systex | 52b775e52c94c7b76db2d61580d9fbbbd8ae0a56300ed8a63f80d51d26aeb663

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
Size 248KB
Sample260415-xd65ragw4p
SHA256 52b775e52c94c7b76db2d61580d9fbbbd8ae0a56300ed8a63f80d51d26aeb663
MD5 18b6e8fa87cfc1a0973e5d8d77ae296f
SHA1 1667b13b4c527b8faf0727c491abe53b2e7eb6a1
SHA512 261a6c8862b4b2a4d5879912ac2aa5cc98c8eb6f905d12e271529dab3a73624dfc986aa011ea3e6014a1aa2a61846567838f82d03cc0fe896f57aa4b7f07c37f
SSDEEP 3072:hJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njb:hghLQ0sQmpcF8BzXfwVfAIPjb
TLSH
T1D4446B1172809031E3664B740856EBA1467EBD354BA2DACFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5960	CP.exe
4672	czusmhbzrm.exe
3064	CP.exe
1120	CP.exe
2476	i_czusmhbzrm.exe
2496	pjhbzmjhbz.sys
2964	CP.exe
4444	wrojgbztrm.exe
3952	CP.exe
1632	CP.exe
5320	i_wrojgbztrm.exe
3124	bwqojgbztr.sys
3300	CP.exe
4428	oeytrljdbv.exe
2412	CP.exe
4272	CP.exe
2364	i_oeytrljdbv.exe
1912	olgeywqoig.sys
1544	CP.exe
5672	dbvtolgeyw.exe
5568	CP.exe
1488	CP.exe
5400	i_dbvtolgeyw.exe
4020	aytqljdbvt.sys
5012	CP.exe
4540	oidavtnlfd.exe
4560	CP.exe
3472	CP.exe
4636	i_oidavtnlfd.exe
4012	sicavsnlfd.sys
560	CP.exe
2216	dysqkicavs.exe
5780	CP.exe
2232	CP.exe
5932	i_dysqkicavs.exe
4552	icavsnlfay.sys
4556	CP.exe
4788	nkfdxvpnhf.exe
5316	CP.exe
2592	CP.exe
832	i_nkfdxvpnhf.exe
3132	vpnhfzxspk.sys
5864	CP.exe
3448	kfcxvpnhfz.exe
4328	CP.exe
656	CP.exe
3688	i_kfcxvpnhfz.exe
3168	cxupmhfzxr.sys
4836	CP.exe
4000	pjhczxrpke.exe
4384	CP.exe
4592	CP.exe
3456	i_pjhczxrpke.exe
2936	pjhbzurmje.sys
5360	CP.exe
5844	hbztrmjecw.exe
2692	CP.exe
4424	CP.exe
4884	i_hbztrmjecw.exe
2752	mgezwrpjhb.sys
5276	CP.exe
1212	qomgeywqoj.exe
5924	CP.exe
5652	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1656699406\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_544711749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1656699406\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1875775165\regex_patterns.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4780_471448759\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_544711749\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1875775165\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1339219101\_locales\iw\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezurmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czusmhbzrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czusmhbzrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mgezwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oeytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausnkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgezwrojhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcxvpnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhczxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomgeywqoj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oeytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hcausnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezurmgecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhczxrpke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdysqlidbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbztrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojgbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3352	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5540	ipconfig.exe
1340	ipconfig.exe
1792	ipconfig.exe
2064	ipconfig.exe
892	ipconfig.exe
1568	ipconfig.exe
3552	ipconfig.exe
4884	ipconfig.exe
4976	ipconfig.exe
2856	ipconfig.exe
1956	ipconfig.exe
3648	ipconfig.exe
4136	ipconfig.exe
1040	ipconfig.exe
384	ipconfig.exe
2512	ipconfig.exe
4476	ipconfig.exe
2472	ipconfig.exe
6140	ipconfig.exe
3988	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 48 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31247712"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2739448223"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "5140"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207546140080036"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2397528088-2630719772-1129911217-1000\{0405025C-C038-4C14-A3B0-CB8B925B751C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe
4672	czusmhbzrm.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe
4780	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	i_czusmhbzrm.exe
Token: SeDebugPrivilege	5320	i_wrojgbztrm.exe
Token: SeDebugPrivilege	2364	i_oeytrljdbv.exe
Token: SeDebugPrivilege	5400	i_dbvtolgeyw.exe
Token: SeDebugPrivilege	4636	i_oidavtnlfd.exe
Token: SeDebugPrivilege	5932	i_dysqkicavs.exe
Token: SeDebugPrivilege	832	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	3688	i_kfcxvpnhfz.exe
Token: SeDebugPrivilege	3456	i_pjhczxrpke.exe
Token: SeDebugPrivilege	4884	i_hbztrmjecw.exe
Token: SeDebugPrivilege	864	i_qomgeywqoj.exe
Token: SeDebugPrivilege	5744	i_ojgbztrljd.exe
Token: SeDebugPrivilege	4564	i_gdysqlidbv.exe
Token: SeDebugPrivilege	2916	i_sqkicavsnl.exe
Token: SeDebugPrivilege	2024	i_icausnkfcx.exe
Token: SeDebugPrivilege	4728	i_hcausnkfdx.exe
Token: SeDebugPrivilege	3104	i_pmhfzxrpkh.exe
Token: SeDebugPrivilege	2432	i_ezurmgecwu.exe
Token: SeDebugPrivilege	3156	i_mgezwrojhb.exe
Token: SeDebugPrivilege	4476	i_gbztrojhbz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2596	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	79
PID 2552 wrote to memory of 2400	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	80
PID 2400 wrote to memory of 4780	2400	iexplore.exe	81
PID 2596 wrote to memory of 4344	2596	iexplore.exe	82
PID 4780 wrote to memory of 2424	4780	msedge.exe	83
PID 4780 wrote to memory of 3352	4780	msedge.exe	84
PID 4780 wrote to memory of 5148	4780	msedge.exe	85
PID 4780 wrote to memory of 5148	4780	msedge.exe	85
PID 4780 wrote to memory of 5148	4780	msedge.exe	85
PID 4780 wrote to memory of 4116	4780	msedge.exe	87
PID 4780 wrote to memory of 4116	4780	msedge.exe	87
PID 4780 wrote to memory of 2120	4780	msedge.exe	88
PID 4780 wrote to memory of 2120	4780	msedge.exe	88
PID 4780 wrote to memory of 2080	4780	msedge.exe	89
PID 4780 wrote to memory of 2120	4780	msedge.exe	88
PID 4780 wrote to memory of 2080	4780	msedge.exe	89
PID 4780 wrote to memory of 2080	4780	msedge.exe	89
PID 4780 wrote to memory of 1264	4780	msedge.exe	90
PID 4780 wrote to memory of 1264	4780	msedge.exe	90
PID 4780 wrote to memory of 1264	4780	msedge.exe	90
PID 4780 wrote to memory of 1648	4780	msedge.exe	92
PID 4780 wrote to memory of 1648	4780	msedge.exe	92
PID 4780 wrote to memory of 1568	4780	msedge.exe	93
PID 4780 wrote to memory of 1568	4780	msedge.exe	93
PID 2552 wrote to memory of 5960	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	94
PID 4672 wrote to memory of 3064	4672	czusmhbzrm.exe	97
PID 4780 wrote to memory of 2092	4780	msedge.exe	100
PID 2092 wrote to memory of 4604	2092	msedge.exe	101
PID 4780 wrote to memory of 5164	4780	msedge.exe	103
PID 2552 wrote to memory of 1120	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	106
PID 2552 wrote to memory of 2964	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	110
PID 4444 wrote to memory of 3952	4444	wrojgbztrm.exe	112
PID 2552 wrote to memory of 1632	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	115
PID 2552 wrote to memory of 3300	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4428 wrote to memory of 2412	4428	oeytrljdbv.exe	121
PID 2552 wrote to memory of 4272	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 2552 wrote to memory of 1544	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 5672 wrote to memory of 5568	5672	dbvtolgeyw.exe	130
PID 2552 wrote to memory of 1488	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 4780 wrote to memory of 3496	4780	msedge.exe	135
PID 4780 wrote to memory of 4552	4780	msedge.exe	136
PID 4780 wrote to memory of 5716	4780	msedge.exe	137
PID 4780 wrote to memory of 3824	4780	msedge.exe	138
PID 4780 wrote to memory of 3824	4780	msedge.exe	138
PID 4780 wrote to memory of 4044	4780	msedge.exe	141
PID 4780 wrote to memory of 4044	4780	msedge.exe	141
PID 2552 wrote to memory of 5012	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 4540 wrote to memory of 4560	4540	oidavtnlfd.exe	144
PID 2552 wrote to memory of 3472	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 2552 wrote to memory of 560	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 2216 wrote to memory of 5780	2216	dysqkicavs.exe	153
PID 2552 wrote to memory of 2232	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 2552 wrote to memory of 4556	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 4788 wrote to memory of 5316	4788	nkfdxvpnhf.exe	162
PID 2552 wrote to memory of 2592	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 2552 wrote to memory of 5864	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3448 wrote to memory of 4328	3448	kfcxvpnhfz.exe	171
PID 2552 wrote to memory of 656	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 4780 wrote to memory of 3824	4780	msedge.exe	176
PID 4780 wrote to memory of 3824	4780	msedge.exe	176
PID 2552 wrote to memory of 4836	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 4000 wrote to memory of 4384	4000	pjhczxrpke.exe	183
PID 2552 wrote to memory of 4592	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	186
PID 2552 wrote to memory of 5360	2552	2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe	190

C:\Users\Admin\AppData\Local\Temp\2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_18b6e8fa87cfc1a0973e5d8d77ae296f_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    PID:4344
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x34c,0x7ffd52abc188,0x7ffd52abc194,0x7ffd52abc1a0
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,15610940003686762170,17948046345519311422,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
      4⤵
      System Time Discovery
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,9992289017208541988,2104579081965772910,262144 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
      4⤵
      PID:5148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,7911893399103536594,5963271089887944284,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,3533257839198415575,14889442407316474591,2097152 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,17422404397362235938,4793866524326206984,2097152 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
      4⤵
      PID:2080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,5113788257746651191,11507237156075104678,2097152 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,8569407003036054984,8662822997702465432,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      PID:1648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,14806450467111551043,14220015135427061648,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
      4⤵
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,120751331301722259,17206074327862891086,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2092
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        5⤵
        
        PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12798495175788922105,18351347028782525645,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,12798495175788922105,18351347028782525645,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:5164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,9615246401629680356,16277528647825748892,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,11985555187234631500,8691611782829306006,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3298989006633517788,16464596001095749752,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,1954031673864865174,14810290481872607568,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=728 /prefetch:14
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,7867037627411456787,3101947982669534091,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
      4⤵
      PID:4044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,7043557722606163518,8176398310848165512,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:3824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,9868560208546198930,12547612335063461516,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,116692626359885355,4862542528815166188,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=868 /prefetch:14
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5808,i,3142385617932043433,8666256173339206419,262144 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:10
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,17138378978013119579,18192340639714508640,524288 --field-trial-handle=2052,i,8253758396962558994,15245507152268184264,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\czusmhbzrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5960
- - C:\Temp\czusmhbzrm.exe
    C:\Temp\czusmhbzrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3064
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4976
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_czusmhbzrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1120
- - C:\Temp\i_czusmhbzrm.exe
    C:\Temp\i_czusmhbzrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojgbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2964
- - C:\Temp\wrojgbztrm.exe
    C:\Temp\wrojgbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3952
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2856
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojgbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1632
- - C:\Temp\i_wrojgbztrm.exe
    C:\Temp\i_wrojgbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oeytrljdbv.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3300
- - C:\Temp\oeytrljdbv.exe
    C:\Temp\oeytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4476
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oeytrljdbv.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4272
- - C:\Temp\i_oeytrljdbv.exe
    C:\Temp\i_oeytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2364
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbvtolgeyw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1544
- - C:\Temp\dbvtolgeyw.exe
    C:\Temp\dbvtolgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5568
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2472
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbvtolgeyw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1488
- - C:\Temp\i_dbvtolgeyw.exe
    C:\Temp\i_dbvtolgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\oidavtnlfd.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5012
- - C:\Temp\oidavtnlfd.exe
    C:\Temp\oidavtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4560
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:892
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_oidavtnlfd.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3472
- - C:\Temp\i_oidavtnlfd.exe
    C:\Temp\i_oidavtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4636
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dysqkicavs.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:560
- - C:\Temp\dysqkicavs.exe
    C:\Temp\dysqkicavs.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5780
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dysqkicavs.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Temp\i_dysqkicavs.exe
    C:\Temp\i_dysqkicavs.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5932
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvpnhf.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4556
- - C:\Temp\nkfdxvpnhf.exe
    C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4788
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2592
- - C:\Temp\i_nkfdxvpnhf.exe
    C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kfcxvpnhfz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5864
- - C:\Temp\kfcxvpnhfz.exe
    C:\Temp\kfcxvpnhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4328
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kfcxvpnhfz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:656
- - C:\Temp\i_kfcxvpnhfz.exe
    C:\Temp\i_kfcxvpnhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pjhczxrpke.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4836
- - C:\Temp\pjhczxrpke.exe
    C:\Temp\pjhczxrpke.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4384
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3648
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pjhczxrpke.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4592
- - C:\Temp\i_pjhczxrpke.exe
    C:\Temp\i_pjhczxrpke.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hbztrmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5360
- - C:\Temp\hbztrmjecw.exe
    C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5844
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2692
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hbztrmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4424
- - C:\Temp\i_hbztrmjecw.exe
    C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qomgeywqoj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5276
- - C:\Temp\qomgeywqoj.exe
    C:\Temp\qomgeywqoj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1212
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4136
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qomgeywqoj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5652
- - C:\Temp\i_qomgeywqoj.exe
    C:\Temp\i_qomgeywqoj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojgbztrljd.exe ups_run
  2⤵
  PID:4704
- - C:\Temp\ojgbztrljd.exe
    C:\Temp\ojgbztrljd.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2680
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1792
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojgbztrljd.exe ups_ins
  2⤵
  PID:2500
- - C:\Temp\i_ojgbztrljd.exe
    C:\Temp\i_ojgbztrljd.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5744
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdysqlidbv.exe ups_run
  2⤵
  PID:984
- - C:\Temp\gdysqlidbv.exe
    C:\Temp\gdysqlidbv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1132
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1188
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdysqlidbv.exe ups_ins
  2⤵
  PID:5596
- - C:\Temp\i_gdysqlidbv.exe
    C:\Temp\i_gdysqlidbv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\sqkicavsnl.exe ups_run
  2⤵
  PID:1576
- - C:\Temp\sqkicavsnl.exe
    C:\Temp\sqkicavsnl.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5168
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6044
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_sqkicavsnl.exe ups_ins
  2⤵
  PID:244
- - C:\Temp\i_sqkicavsnl.exe
    C:\Temp\i_sqkicavsnl.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icausnkfcx.exe ups_run
  2⤵
  PID:5428
- - C:\Temp\icausnkfcx.exe
    C:\Temp\icausnkfcx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4036
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4536
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4884
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icausnkfcx.exe ups_ins
  2⤵
  PID:5332
- - C:\Temp\i_icausnkfcx.exe
    C:\Temp\i_icausnkfcx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2024
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hcausnkfdx.exe ups_run
  2⤵
  PID:5304
- - C:\Temp\hcausnkfdx.exe
    C:\Temp\hcausnkfdx.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5576
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1944
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1040
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hcausnkfdx.exe ups_ins
  2⤵
  PID:3820
- - C:\Temp\i_hcausnkfdx.exe
    C:\Temp\i_hcausnkfdx.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfzxrpkh.exe ups_run
  2⤵
  PID:5228
- - C:\Temp\pmhfzxrpkh.exe
    C:\Temp\pmhfzxrpkh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1528
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3940
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfzxrpkh.exe ups_ins
  2⤵
  PID:832
- - C:\Temp\i_pmhfzxrpkh.exe
    C:\Temp\i_pmhfzxrpkh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3104
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezurmgecwu.exe ups_run
  2⤵
  PID:3880
- - C:\Temp\ezurmgecwu.exe
    C:\Temp\ezurmgecwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1184
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3404
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:384
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezurmgecwu.exe ups_ins
  2⤵
  PID:5484
- - C:\Temp\i_ezurmgecwu.exe
    C:\Temp\i_ezurmgecwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mgezwrojhb.exe ups_run
  2⤵
  PID:4984
- - C:\Temp\mgezwrojhb.exe
    C:\Temp\mgezwrojhb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1896
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mgezwrojhb.exe ups_ins
  2⤵
  PID:3600
- - C:\Temp\i_mgezwrojhb.exe
    C:\Temp\i_mgezwrojhb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gbztrojhbz.exe ups_run
  2⤵
  PID:4632
- - C:\Temp\gbztrojhbz.exe
    C:\Temp\gbztrojhbz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5636
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3988
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gbztrojhbz.exe ups_ins
  2⤵
  PID:3220
- - C:\Temp\i_gbztrojhbz.exe
    C:\Temp\i_gbztrojhbz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4784

C:\Temp\pjhbzmjhbz.sys
C:\Temp\pjhbzmjhbz.sys
1⤵
- Executes dropped EXE
PID:2496

C:\Temp\bwqojgbztr.sys
C:\Temp\bwqojgbztr.sys
1⤵
- Executes dropped EXE
PID:3124

C:\Temp\olgeywqoig.sys
C:\Temp\olgeywqoig.sys
1⤵
- Executes dropped EXE
PID:1912

C:\Temp\aytqljdbvt.sys
C:\Temp\aytqljdbvt.sys
1⤵
- Executes dropped EXE
PID:4020

C:\Temp\sicavsnlfd.sys
C:\Temp\sicavsnlfd.sys
1⤵
- Executes dropped EXE
PID:4012

C:\Temp\icavsnlfay.sys
C:\Temp\icavsnlfay.sys
1⤵
- Executes dropped EXE
PID:4552

C:\Temp\vpnhfzxspk.sys
C:\Temp\vpnhfzxspk.sys
1⤵
- Executes dropped EXE
PID:3132

C:\Temp\cxupmhfzxr.sys
C:\Temp\cxupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:3168

C:\Temp\pjhbzurmje.sys
C:\Temp\pjhbzurmje.sys
1⤵
- Executes dropped EXE
PID:2936

C:\Temp\mgezwrpjhb.sys
C:\Temp\mgezwrpjhb.sys
1⤵
- Executes dropped EXE
PID:2752

C:\Temp\wtolgeywqo.sys
C:\Temp\wtolgeywqo.sys
1⤵
PID:4324

C:\Temp\qoigaysqli.sys
C:\Temp\qoigaysqli.sys
1⤵
PID:6084

C:\Temp\davsnlfdxv.sys
C:\Temp\davsnlfdxv.sys
1⤵
PID:1020

C:\Temp\aysqkidavt.sys
C:\Temp\aysqkidavt.sys
1⤵
PID:772

C:\Temp\snkfdxvpnh.sys
C:\Temp\snkfdxvpnh.sys
1⤵
PID:3432

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
PID:5524

C:\Temp\mkecwupmge.sys
C:\Temp\mkecwupmge.sys
1⤵
PID:3176

C:\Temp\eztrmjecwu.sys
C:\Temp\eztrmjecwu.sys
1⤵
PID:320

C:\Temp\uomgeywroj.sys
C:\Temp\uomgeywroj.sys
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aytqljdbvt.sys

Path C:\Temp\aytqljdbvt.sys
Size 141KB
SHA256 842d043935299aa344b05334080893ea435bcad32a9505f01479f6aee6d63e2f
MD5 a01434d5f98c69b3377e8f617110c3b3
SHA1 c0dea1b8291ccfbad282febd5bcab94ff072322f
SHA512 df4e29a6dd87988f9812a2b9a84f3d228e1a150e8940eed56e79a2973899efb62f8a3adb181bea9ee2214dcd0f58cfe0ce884c1b0acf7aec7950cf721510143f
SSDEEP 3072:PsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:PsQmpcF8BzXfwV
TLSH
T108E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwqojgbztr.sys

Path C:\Temp\bwqojgbztr.sys
Size 141KB
SHA256 b77507c1d5b112420fef6a17fa54ae2ff0fc2bed808d7336bf2cc6de6f806a17
MD5 764528b97f5517853c42579545f9699d
SHA1 563bf24f24e41be26657a864ee00d433f7129161
SHA512 c8ff74b7401f6de80a520b3ad4e1d07d8286e7f9a886c921b439102edf0c61c1b7f69b28251d776480ebd37c97d89b7cc2456441c7709fe3b32f230d9b622d5e
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T1ADE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czusmhbzrm.exe

Path C:\Temp\czusmhbzrm.exe
Size 248KB
SHA256 63eb339a0979687cb89dd3b9178a4accca7532c0a526c2dcf35f02b88dc9e10f
MD5 374fd363747879dddecc725083e15eb3
SHA1 ce1e76da8a832c01373a669097425fe7f9b3028d
SHA512 3102c4b70891f76a18ba85ce6cbff99011ee38ca14172f643e5ed24195b95ab57603ef9635b8b85a010490ed160f5d8750f80a6b8e2f55e94f444255d008da8b
SSDEEP 3072:oJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njs:oghLQ0sQmpcF8BzXfwVfAIPjs
TLSH
T17C446B1172809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtolgeyw.exe

Path C:\Temp\dbvtolgeyw.exe
Size 248KB
SHA256 b07747cca936f7ee9831f59db1c972025072f20af030b5fc8616004d0846ee7e
MD5 23fe1bc8ecd46070901ee4790cf0709e
SHA1 4f4ea42e87ddece05b65a3ead7e27a1681aaa3f5
SHA512 1db6f0ac2907fafc5d966d2a44befa151fcdcc37016b2f42787aaf308d619bbda9bb00ef0e394f00aaa9119e18300dd7ac5cb5cc61ed276e911049877203d9df
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9NjR:bghLQ0sQmpcF8BzXfwVfAIPjR
TLSH
T1F1446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dysqkicavs.exe

Path C:\Temp\dysqkicavs.exe
Size 248KB
SHA256 5ca829607b66b1965cb2461e3481370a6eb3d8ea2c97498c05aa47096e4171e3
MD5 dc105d73db77705fc5d67d2e535eec00
SHA1 bd26915bd94f0cc8942ffd947cd884070b436165
SHA512 c75ee26f5a44dc6c17bcb9dccc6b526cc7f13ed2e6ff30191c2b95a4354b3db267567581641743e733cec864a5ae8935c5096707af25c30a9d32fe6d1b0827e6
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njp:LghLQ0sQmpcF8BzXfwVfAIPjp
TLSH
T147446B1172809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czusmhbzrm.exe

Path C:\Temp\i_czusmhbzrm.exe
Size 248KB
SHA256 7c38b947ff4265476ec6bc2e66bff5b0f6b430e2daf7c0772a5e5035244838fd
MD5 9ee826603cae3b41559261c591bbd45b
SHA1 f83044893e86ac42418a3d5b83dcc152e9d987e0
SHA512 b283d772e8d3a2024ec69def5db89dde35e588ef340a163c66eda55932b54cedf575002e63ec48da6248c3ce038ba719fae4226f5ebc15ba1115b1688a00c600
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Nj6:CghLQ0sQmpcF8BzXfwVfAIPj6
TLSH
T147446B1172809031E3664B740856EBA1467EBD354BA2DACFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtolgeyw.exe

Path C:\Temp\i_dbvtolgeyw.exe
Size 248KB
SHA256 41f88e24ac65a7a1bd99ae8eaf5eecee5820e87e5d367a97aad2bae1240d20d5
MD5 b25b7a4b890d9fbeff882512a17ac8d5
SHA1 0b28ce405c2646daef4d458a1c45198a974c8ddb
SHA512 5f36fa94988fd8f9f2606443c9d235c0e164c3f46739e860dcd5adaaaad24cadd399b09dc7dcfa07c246c093be68d7ad327b5eb99a11d198db2a930a7bb2c18f
SSDEEP 3072:HJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9NjR:HghLQ0sQmpcF8BzXfwVfAIPjR
TLSH
T19A446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dysqkicavs.exe

Path C:\Temp\i_dysqkicavs.exe
Size 248KB
SHA256 de611d24bf82512c9bc139fe86a67e907e3076dd26489f440565e445bff5509a
MD5 a99740f88ff6fd2c320c90ddaf0fe6d0
SHA1 84da66c5fe4efcca3425ddc4a004a2a07a51cfb0
SHA512 4408ef314a2fb3acee6be04e24f1cb4f82a7ca8a2378f4e09fbd8ceecc3ff8530d0a0d49eea3047a4142d4e4fabffb1e70d677aaa68b7a525374232b0ae8cb80
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njx:rghLQ0sQmpcF8BzXfwVfAIPjx
TLSH
T1D0446B1172809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oeytrljdbv.exe

Path C:\Temp\i_oeytrljdbv.exe
Size 248KB
SHA256 4cf919ae28cda93c78d040feb9bb56b8095b1525fcb2fbe33415bf5034e82535
MD5 f13b1bf30b1afee758c11cd36eb26989
SHA1 0267e14885a4979ad7bd8d6f31eb690424c95d8f
SHA512 cb0eb1f0b28452ebb661c638db630a9052b69758ef5a7ac45d454ea5a2b2804b570b04f95cab2646fcce8fb8a433e5b271a279260f39abe373c9398402045382
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Nji:6ghLQ0sQmpcF8BzXfwVfAIPji
TLSH
T19A446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_oidavtnlfd.exe

Path C:\Temp\i_oidavtnlfd.exe
Size 248KB
SHA256 b90f7e8dbb0d7df7dde7fbbed6e8c5434a07f237c16ceceb0372a816d3452210
MD5 8e7499a47bc4683902e6ba0834c093ac
SHA1 0de2f0050398c048f016387d1c6087814d07276f
SHA512 f095024715ad3de0e8e49da6fc572f8c11174272af94f02649d691e28878b3049db46de9cfc059f6b7ac3d133b95158e87ab7181e79036d499fafd69865b4620
SSDEEP 3072:GJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Nje:GghLQ0sQmpcF8BzXfwVfAIPje
TLSH
T199446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wrojgbztrm.exe

Path C:\Temp\i_wrojgbztrm.exe
Size 248KB
SHA256 80910d229b056d0da67b25f16191247e50a7350e01983c70924e3aaff0993602
MD5 6d9d57fdf0f458d8bc1ee4201e78693f
SHA1 3aa64c779b5f1504b84c7a4d554239a988f711c2
SHA512 9eb9b750964bfe42a57d1b19909cd48230fc92f46041ab584c2730e37c716a5503a40237bf2845fbe38678b694ac0c26a1af50763b9fb3d66d1d3772eef5518d
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njm:CghLQ0sQmpcF8BzXfwVfAIPjm
TLSH
T18E446B11B2809031E3664B740856EBA1467EBD355BA2D6CFF7A83F795A312D3693320F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icavsnlfay.sys

Path C:\Temp\icavsnlfay.sys
Size 141KB
SHA256 7404fb9ad81751a67fa007812e2b3d3ef1b9c7a5d4d34a9f34222b44d40eab31
MD5 99a8397a333b2bf84d699c22b89ad226
SHA1 0450da30e738f30b78287dc54625b81c05e4316d
SHA512 422b94ff3d19adb8b493e36f0713fcf8f81d835229eca2e8e3aa683b9fa5bd0ee156b48da74dff86286cc57372f0a7cbfeaa13ab80c98b286f9fc2a39baa0784
SSDEEP 3072:vsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:vsQmpcF8BzXfwV
TLSH
T1B5E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oeytrljdbv.exe

Path C:\Temp\oeytrljdbv.exe
Size 248KB
SHA256 01c7ccb1fc2f69354df215c474642a8f5850b2a3e7cc81adbbb6c585df3be056
MD5 42171d27466b5c45f45beebbb0b805c4
SHA1 e48ea9c1316353ae0d865a8b665c315229c8c5d2
SHA512 dd014127a9063287fcdef2c707821eac10d7fceeacd77cc882450fe72dd254ffbde1716177720aedf4ccf4b1c759f13a68d2a1fc670656d0413f45ed5757dd9c
SSDEEP 3072:WJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9NjG:WghLQ0sQmpcF8BzXfwVfAIPjG
TLSH
T1CA446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oidavtnlfd.exe

Path C:\Temp\oidavtnlfd.exe
Size 248KB
SHA256 85bd2f0e46e968ada72c22456dd9c9cab8187214de3d3ace19b9e2c2c90959a7
MD5 bfa5aa4f6a88ac349288094ee23379de
SHA1 50a02d85908975132814d137f5eaf7106af837b7
SHA512 ac5330a5f81423035ec07f86c5d53242273f91df525e9f26ab06e533d23331ecc5ef57159cd4c56c988463449771a2ffb5d79441bba98c647f31f2920e48187c
SSDEEP 3072:uJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9NjW:ughLQ0sQmpcF8BzXfwVfAIPjW
TLSH
T181446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgeywqoig.sys

Path C:\Temp\olgeywqoig.sys
Size 141KB
SHA256 a9860864420363849eb7e0d1953463bc1510fb48db205010269b206bdc75c205
MD5 c0902087c66e9d87a61b0f8987e0c6a5
SHA1 6199a7da8f41a05348ae3486be996f3ed79867c4
SHA512 b50b2ac91f0e292252a61a008ecb471fc3ffe86eee3661f14d3a34f2a8692383606fb6db48835d26db298d4d26d8d2a378a430b3e07491a395a3d7ed4df29188
SSDEEP 3072:JsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:JsQmpcF8BzXfwV
TLSH
T16EE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhbzmjhbz.sys

Path C:\Temp\pjhbzmjhbz.sys
Size 141KB
SHA256 16988c15f3d80b00c4bc9ff79d42db46895f96d5a17a5cfde598c4aa478278f5
MD5 c92929e99cbefcc11e0c226b88d41950
SHA1 a0f03b801680549204f9e33d56111999e3dc00f2
SHA512 570fe56a214f7519f32fe018f91e433f9a19d49af6576c209f7d7d0c07cd7e01709ffcb8ce1d9ba58e69b631361fe085712764bf7f06519dfd9add12c2161453
SSDEEP 3072:/sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:/sQmpcF8BzXfwV
TLSH
T1ABE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sicavsnlfd.sys

Path C:\Temp\sicavsnlfd.sys
Size 141KB
SHA256 5daf1138efcb3317c3462dcd9d511a33dcff30d45522c2b9ed765445c35d999c
MD5 921ba6b53b6db867e686fe0c80721f1e
SHA1 42cdadff573b1c0de344c2113f38de611b3b9c0b
SHA512 4c13cebef847a8feec81e09a2972d4512eafdfa147e8ab895cdebf64021d8820298fdc95c168f69b9e72f684f1d71cf2f30d19f13901265df0bb17d2ad63f122
SSDEEP 3072:ysQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:ysQmpcF8BzXfwV
TLSH
T1FDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojgbztrm.exe

Path C:\Temp\wrojgbztrm.exe
Size 248KB
SHA256 b788663f005230f1f8297ce23d496ff8f70cefd4f04ba3d0db6a189e0ae271f4
MD5 0484fb7aa4f27c620b0436a7aa5e18b9
SHA1 66db5c2da97f03e400c2ca1da136ae5986bd3bf6
SHA512 1593db5b01d397a24a0ed35720515d7514d49421a58fda634591ab478ff6b0ff9b316eb699aa68a383cee77a49689d76f6f31667016b5cb512dd0842064cb28d
SSDEEP 3072:OJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9Njm:OghLQ0sQmpcF8BzXfwVfAIPjm
TLSH
T1C0446B11B2809031E3664B740856EBA1467EBD354BA2D6CFF7A83F795A312D3693720F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

autofill_bypass_cache_forms.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\autofill_bypass_cache_forms.json
Size 161B
SHA256 f7510e38f81f8a84027304070205dd55127e3233fdf011411465ede67b5b5d92
MD5 4b1a79b1996f03fb926a97912835c881
SHA1 ca43e23f7bbb4ff3839751f722df3c38ef7bd8a7
SHA512 c2e07a1b311ab71d94c7b874d645fe1114fdccfe4468875d6b23318fbe327481a60b2782af105b7546b3c1e6c3a7ec67261b21a0587f914cc7bf77c55f1f568e
TLSH
T1E5C08C07ABB804230B414E0B590DEFC9990476F6D5C146FEAB75A5A98A3C6B0005B74A
MD5 SHA1 SHA512 TLSH

Submit Download

edge_autofill_global_block_list.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\edge_autofill_global_block_list.json
Size 6KB
SHA256 7d3c45c8207ba69066516e51e10a2137bc4f1fce070a692e0c65225f9856e04c
MD5 5d4464dabc1289c3a010e14c05b92c57
SHA1 d2d185faca1cd13a6d42dea68803a9941074707d
SHA512 f93f4b58efc0127946ffa1b2950a1cf71da6f77a6ab4cf98ad8ada6a751d6261be4818ff8c64fe1f1d45467aa070e0823d15be36c8259c1044fb2d1289df9994
SSDEEP 192:C73stL7O9FnLk25+tF4B8K5b+QiGoztWuDpR6lFuftdHAa4/i:nwJ2r
TLSH
T133D16A2BA91C54B32A044839128E5BE47DDD73B6DD6008D6D650C0B9AEDFCB8203FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v1FieldTypes.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.1.32\v1FieldTypes.json
Size 509KB
SHA256 611e7995ab7599a0c89f98d6c6152a42aaedf7449748109a465bb5b0badd0af2
MD5 b1c140ef49f01eea089d3957da1a529f
SHA1 de64781f20aac98b4d2bbc497e3defa83b25aa8f
SHA512 02ddfcbaf9eaff793f251bd983394cf473b1340182ac1f3217cb7258ddfbd2de066ab08af16b47a378644bcc1871ad6ed8c641f6a053802c90e77f648e4f4be8
SSDEEP 1536:jlKS/dYt+dtxX9U2/W++dGcUooTHR6rF1azQmkEMUmxralqDAtyttVJAC5c8KrVx:B
TLSH
T148B48E2BF9F25C634D822A32053E18996A30615F5CEC6CD4BB3E211F4F2C1791E797A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
MD5 c6c88b3fb919f1f75228e4aff327fe5c
SHA1 70428f4ae69437730ef237674398113e1a3f3017
SHA512 1cda50c8b022751e3d3a7c73ffc9350fe02786e3000fa887544b774366bd092e165982f8e834c7eb67dc7a078a4dd76c0d5370912b7c3c7b95fc731b504ce5e8
TLSH
T19FD0803D1572BCB4C499DA714456372B6E1DCCE24DC65F116462356D4D9700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
MD5 b42dc01f081a5fcaa564011a4fcbf9f9
SHA1 8bcee7db87d1cadc63412a4981a1a46bc8ac9a01
SHA512 70a6ffe00e23a197554908a478c6e06671c1c239e2134c7e2eb172c03b4237bd91a7d62847a63e20268dbfb9c9b77ec1b8df3b9c0e528df0aaa3f9289c5d6452
TLSH
T101D0803D1572ACB4C485DA714456372B7F1DC8E24DC65F116462357D4DD700186D72D3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b185be9e49a1cea3ebc70e9c4bebab6fc8a1f15aaa6c3cbe38602ec15c721603
MD5 0a99a691a524d3f08e61763f27c56a7d
SHA1 899d57e9669b48bc4e023c847f2b64abd4c906e5
SHA512 26e848c89c15d4169ae0d396cc5efd6b4430e3ccb264d4f6cf1a3991e5a3b3f00cfa12307ed17ecace05eb799e0d59f561bbd687153f139870248947d2480ccf
TLSH
T1F441A0F3C3E8856ECA0196F0AA187E3BCE2D0554436C7D9AC5E4AF1B93E24B1E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b98f0820a14ac26aec0b41e8dee154973880467f2f3f78fc3287094ef8c219af
MD5 e3bcefd489d9fb9e8c6f6bd1c6cbaa6b
SHA1 ed3badd71740f20a7e027047ccc0a942253051e5
SHA512 aedab52130da8e97d4153d5b8a5b0b0fbc2c6592a9307678e7d49a53dde7e77ada2c2a9100132008c1ad22e668e6215dfdfe8cdf99cbf1f67231e59032bddef6
SSDEEP 192:sxZGRgyMqZ/K1Ml8UQjcS/fksZmkdrsPOIIDPxfzodpZz/W6+WNs2cfY0ETq0wIC:sxZGdqoS/fksZdhiOtLKp/b2f5wj7gh
TLSH
T17572D80AAA3899778CD7D209FA45BF53D7F91573D5804E44AAFC9B0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c5a6111476223d1d08634c7da854cf997e0d0f8728cf99a691f10069d67e7f98
MD5 6df082b0673a2d8c9c8a553590c0769d
SHA1 35fb23add53f392ba23775fcd4427a33a128d357
SHA512 7631c34eb92e4167901ba142a2660f599f4fe8f2a3d269b5ebb45914fdc2e1bf4e565fccdee77a2990e1e071b3d946357f1e09bd93e6044439d2f0fc33b07c43
SSDEEP 192:sxZGRgyMqZ/K1Ml8McS/fks8mtdrsPOIIDPxfzodpZz/W6+WNs2cfY0ET5j04ITi:sxZGd0S/fks8shiOtLKp/b2f5wi7jW
TLSH
T17F72C80A6A3899778CD7D209FA45BF53D7F9157392904E44AAFCDB0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 08bb3b0b21dba37bd41e15e131567b147de960d80717ad89f5bcca9a38922890
MD5 9f9e9a61b7a8afed00f952cfe8f11e65
SHA1 4d75424e4293dfc9eb603296749db7d02d1fe023
SHA512 3c83ba8a728306f19e845c0fbc86059111c14ef717b1bd5e9096c1a1a8fbcb8445a62e08583fb653bc5b76c0c72e9989f86b48dbef7fd1e8fa49dbfd7802dcbb
SSDEEP 768:UnjXV8Zp2+m7pLuL/AAWRmAoQ7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nDwvLlC:UnjXV8Zp2+GE/AAWRmAoQ7ku1jaKnDw4
TLSH
T1CA030B3B680CCB7E4F844E9CEC27BE9E6DE8018B9698895447FA444C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 73a0d406d82a7cc02bc09b877b347c4a25221a39ee6f759bef9ce2f636351b56
MD5 68d21bc2f40812584cf1b1167fab22c8
SHA1 fedfb6a956292c1c9e1577e5560bdc83156d7e1c
SHA512 b0dd755cf6db338947aee02601c8c6cb81aa5ddcbd911196e80e0b61008cf0d6dab631b46dbf08e20ebb027534d858e227d5d65ce8a02b3a7b7f0a680b3238bf
SSDEEP 96:KUQAK926Wh+KiQRYAKJq+2xWKqgZ8gKRuiqsQKJyy1aKGg/qQYKxqqvOKMMaa203:ardVTNBbfw8nM9fgzNJ9dvz9VDBX
TLSH
T1F5B22611753B03C03ABE259A81A5B56F46C230637118E43B7BF841E68F66E24DDFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b941d710-f270-40f9-a11a-8b3281e6e92d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b941d710-f270-40f9-a11a-8b3281e6e92d.tmp
Size 414B
SHA256 fe192675f1534421a80f2e818ceae771d041fe5507b09a05ec0e50354160ed60
MD5 a9a0c75d470a4fb834d6e69bf7cf857d
SHA1 30c8ae99436cef9baf982d76556a076d6f5afbaf
SHA512 a835b77fea732f3d27ac9005390f24acc4663fe7a1dba3cee47db2996f7e512b0405b0d3713f69b4a35dcd7e0391a55c6259d96443e43481aba331a357a21e7a
TLSH
T135E0E5AAC821982B19FD072950604A06EE14132B1B50964B3A3C820C8FF0A3B458699C
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 24406b5969faa65f506254709263c0c6dec54345acab7e9defbb18f873a0bd8a
MD5 dd90be43ce08104689f42c0e9222fbe5
SHA1 e82dfdd9ca1dbab029024443575ab01f7d0c0e66
SHA512 e5d226b462c44d90ae91207ab26dfa4047011c0e3ff08f034dda14595deea0859cc0ad33295485782bb2120c04df8df4bc71316b88c4dec2da7e4c2ade7c2861
SSDEEP 768:kFJccQy3owgk9oKuS0/yHpkMZwCXabW6KGT:uccQy3sS06Hpk+NyWCT
TLSH
T19EE2B4F194D78977E9AE4B97A37D2D029ABCC163B5484A94F7C44E0CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5889b4e0c8247da492df86235b0526adc1cfce122d9bcebbcc2c20794039d84b
MD5 6e6f3daba1c7f3fa3f2cf876a2854e8f
SHA1 cfb9158295f8c505a985456ecd295e2a471a923d
SHA512 e96eacd276a94b11c622fd9e4fbb1104a52fd143ce1b386ead3eebccdcec7aeb1c51c1ebfea0f4dc99035d354e8d079376906a732de973c6f97d3173dd6b1d2c
SSDEEP 384:nGiFavqMg38N18TUNTUlIxBvHTnMGBrfDKclFkaZ/94QNdnS4mtm6FrNlk+5vI+b:tFayv3Wwg7M4KuS0/yQNdS4sm6xH
TLSH
T1EAC23C75E898D9BBEDE74FC9A7497A07EEF041A7A58C4AC4CAD81D0E00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 43de4dbf86e7add5cf22e2de997d100ebd46ea60cbdacfd69ab53a48d0043f25
MD5 ac6689369853cddff1099785c2e996aa
SHA1 6a027efd6dd29bea5255ca0a421d5526381ae684
SHA512 f33c3b67fc021022a7e72897d352f26550019b1084a19f2baf87044c66456d904874257caf04b37b78cf948d7d49ccdf19e0e6399f9c83df26dafe2c85691cf2
SSDEEP 384:ngiFavqMg38Nr8TUNTUlIxBvHDiJBrfDKclFkaZ/94H/Rk+jyqsspdnS4mtm6Fr/:7Fayv34wgG7KuS0/yHpkMZsCdS4sm6xH
TLSH
T1C8C25B71D898DD7BECE78FC9A7493A47EEE011A7998C4BC4CAC81D0D009719E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ed0e33fc5fde6aba6141eb0dee8ed47fec461ba1ed8ddec24e836795b9271df4
MD5 e47b185a27a0992af643fded0e87eeb9
SHA1 a4f4ef8a4f94c862503b7d87bd450bda5cbffa77
SHA512 50f0fc4443fbcc6214dc3f113350d5f1bd58fd3f075d6b1286d3e69691b848a8613b0e067bd686cffd65bc62909ec477e4b1af376e5467ace177cabca92919ca
SSDEEP 768:mFJccQ03owgR9oKuS0/yHpkMZVCXabW6KGT:8ccQ03LS06Hpk+8yWCT
TLSH
T12FC24A31E898CD7BADE78FD9B35A3A47EEE011B7998C4AD4D9D84E0D008B1DD130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d9ca91999e2f39d8a7b00b5eaa19dd16fa2f003cd5a555e7734b7d5bcff06028
MD5 4ba098a71cdf7301bf64b6e7852e272f
SHA1 8bbd263347ada93c71fda8a15b017f1c986a330a
SHA512 d6df775b8a9d35d7d17d785d24e9f470e17459eed326a4ac9f61bc140ad66c21faeb46432b271d5ca8f91af39dcff0535a969a5e3c5cb9bc09c85d999ddb7e15
SSDEEP 384:nLiFavqMg38Nv8TUNTUlIRyvHuWsBrfDKclFkaZ/94H/Rk+jyqsspdnS4mtm6Fr/:mFayv3owgSaKuS0/yHpkMZsCdS4sm6xH
TLSH
T17DC24A71D898DDB7ADE78FC9A7493A43EEF011A7998C4AC4CAD81E0D009729E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4c62c8129d8c48cfacf67fe5b31a681862145efa33af18137fa8c7853ee34550
MD5 7fc2b78b5530690215fa4edc1ec2e510
SHA1 b9c7867b8107a3ffb057423e12d188b0d3cbece0
SHA512 dc546710cc032d7613bded5e067a779d78a2cf31a855f0047bc7f4e208f96bb4b99114e69b1b075bcb83d157b6db0b8da41188eefd7b5bde7689a1d98240f038
SSDEEP 768:cFJccQO3owgS9oKuS0/yHpkMZ8CXabW6KGT:WccQO3iS06Hpk+ZyWCT
TLSH
T1FBC24B31E898CD7BADE78FD9B35A3A47EEE011B7998C4AD4D9D84E0D00872DD170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 e19a9a72b36879e282ec6fc1d14de96d2d4260cf278de19790daaad3318655d9
MD5 9a9e428bf6b8b2131917eda9fd8fd3b9
SHA1 2b18ed7ada3c016044cc1822063aaf8b1fa85c54
SHA512 c463a33f4e09dbf364936ac4de84dbb32f431da6c3536747fa0f0ec28903fbc5006b9df571c97279db0932f179a624c0a8904b656de501480bb137ab51ca1310
TLSH
T1EB4122E15C3D2AC1E0BD0E6EB49738FC95DCD715F4A4347D6854EA94463A60D648483F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 521d8bcc92fc9b2749ef9a33b70d81b3b984e8f1369fbb8036ea15a693567c6c
MD5 a105973d0b0f5180d0ceac51bd482dc7
SHA1 7cbaa9e839bccdac1d920545579f712b380dd068
SHA512 284afe998764e9cac4ddd0a9dbb0d82943b1747527cf8eba3a3c5be44948338aac0678d0112b787421f20b52f07552bf272e6c20b090b9aeac4c2504d81b8dd8
TLSH
T18C414FD18C3E2AD1D4FD0E2EA49738FC91D8C32AF4A4307D5868EA98463A60E604083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b402451b4c685307a92e00c4deee4590fd7322c97a3f911a508cc64602d76b23
MD5 84abce53f8fe9949509866ac6e26b81e
SHA1 4a0bc9ce8c5e3606e3a19417f612820ba05fa67c
SHA512 c36b0a32237fae85a27f4046e1ed41e34c90e2234cfa0086f9c19a6a08996deb42121097b0f46c6a6b36ffcd91d4fca96f39736efb5b38d76715513b22201597
TLSH
T1AB411DD15C3E2AD1D0FD0E2EA49B38FD91DCD72AF4A4347D6868EA98463E60D644483F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1656699406\manifest.json
Size 177B
SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
MD5 2714a51ed8c2a891ad73b7488ab655b9
SHA1 9a8cc479aec8de1b4eb678e5d68b23b16a39dc99
SHA512 4811522c06ad6946626a9f4d12eb62a1d623825d18a1cd0ad7b628f4c059f37d299b5857abffd959e4ea53239412490539f5705b4aa6c6951d13c68e6d5b72ad
TLSH
T1E6C012EFDC509DB215EB4323156D43C4E733CF4B1546490935FB66082A25981C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_1875775165\manifest.json
Size 119B
SHA256 7169d86e87f904218238cd293e043e20b7828afad9acd1ff2e5d64188530b9d7
MD5 7382260298fc06c135b7c7399e9acff9
SHA1 6a829f795a3b8be25200675e00abfa1908fdefdf
SHA512 f0ce77f9f72fb6721bcfa9b03f77b0771e8217988183787c00dba4f9d9f19cdba252ddd656422336035f81939cb97c8b5dcb4f036a39280198c17cd04faaaed4
TLSH
T191B09273A800E83830E9EB91093A8243F320AB4BA585640A3625485C0B2B9F990606C4
MD5 SHA1 SHA512 TLSH

Submit Download

keys.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_544711749\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4780_544711749\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

memory/244-755-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/320-857-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/560-572-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/656-617-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/772-756-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/832-833-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/984-712-0x0000000000590000-0x000000000060C000-memory.dmp

Download

memory/1020-741-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1120-193-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/1188-711-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/1488-280-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/1544-273-0x0000000000660000-0x00000000006DC000-memory.dmp

Download

memory/1576-752-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/1632-233-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/1716-872-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1912-258-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1944-789-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/2232-578-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/2412-241-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/2496-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2500-708-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/2592-594-0x00000000009D0000-0x0000000000A4C000-memory.dmp

Download

memory/2680-698-0x00000000009C0000-0x0000000000A3C000-memory.dmp

Download

memory/2692-648-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/2752-653-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-633-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2936-684-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2964-217-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/3064-63-0x0000000000860000-0x00000000008DC000-memory.dmp

Download

memory/3124-235-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3132-595-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3168-618-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3176-834-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3300-242-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/3404-852-0x0000000000820000-0x000000000089C000-memory.dmp

Download

memory/3432-779-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3472-542-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/3600-871-0x0000000000820000-0x000000000089C000-memory.dmp

Download

memory/3820-794-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/3880-853-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/3940-821-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/3952-216-0x0000000000830000-0x00000000008AC000-memory.dmp

Download

memory/4012-544-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4020-382-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4028-859-0x0000000000840000-0x00000000008BC000-memory.dmp

Download

memory/4272-256-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/4324-688-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4328-613-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/4384-620-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/4424-652-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4536-766-0x0000000000820000-0x000000000089C000-memory.dmp

Download

memory/4552-580-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4556-583-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4560-524-0x00000000009A0000-0x0000000000A1C000-memory.dmp

Download

memory/4592-632-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4632-883-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/4704-699-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/4836-621-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/4984-860-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/5164-222-0x0000020199200000-0x00000201999AE000-memory.dmp

Download

memory/5228-822-0x0000000000620000-0x000000000069C000-memory.dmp

Download

memory/5276-675-0x0000000000670000-0x00000000006EC000-memory.dmp

Download

memory/5304-790-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/5316-582-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/5332-778-0x0000000000960000-0x00000000009DC000-memory.dmp

Download

memory/5360-649-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/5428-767-0x0000000000980000-0x00000000009FC000-memory.dmp

Download

memory/5484-856-0x0000000000880000-0x00000000008FC000-memory.dmp

Download

memory/5524-795-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5568-272-0x0000000000620000-0x000000000069C000-memory.dmp

Download

memory/5596-740-0x00000000009D0000-0x0000000000A4C000-memory.dmp

Download

memory/5636-882-0x0000000000850000-0x00000000008CC000-memory.dmp

Download

memory/5652-687-0x0000000000990000-0x0000000000A0C000-memory.dmp

Download

memory/5780-571-0x0000000000880000-0x00000000008FC000-memory.dmp

Download

memory/5864-614-0x0000000000970000-0x00000000009EC000-memory.dmp

Download

memory/5924-674-0x0000000000870000-0x00000000008EC000-memory.dmp

Download

memory/5960-64-0x00000000008B0000-0x000000000092C000-memory.dmp

Download

memory/6044-751-0x0000000000860000-0x00000000008DC000-memory.dmp

Download

memory/6084-709-0x0000000000010000-0x0000000000083000-memory.dmp

Download