcaxspkhcz.sys
C:\Temp\hcaxspkhcz.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\czusmkecxr.sys
C:\Temp\czusmkecxr.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\hezxrpjhbz.sys
C:\Temp\hezxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\mhbztrljeb.sys
C:\Temp\mhbztrljeb.sys
1⤵
- Executes dropped EXE
PID:2976

C:\Temp\tqojgbytrl.sys
C:\Temp\tqojgbytrl.sys
1⤵
- Executes dropped EXE
PID:1384

C:\Temp\dbvtnlgdyv.sys
C:\Temp\dbvtnlgdyv.sys
1⤵
- Executes dropped EXE
PID:4400

C:\Temp\vifaysqlfd.sys
C:\Temp\vifaysqlfd.sys
1⤵
- Executes dropped EXE
PID:2064

C:\Temp\fdxvpnicay.sys
C:\Temp\fdxvpnicay.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\snkecxupnh.sys
C:\Temp\snkecxupnh.sys
1⤵
- Executes dropped EXE
PID:3496

C:\Temp\zxrpjhczus.sys
C:\Temp\zxrpjhczus.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\gezwromgec.sys
C:\Temp\gezwromgec.sys
1⤵
PID:2868

C:\Temp\bwrojhbztr.sys
C:\Temp\bwrojhbztr.sys
1⤵
PID:2208

C:\Temp\lgeywqljdb.sys
C:\Temp\lgeywqljdb.sys
1⤵
PID:4364

C:\Temp\qnlgdywqoi.sys
C:\Temp\qnlgdywqoi.sys
1⤵
PID:4660

C:\Temp\dbvtnlgays.sys
C:\Temp\dbvtnlgays.sys
1⤵
PID:4604

C:\Temp\ysnkfdxvpn.sys
C:\Temp\ysnkfdxvpn.sys
1⤵
PID:3360

C:\Temp\nicaxspnhf.sys
C:\Temp\nicaxspnhf.sys
1⤵
PID:1836

C:\Temp\zusmkecxup.sys
C:\Temp\zusmkecxup.sys
1⤵
PID:3060

C:\Temp\pjhbzurmke.sys
C:\Temp\pjhbzurmke.sys
1⤵
PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkecxus.exe

Path C:\Temp\ausmkecxus.exe
Size 230KB
SHA256 ced090b3f7f90073d06b8ae8159bb0d18d484d8125e1338a03e99bfa6c9b56f1
MD5 3e451cb742ae6e403daf3583afe61c60
SHA1 c008dbe08690f23e27296b605c7c5af492e3cbb3
SHA512 6b90d2c2790accca33c650824079584b866a2af013d2debe82d391b71b8e4055e338b7c5057b39fa509985f8aec5d3187e6b13c7c83126ecd9683744fe50e45f
SSDEEP 3072:9JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:9ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F8344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmkecxr.sys

Path C:\Temp\czusmkecxr.sys
Size 141KB
SHA256 13061f9b643000870eb7548df822ef5645e950d49ebbe43a6fe88b2c7c51cd2e
MD5 eea5461ec752643c5407953038c68c95
SHA1 3a50906e8701cbc8906dc54c70a7e06458c381e9
SHA512 e86741ca829143b778f74e00f114f4e04c6b6ede6392ecab58f62cdeb666a902c05f8cc83ebcf7948a679234bc9e572d7e1d7e06e9dcae4a0e8a1588181b26e1
SSDEEP 3072:GsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:GsQmpcF8BzXfwV
TLSH
T19FE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcaxspkhcz.sys

Path C:\Temp\hcaxspkhcz.sys
Size 141KB
SHA256 31a5eb1639a0e4873fdd875784a698736bf7fa255fbcf4cb56f3d9c5472ab2af
MD5 f2f725fd2d60ba4b3be8a968eb840a5f
SHA1 6f531cc7c42f987045fb8f3761baa1dc3402379a
SHA512 a58b342cbe788007abc354a834f4793537cc3d7c880ad1037d527e46e3e4a0c60413b8cf370ca7b607289d63ea84adf4e77086e2c3913a69fa73f805a8d10cb0
SSDEEP 3072:fsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:fsQmpcF8BzXfwV
TLSH
T1C6E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrpjhbz.sys

Path C:\Temp\hezxrpjhbz.sys
Size 141KB
SHA256 2b5a016d4f0732b5106bc41c48903c23f5b66c9391e03fa499f1cf59d648ae4c
MD5 951137729002d9d83fe190db40d7072a
SHA1 0526c3263e0eb477b5e13a59cd2290b9752cb51e
SHA512 7e607ca8529939f1680e241a56dc8c564ec0e9abcada53f98721c9d6da1cad2538d66bb5b78df6a4b8f44af9744dfca099b13ae5cdb3f9d4e501bc6150948f7f
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZy:/sQmpcF8BzXfwV
TLSH
T1EEE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkecxus.exe

Path C:\Temp\i_ausmkecxus.exe
Size 230KB
SHA256 1ac89edbf04259e5707e81578ee9ad50f77aff8f307012112a3337104974bc98
MD5 a7b3e5007378b0dfd8293c4369aa82df
SHA1 a36d3853cd0dd99fa748e1e80cf99035b76d5dd9
SHA512 de8b712c4cf8280676453dac699642c4c790c99692b0bcb320e118efec0be4b654a2a4ea9547ef8f360e46678b6f9463dd4f95a9157bc6cdef4a1f5838dce45b
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgezwrpjh.exe

Path C:\Temp\i_omgezwrpjh.exe
Size 230KB
SHA256 8c936de6437bdf3cccf5fe91a692026c96528cdbf65995c95c54d29d5cd6aef9
MD5 4c0c1f154a0639bade11b33b1f636885
SHA1 0ff60f51322531d8b500cdd3af7bd657232b5568
SHA512 67c7946735be2cdd5399dfe4e9fd177e8a0c456d84cdfe7e4b3c7208ce6cdbc65b802d430026008e79c8ed87108e8f575f33a1de542b2b6fa671ee1483a7f793
SSDEEP 3072:nJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:nghLQ0sQmpcF8BzXfwVfAI
TLSH
T16F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pnhfzxspki.exe

Path C:\Temp\i_pnhfzxspki.exe
Size 230KB
SHA256 7cfd0aa6fe19d1c1487a4aad569c7a37b7caa60f8d33a1273652579630525eff
MD5 170b20b0e43131f2525833e432620b98
SHA1 0d1ad17116f587d8b5e0a59b5bfcff3b6ad01da0
SHA512 550510b97cce394b6d312c2aeda42bf75b85f5fdb2b2f5b6be5fad78122f7a6157624ebf591735723c3f80a774a6b9f08dacf9d49893b3949d87077a8862dbf9
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T115344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_smjecwuomh.exe

Path C:\Temp\i_smjecwuomh.exe
Size 230KB
SHA256 bc5e3b62ca00ba4760b27f08ee364910fd7770cbac86bb4aa1b4ead3687c0731
MD5 aae51ef44430afa6b21f28dbcf5d651b
SHA1 d8e449f375c5dc43f7459a1eb0f6fd4ddd8c7023
SHA512 74bb5c312eec10f7407e00c957c8da09fde50645af80958760ac03f3796e3fbc116e2b2bfc981be2c08f964bc1ac61e53895ee8d96fd5d054a7a4a577bc7bb6e
SSDEEP 3072:4JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:4ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1DB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrdbwtrlj.exe

Path C:\Temp\i_ztrdbwtrlj.exe
Size 230KB
SHA256 7cca8ef623c45cd1d8d78b4b74565a598e897688899c347784578861bb689aea
MD5 94912ac7710f973edd34e55c2c73932c
SHA1 19b5dcf86b7e061d3afaafc6a39da02e19941386
SHA512 3e369bf5f7cfae489e7346f2cd06943ecfd65132f5f880f96aa2b6defa3f31796f8b3b2b91f2d0a622f594cf7a5b7b20f1e581e9f7a0ace51f1150f335296d51
SSDEEP 3072:ZJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ZghLQ0sQmpcF8BzXfwVfAI
TLSH
T166344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhbztrljeb.sys

Path C:\Temp\mhbztrljeb.sys
Size 141KB
SHA256 34ecb868e56d17567834a680b0727932b69b70371b9c2735d00567d38ed034f2
MD5 a0f6a0c29d8ec8684a8e90122e483da6
SHA1 ba9c1d1510cf828e4dfd58a65e5a1afa1a694221
SHA512 d24c598b88575abb00e4802a7cb5b6f7df803613266a3b900aae3e8ecd3f8550111cf4d5f5fae6320200f3b7611d7f0a0b8340bac7ad2b8c0f998100fbfd73e0
SSDEEP 3072:3sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:3sQmpcF8BzXfwV
TLSH
T1EFE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgezwrpjh.exe

Path C:\Temp\omgezwrpjh.exe
Size 230KB
SHA256 38377817981ed36fdb7c6094db5a8c338781360593a1bf19dc55642c0bf3ba55
MD5 2ba6560d39c085f28ac9e9d419d20b00
SHA1 dcc78f5b29b460792766b498a0231cb0b3dc9890
SHA512 1f1f90e415766abab997b6ef2299a132910b4e1ff4d8ba99bd64aae800ed65d58979a90335550bdbe6b90f35b635c2e8bf64a2e25a6ab2051d1f2d679b52a844
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T11D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfzxspki.exe

Path C:\Temp\pnhfzxspki.exe
Size 230KB
SHA256 3ae0dbea7bd9ecc573060f987d3a67fccffa0cb8949b4fccb476a0b9efd84fb5
MD5 ad0a2b2d44b5993e42104121d65f47a3
SHA1 0440d61823acb0ff6f8c97a865038c14df1ff745
SHA512 c2e9a4356ac5c03dd62b422c7413ecc6abecf407dd0161499912fa63178545a4f0b3bf7129647e00e55c1e31c219fa08deba40c2385b95198ab5efd8b1e3568a
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T10A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smjecwuomh.exe

Path C:\Temp\smjecwuomh.exe
Size 230KB
SHA256 4949c8f35512ac43080558a67277d7e46c8fcd0f8ea49dcfeac362cb3b43e4ba
MD5 e10f43406ffc98600440215717bb016e
SHA1 c2f3406b1e3f46972f688f87c5368a058ad25ceb
SHA512 e4d934eab300df527885a43c453b042a4e72b0a782dc597c04e81c441006b8e6135829034ae7da7980f81202292f2a45a64b7b7ce1772c277de77adfe3afa5c0
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T13E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrdbwtrlj.exe

Path C:\Temp\ztrdbwtrlj.exe
Size 230KB
SHA256 aaa4febc88bbe520e8380a85652513c9816df2804c9e190fa3880b9954ba4e95
MD5 325b598f7bf80b485edcba86965be7e1
SHA1 0a352ecfa01b77fa3bb8cf4bc1c8fff28cb5629a
SHA512 9c1c3bdc4337d3b8f3aaa5fa0f7d28f497c34b6508e38ce9ad0be6f11191f71daf4c29f7016e8ef71f09fed20814f138e81204569ef1c949c65751ee26ab6191
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AB344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d4b1f4021efe562889686ca23b343186755c4a3e384d48334452f0e3d84d3486
MD5 ee955f2c936c31e263773fe62d6a83cb
SHA1 47d2c335e07918d44d3d5d60208bd2e8ea91b3c5
SHA512 84d608e59364d37b614631245b5e20358df5bf985a2531a22dba8df4c53ad17ffd7989293c5a9242cbf1c9b5a7688cdb2e89f37edb3cf63a74a244c94c6da653
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 72b205beb453f50e17a365601deeef9544c1fb0a6c7471fff4fe6b93111db2cf
MD5 4545a4b7e84bcd1f6c7395a6930d3c6b
SHA1 26e12977a65c318160cfc591f3cc6ac9c106ebef
SHA512 789954b86c2f406bc6b7f62fd9619c8e956d66ddac2ac5afb6d58654154278baf2404cd620e207faa1dc05510f158069b79ca441afa4f99edcf4da9fa519cfd6
TLSH
T10DD0C02C00B15C25C0C489702841FB063F34D023140B5F3028F32C6C0D41342445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 717eb4940c7fbe87ab8f0b600d1104c8a67cd4b09b0beada521544a45bbe175d
MD5 e9e994edd7a4b5a78b7b4a8f74bbf493
SHA1 df0475a3ce64d76335fb0863982edfd1a11e70b3
SHA512 d35a1536d171822e132b7f0c00b30e123c9a419e2c6192fd28ef0dd75cdabb6e20eeb4fa7c6c6085b4ad1cdf846fedf1ff5eb9437a48a09c77a49de91da73af5
TLSH
T10CD0C02C00F15C25C4C489702840FB063F34D023140B9F3128F32C6C0D42382445B0D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a45ce65ef78883466665ed2696bcca97e529aca73554971faf4e01a66a1a63c5
MD5 ae2ea2499b54fba4dfaa627e94101ee2
SHA1 b3467f66422152c049111549183e5b85fc556d2c
SHA512 6a93999be2d089213ac780839eca850f5ad1013090deb4afdb6514f65ad19c11656f247f285c375c9ff9d1421d3fa860c54e7b060f2f6fc607dfe2ab1392f39a
TLSH
T18871D61DE0B687DAEBE853B446E6D72132F24E5431872ECF06E4817D9D1EBA290BDC04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe583a55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe583a55.TMP
Size 3KB
SHA256 597bcb3069e83c8232a12180da531196bc2bfae72904767d4069a922e847f416
MD5 50e3ccaa6810669cfa057ac8da1ed4fa
SHA1 0d8f28a29c546aab38841d12ea89adc98103e168
SHA512 cab4303bd9177aea68f78c50471152037d7beae5dfdee810f5360892cadee151eeb943cf11776347b589e6c1f34c6e09adc5de55ea5550b3a756dbd658a41cd1
TLSH
T1D971B41DE0B687DAEBE853B446E6D76032F14E4430872ECF06E4817D9D1EBA280BDC04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5fcfd7dfe908b51c1d2655860c0ad555943b464e0e6da32c103cfa4653adb158
MD5 f204a592467cd0fdc527968528182ba3
SHA1 5d652aa85cdaf869c143f321104fbe537ba5821d
SHA512 29e304b56f0c8f3742127fe0ed4ec6362f92cd9772795103f4fdcde43daf13cadd190633a1fd3745ce15f3a151b9731168f44df96966eddfb53d8c495bc5a208
TLSH
T15B41CFF3C2E9856E891155F0BB14BE2BCF2D0954832C3D5AC5E4EF5B93E2470E14155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3e14c6d4095c50f1532b16c4e8058c87583d3d6664f597d93c6c0ebd8ed2e247
MD5 34b31e62934977dae05ef62cd5a046f4
SHA1 ed3b64b2678087d582193047ff35d8a3145e0cd8
SHA512 697a984a80da665079623c42973a661512a9f8c7716eecac4c930f6d2764931835aab4bd693bd37e8b5b8558481a3c71c6ea216615294a969138596a922c3216
SSDEEP 192:sxZRR2yM//K1Ml8McA/fWsyChYrsPQpIdpM/W6+WNGY0FD320Ig4J:sxZRc0A/fWsy+MmQiM/bG51c
TLSH
T13B52F9026A78997BCCDBD209FA45BF53D6F9156392900D44A9FCCA0C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e7309ef226cb10e2f5a974482b219fc641ec0de1f45e64a69308ea9800e9d617
MD5 40fb8663b60985b16e58b241655386d0
SHA1 5ca91e6f90156f243701c4462895a63110af2fc9
SHA512 75244f54bfa62de6db0ed4c631f4405312663a925014e1b35681a06c508a5842ef7ff9625999f6ffbd1dc7d97e3e199d3b951529665ddfed4e6f62e263c0b1c6
SSDEEP 192:sxZRR2yM//K1Ml8UQucA/fWs9ChYrsPQOIdpZC/W6+WNGY0FthWv0Ig55J:sxZR8qNA/fWs9+MmQfM/bG5UwR
TLSH
T13262FA06AA78597BCCDBD219F941BF53D6F9156392500E44AAFCCB0C01E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd05d2ca0866c3d42450aa2409cce11c782fefedb13cd90e8d189d9ac519156b
MD5 c69a78b2046b94a5b204edafd666a8a2
SHA1 81dd0bbed76079d2f0c2ca057d6263d891a5cf8c
SHA512 4d4d835c81341e92142528664da591c30a710931c62984997810fb89ef9049f036b81c0c7bdae14566421d0d86f1e6b1a0a5c97e115da9312dffd52d16a2b25d
SSDEEP 192:sxZRR2yM//K1Ml8McA/fWs9ChYrsPQOIdp/C/W6+WNGY0FFW20Ig5PJ:sxZR80A/fWs9+MmQfa/bG5eL
TLSH
T18552FB06AA78997BCCDBD219FA45BF53D6F9156392500D449AFCCA0C01E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 7330cdd88393512b322d00ecaf5ea14067af6d697240bb84fb8e134ec31f26af
MD5 aca230152223394b1ceb31c81fc3b3f1
SHA1 c47db6c141734bb75464da1a069bf53f39678d87
SHA512 42daaaf768ba92a59e8755a2cb2d8b80a044a3bbfdcd0f95722be6097426f630f9eaee6f37b75d3854050eede393b79540dad7d436df2155722285cbf0f7f7b9
SSDEEP 768:TOP7x8t12l57pLuLno0WRmoMQ3A8F1+UoAYDCx9Tuqh0VfUC9xbog/OV30xizLlh:TOP7x8t12lPEno0WRmoMQ3Au1jaK0xiH
TLSH
T1C0031C3B284CCB7E4F804E9CDC26AE9A6DE802CF56A8895447FA484C03C67EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3525e1607d37b81d23dddbd077c75801557b263542ea80c34ea5eedaffde7fc4
MD5 b1c06ec2b0804b83bf3e498bae7ee357
SHA1 a9ffd56efbe40db048ed69910132b43f3bab347c
SHA512 9a1e89b20d73eb1a6e1d22d8f919628f940845e4c4eaa985de62484819a795471e13535a77e199659a009652ed0e3e71290aed76a0a862c3cbc581a4fdac8691
SSDEEP 96:K84YKhq+ub+KgUyuFuK2gRjWKUQWGpuKCoe:y7xN1PVVb
TLSH
T1A0E1E051F13A53813A7D699A85E0B47E02C334637028A43B7BBA41A60F67E10DEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58d54c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58d54c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

office_endpoints_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2.0.0.0\office_endpoints_list.json
Size 3KB
SHA256 8480f3d58faa017896ba8239f3395e3551325d7a6466497a9a69bf182647b25e
MD5 94406cdd51b55c0f006cfea05745effb
SHA1 a15dc50ca0fd54d6f54fbc6e0788f6dcfc876cc9
SHA512 d4e621f57454fea7049cffc9cc3adfb0d8016360912e6a580f6fe16677e7dd7aa2ee0671cb3c5092a9435708a817f497c3b2cc7aba237d32dbdaae82f10591c3
TLSH
T1F681BE27C5B58E2796F060119750E654F53D43AFA600C6AFB5FC825C2F373ECE88A4A8
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3b634b5b6598c3bea5638c543add54d7fd5ebfce75c6ccf0e3fb667713b680e8
MD5 a9226bcd9ca75c8ecdd3da8f78991508
SHA1 defd300f41dc179c2a1d19215bbc8632b974ed7e
SHA512 219a4e2743667addc767a0d595e4d41b7dfd0f41efe8babca88a4e885f9f64fff226db1e2295716c9e0e398b74d3d8ff164b09789346a58ca0f2c7bfc554c7f4
SSDEEP 384:n5jccCs+Bt0S3b8N+6ATQV5S2Y/Fk8kDNabeJKmYKGUf3w:5ccQ7WSb/FkPDNa3Klw
TLSH
T124827C3528F85C7B99E39518F18B33936FB410F79A806F64E9E95F1D00CA69C2717827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6adc10b984ab116d1ed68bb3ce23a56aac4975dae94815cb707e593e06e0cbd7
MD5 cce9902ccb72c41f02a9ae855b422559
SHA1 5a6eca51a7c45dfefbc7da90e63dcb39a29cede8
SHA512 579815c80dd822a32d8159bdedcbd94a41789413cc8b0c068bb172f93a98de03caf0d2df41b90f9d375a29ff9d25cd219c929e77e78aad72b65834b65dc0219a
SSDEEP 192:zTGN+1PtQv1QmiU1WwGZY/Fl8V38SAnFgqfhNaU8:zTGN+1FQLj8Y/Fk85DNaU8
TLSH
T1FC22F83468B8AC775DE3A554F08777535E7410B79E84AF64DAE91B1C00CB69C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9c19abadb0f7c90dfa181f58f37980201baac52b096f1ebd7ac1ec1744301c79
MD5 25ff59606a66c443d91e831f5e7b7c10
SHA1 76348ecaf6b1ceb8aeb36f8c3167318cff3b63ed
SHA512 50560b4e55c410a1e6a41df3a91ae8d1be583dfe63e0bac8c2e91f5e01bf690012f6d65375fc18736e076770355386726a867369334b1096560fd912d2200023
SSDEEP 192:ZGNG6Pt3QmiUy2cEqB/Fl8V3t7rgJC5U6:ZGNG6FZ57qB/FkVeC5U6
TLSH
T17702FB3468B86C779EE39E55B487B7135FA4206BDAA45F94DAE81B1D00D768C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 cf92e5e405ec8948b14c6d2ae8aa2206b2a8cab77726a768f2661a37a6fb0917
MD5 0f20fce72f56c6b82e42f9a124ac5b81
SHA1 60d014b80abf6588c5c58952989d3c308332bc23
SHA512 3934d7702a95a79d10da6d25fa0acfaa4f1d66aae0cbc757cc5a6a8ef1a4002ca5fa61e81d16ce6c454679f52e61ae2aef4f86febd8a371e6f35bb1dd170c118
SSDEEP 384:n1jccCs+Bt0S3N8N+xATQnb5S2Y/Fk86DNabeJKmYKGUf3w:lccQtpSb/FktDNa3Klw
TLSH
T1D8826C3528E85C7B99E39418F18B37936FB410F79A802F64D9E95F1D00CA69C2717827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9901cbe9bf8890dd8f3be1a7e0073c7a9fda25765396bc50f1d989daf15dfa9a
MD5 0e7afa89f7424d74eca46a228fe1fe20
SHA1 ab7d3efdf03a705c0fcfb487afbe77c3b7159caf
SHA512 33129a639d87c0078b4f5323393e707e14143e88e937ffd858d414489e9dfcf37dd445ab4f55fc33b9f333fae25ba011d1a65abc6eba405eeed9e32f78c42604
SSDEEP 384:n1jccCs+Bt0S3E8N+xATQxb5S2Y/Fk86DNabeJKmYKGUf3w:lccQk3Sb/FktDNa3Klw
TLSH
T15E826C3528E85C7B99E39518F18B37936FB410F79A802F64E9E95F1D00CA69C2B17827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9c2cba032500d6c0ce131ba42b52d087d828e319193802f55832e345b67c9f6a
MD5 5ab4bc8f146b8ae66b13d9fbd2bb11d0
SHA1 eb9d118b3c57bc37bd31d1eb6ea0dda434729933
SHA512 a0b24f1534de1cf3863820652cbf8a693b665444828c34f9e76b73c9dde9b355929da03d15c314ccecfa25933b202374440dcaf8009827139ee56cc0cea07160
SSDEEP 384:nOjccCs+Bt0S3b8N+uATQzb5S2Y/Fk86DNabeJKmYKGUf3w:4ccQ7sSb/FktDNa3Klw
TLSH
T1C9826C3568F85C7B99E39418F18B37936FB410F79A802F64E9E95F1D00CA69C2717827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 14e8900520dc1e9753c4d7464fbb0c749fda632ecbc5ecf0c72a94b647f3af71
MD5 bd49f80e48baeb27d42453d3410b41c2
SHA1 645083f4ce68b2a3d82b724585036e87e8bd5491
SHA512 f279005a7d17d25b48cca587c4f43ed5467c6c085296e01f028c9b6e58c1189a99ecb0988fe126d18ebadd18658a392325f6812fc165587a595b6e3fcfb06da3
SSDEEP 384:nfiFejccCs+Bt0S3t8NO8TUNTUlIlxATQd5S2qDfwP/Fk8dMDNabeJKmYKGUf3w:qFIccQNvwgfSGP/FkEMDNa3Klw
TLSH
T1D7B23A36D8E4CD3BADE38B95B24B76839EF010A78A88AED4D9D95E0C00875DD1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0583c0fef00040e06dbcacbb2b19ba4a1a2e49c3ebf255bc2d43dc28ef8554e2
MD5 565b706f884478ecb032b4d7b008f532
SHA1 657e68ea430a3ff07dab5c4447358ec92c8f62e0
SHA512 f3de2c53b4890c9fe0cd4e9c94eadff7f2bf9cc21fae052130d140075aa1c3495fd8a2c945b055a57e5cad505f822588f9a350a1494d7213ef56086afe41682c
SSDEEP 192:oGNP6Pt3QmiUy1nErB/Fl8V38SAn4gqfhNaU6:oGNP6FZYErB/Fk80DNaU6
TLSH
T1CC121A3478B8AC775DD3A954B08777535EB420BBDE84AF64DAE81B1D04CB68C270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 30e8b5d48a130d6bf81847b89c208c7a087525e9b7d9a0a97bcf21598332b63b
MD5 bf165c172af1f75083dd4c7e8915ad0e
SHA1 2eb27e18672fd0a1816ab00d00078a570eb62711
SHA512 a58ad7ee2e18750242b9c5d53224218bef54ecd50e067170da12510559c455979fb0523044d4c23d5d5a523562165e471f95d939376df623bfdea9228ca25256
TLSH
T181F09ED29D7E36C0D6E50F6ED44B64FC40D89506F05CB579484CEAD8913950B254287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

05ea31d1-c460-4c10-8bc4-eb3857713197.tmp

Path C:\Users\Admin\AppData\Local\Temp\05ea31d1-c460-4c10-8bc4-eb3857713197.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79f2ba16-70e5-424b-aab1-9226e54a6a2f.tmp

Path C:\Users\Admin\AppData\Local\Temp\79f2ba16-70e5-424b-aab1-9226e54a6a2f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

f363df9c-2b3c-411d-bdc0-002107540de1.tmp

Path C:\Users\Admin\AppData\Local\Temp\f363df9c-2b3c-411d-bdc0-002107540de1.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4844_1039281522\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1715319955\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_1950791000\manifest.json
Size 160B
SHA256 2a7fe18a087d8e8be847d9569420b6e8907917ff6ca0fa42be15d4e3653c8747
MD5 a24a1941bbb8d90784f5ef76712002f5
SHA1 5c2b6323c7ed8913b5d0d65a4d21062c96df24eb
SHA512 fd7dfec3d46b2af0bddb5aaeae79467507e0c29bab814007a39ea61231e76123659f18a453ed3feb25f16652a0c63c33545e2a0d419fafea89f563fca6a07ce2
TLSH
T133C04C23ED18BABA12F587D40971DB43F7F0031B34E169463B39948C5F761B8925175A
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_2010252461\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4844_992117852\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

memory/412-919-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/704-596-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/744-923-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/772-860-0x0000000000630000-0x00000000006F2000-memory.dmp

Download

memory/984-656-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/1020-922-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/1224-677-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/1284-879-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/1340-713-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/1384-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1392-763-0x00000000009E0000-0x0000000000AA2000-memory.dmp

Download

memory/1456-740-0x0000000000A20000-0x0000000000AE2000-memory.dmp

Download

memory/1524-737-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/1604-622-0x0000000000830000-0x00000000008F2000-memory.dmp

Download

memory/1692-629-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/1820-539-0x00000225BD4D0000-0x00000225BD848000-memory.dmp

Download

memory/1820-540-0x00000225BD4D0000-0x00000225BD848000-memory.dmp

Download

memory/1836-899-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1860-955-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/1868-662-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/1872-950-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/1912-632-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/1912-583-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1992-819-0x00000000009C0000-0x0000000000A82000-memory.dmp

Download

memory/2004-901-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/2064-679-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-660-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2064-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2208-786-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2232-655-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/2292-878-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/2324-589-0x00000000008A0000-0x0000000000962000-memory.dmp

Download

memory/2368-698-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/2436-788-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2460-741-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2488-760-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/2620-712-0x00000000009E0000-0x0000000000AA2000-memory.dmp

Download

memory/2688-659-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/2832-837-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/2868-761-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2968-663-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/2976-598-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3060-952-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3060-920-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3092-542-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/3144-808-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/3240-859-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3360-678-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3360-875-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3428-898-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/3496-702-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3544-633-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3596-772-0x00000000009F0000-0x0000000000AB2000-memory.dmp

Download

memory/3624-823-0x0000000000980000-0x0000000000A42000-memory.dmp

Download

memory/3680-490-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3848-83-0x00000000008D0000-0x0000000000992000-memory.dmp

Download

memory/3860-874-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/3904-529-0x0000000000840000-0x0000000000902000-memory.dmp

Download

memory/3948-488-0x00000000009B0000-0x0000000000A72000-memory.dmp

Download

memory/4204-550-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4236-951-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4320-623-0x0000000000990000-0x0000000000A52000-memory.dmp

Download

memory/4324-954-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/4356-836-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/4364-809-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4400-637-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4436-701-0x00000000009F0000-0x0000000000AB2000-memory.dmp

Download

memory/4520-820-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4568-84-0x00000000008E0000-0x00000000009A2000-memory.dmp

Download

memory/4604-849-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4604-876-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4660-824-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4696-590-0x0000000000850000-0x0000000000912000-memory.dmp

Download

memory/4836-581-0x0000000000900000-0x00000000009C2000-memory.dmp

Download

memory/4848-902-0x0000000000960000-0x0000000000A22000-memory.dmp

Download

memory/4864-551-0x0000000000860000-0x0000000000922000-memory.dmp

Download

memory/4872-528-0x00000000008D0000-0x0000000000992000-memory.dmp

Download

memory/4968-848-0x00000000009A0000-0x0000000000A62000-memory.dmp

Download

memory/4996-697-0x0000000000820000-0x00000000008E2000-memory.dmp

Download

memory/5008-789-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/5008-738-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5028-636-0x0000000000960000-0x0000000000A22000-memory.dmp

Download