systex | c30802dc10a883ea64ef440214f51b7d6ce9254632bdfe42d2746bd2e9e71507

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260706-2p4afsh19m
SHA256 c30802dc10a883ea64ef440214f51b7d6ce9254632bdfe42d2746bd2e9e71507
MD5 0990e42b21eaba160535e33c2bdf6e64
SHA1 82f7f4ba398d522f7f3779e8cd2d6b816f1cdfbf
SHA512 b5daae4aa44e37f06e64553801343142c63cae21e7498b80eecebd88dc50f1b204fcecea4c6d671f4018f0c183421ae7e7f74dfdf20735e867a8bed947631346
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B3344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2852	CP.exe
4336	hezxrmhfzu.exe
5456	CP.exe
1264	CP.exe
5088	i_hezxrmhfzu.exe
5076	zxrpmhfzxr.sys
4940	CP.exe
2304	bztomgeztr.exe
2948	CP.exe
5908	CP.exe
3228	i_bztomgeztr.exe
5540	wrojhbywur.sys
3056	CP.exe
5012	romgeywuom.exe
1752	CP.exe
5964	CP.exe
2660	i_romgeywuom.exe
5896	ljgbytrljd.sys
4864	CP.exe
4608	rojgbztrlj.exe
3924	CP.exe
3124	CP.exe
2980	i_rojgbztrlj.exe
5996	oigaytqnlj.sys
4692	CP.exe
2340	gdbytqlidb.exe
908	CP.exe
3588	CP.exe
4292	i_gdbytqlidb.exe
252	qlidbvtqlj.sys
5424	CP.exe
3944	ysqkicavsn.exe
3596	CP.exe
4784	CP.exe
5752	i_ysqkicavsn.exe
4312	avsnkicays.sys
4908	CP.exe
2992	avsqkidavt.exe
3080	CP.exe
2996	CP.exe
2604	i_avsqkidavt.exe
4532	caxspkicau.sys
3716	CP.exe
5632	ifaxsqkica.exe
448	CP.exe
776	CP.exe
2556	i_ifaxsqkica.exe
2328	cxupnhfzxr.sys
1412	CP.exe
3936	ausmkecxup.exe
2412	CP.exe
3396	CP.exe
5716	i_ausmkecxup.exe
1404	cwupmhfzxr.sys
5388	CP.exe
5372	rmjhczurmk.exe
1296	CP.exe
3564	CP.exe
1692	i_rmjhczurmk.exe
4780	zwuomgezwr.sys
5180	CP.exe
2112	cztrmjhbzu.exe
1028	CP.exe
824	CP.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1716884621\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_984312267\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_984312267\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_984312267\sets.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_2102475224\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1793586441\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_104594629\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_104594629\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1716884621\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1716884621\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_984312267\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1793586441\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1736_1716884621\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrmhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgbztrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrmhfzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztomgeztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdbytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqniga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqkidavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cztrmjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicaysqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjhczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlidavtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupnhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezxrpjhbzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romgeywuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaxsqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cztrmjhbzu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5728	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3732	ipconfig.exe
2660	ipconfig.exe
4228	ipconfig.exe
2848	ipconfig.exe
2068	ipconfig.exe
5680	ipconfig.exe
824	ipconfig.exe
2456	ipconfig.exe
5028	ipconfig.exe
3644	ipconfig.exe
1996	ipconfig.exe
5380	ipconfig.exe
728	ipconfig.exe
5772	ipconfig.exe
4372	ipconfig.exe
4552	ipconfig.exe
2184	ipconfig.exe
2184	ipconfig.exe
1160	ipconfig.exe
4800	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{6AB942AA-3F82-4CE9-B744-C3C0E30F6CB0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe
4336	hezxrmhfzu.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	i_hezxrmhfzu.exe
Token: SeDebugPrivilege	3228	i_bztomgeztr.exe
Token: SeDebugPrivilege	2660	i_romgeywuom.exe
Token: SeDebugPrivilege	2980	i_rojgbztrlj.exe
Token: SeDebugPrivilege	4292	i_gdbytqlidb.exe
Token: SeDebugPrivilege	5752	i_ysqkicavsn.exe
Token: SeDebugPrivilege	2604	i_avsqkidavt.exe
Token: SeDebugPrivilege	2556	i_ifaxsqkica.exe
Token: SeDebugPrivilege	5716	i_ausmkecxup.exe
Token: SeDebugPrivilege	1692	i_rmjhczurmk.exe
Token: SeDebugPrivilege	3260	i_cztrmjhbzu.exe
Token: SeDebugPrivilege	2140	i_bztrljebwt.exe
Token: SeDebugPrivilege	5772	i_wqoigbytql.exe
Token: SeDebugPrivilege	5156	i_igayvqniga.exe
Token: SeDebugPrivilege	3132	i_nlidavtnlf.exe
Token: SeDebugPrivilege	2556	i_kicaysqkic.exe
Token: SeDebugPrivilege	4468	i_hfzxupnhfz.exe
Token: SeDebugPrivilege	4528	i_ezxrpjhbzu.exe
Token: SeDebugPrivilege	2456	i_urpjhbztrm.exe
Token: SeDebugPrivilege	4524	i_romgeywuom.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 2828	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 1844 wrote to memory of 3432	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 2828 wrote to memory of 1736	2828	iexplore.exe	89
PID 3432 wrote to memory of 4564	3432	iexplore.exe	90
PID 1736 wrote to memory of 5696	1736	msedge.exe	91
PID 1736 wrote to memory of 5728	1736	msedge.exe	92
PID 1736 wrote to memory of 5448	1736	msedge.exe	93
PID 1736 wrote to memory of 5448	1736	msedge.exe	93
PID 1736 wrote to memory of 5448	1736	msedge.exe	93
PID 1736 wrote to memory of 2824	1736	msedge.exe	94
PID 1736 wrote to memory of 2824	1736	msedge.exe	94
PID 1736 wrote to memory of 1436	1736	msedge.exe	96
PID 1736 wrote to memory of 1436	1736	msedge.exe	96
PID 1736 wrote to memory of 1436	1736	msedge.exe	96
PID 1736 wrote to memory of 2124	1736	msedge.exe	97
PID 1736 wrote to memory of 2124	1736	msedge.exe	97
PID 1736 wrote to memory of 2124	1736	msedge.exe	97
PID 1736 wrote to memory of 3012	1736	msedge.exe	98
PID 1736 wrote to memory of 5172	1736	msedge.exe	99
PID 1736 wrote to memory of 3012	1736	msedge.exe	98
PID 1736 wrote to memory of 3012	1736	msedge.exe	98
PID 1736 wrote to memory of 5172	1736	msedge.exe	99
PID 1736 wrote to memory of 5172	1736	msedge.exe	99
PID 1736 wrote to memory of 5168	1736	msedge.exe	100
PID 1736 wrote to memory of 5168	1736	msedge.exe	100
PID 1736 wrote to memory of 5168	1736	msedge.exe	100
PID 1736 wrote to memory of 3312	1736	msedge.exe	102
PID 1736 wrote to memory of 3312	1736	msedge.exe	102
PID 1844 wrote to memory of 2852	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	103
PID 1736 wrote to memory of 2368	1736	msedge.exe	106
PID 1736 wrote to memory of 2368	1736	msedge.exe	106
PID 1736 wrote to memory of 2368	1736	msedge.exe	106
PID 4336 wrote to memory of 5456	4336	hezxrmhfzu.exe	107
PID 1736 wrote to memory of 1140	1736	msedge.exe	110
PID 1736 wrote to memory of 1140	1736	msedge.exe	110
PID 1736 wrote to memory of 1140	1736	msedge.exe	110
PID 1736 wrote to memory of 3172	1736	msedge.exe	111
PID 1736 wrote to memory of 2164	1736	msedge.exe	112
PID 1736 wrote to memory of 3172	1736	msedge.exe	111
PID 1736 wrote to memory of 2164	1736	msedge.exe	112
PID 1736 wrote to memory of 5036	1736	msedge.exe	114
PID 1736 wrote to memory of 3924	1736	msedge.exe	117
PID 1736 wrote to memory of 3924	1736	msedge.exe	117
PID 1844 wrote to memory of 1264	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 1736 wrote to memory of 4780	1736	msedge.exe	120
PID 1736 wrote to memory of 4780	1736	msedge.exe	120
PID 1844 wrote to memory of 4940	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 2304 wrote to memory of 2948	2304	bztomgeztr.exe	125
PID 1844 wrote to memory of 5908	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 1844 wrote to memory of 3056	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 5012 wrote to memory of 1752	5012	romgeywuom.exe	134
PID 1844 wrote to memory of 5964	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 1844 wrote to memory of 4864	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4608 wrote to memory of 3924	4608	rojgbztrlj.exe	143
PID 1844 wrote to memory of 3124	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 1736 wrote to memory of 1552	1736	msedge.exe	148
PID 1736 wrote to memory of 3204	1736	msedge.exe	149
PID 1736 wrote to memory of 2940	1736	msedge.exe	150
PID 1844 wrote to memory of 4692	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	153
PID 2340 wrote to memory of 908	2340	gdbytqlidb.exe	155
PID 1844 wrote to memory of 3588	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	158
PID 1844 wrote to memory of 5424	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	162
PID 3944 wrote to memory of 3596	3944	ysqkicavsn.exe	164
PID 1844 wrote to memory of 4784	1844	2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe	167

C:\Users\Admin\AppData\Local\Temp\2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_0990e42b21eaba160535e33c2bdf6e64_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbde98c188,0x7ffbde98c194,0x7ffbde98c1a0
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,13548594869324387775,10678463299903567258,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
      4⤵
      System Time Discovery
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,128049796856485029,5515078063197138672,262144 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,5303209046381255802,16578829436159009482,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:13
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,12289178671313269032,4368424412946150194,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
      4⤵
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,3627930143491242900,12947809147415108547,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,14931891496315649609,1098033562058229617,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4332,i,15538777348325065536,15648110015367385052,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:9
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4420,i,8542706278160883414,1791878413616174932,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,260277590349964792,5543967602420115351,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
      4⤵
      PID:3312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5492,i,6680124238699892146,6262777704352185355,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:2368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4504,i,3951187093620804910,5399600344261987998,2097152 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
      4⤵
      PID:1140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14995674817591434314,1726147433943527866,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,15632443516810473600,15502623836472799709,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,674842089499577918,7174718551569177771,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,674842089499577918,7174718551569177771,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,7901343280036877197,12938297214930955274,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,5556499994812296979,8819196973691551503,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
      4⤵
      PID:4780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,5118974025667274371,1687672560428455671,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:14
      4⤵
      PID:1552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,571791427969064745,11541550215227570723,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,10127304571523594104,4880149606709790340,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:14
      4⤵
      PID:2940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,6041286887868282599,1918034335910164507,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,5483880296122821759,5608564803685047640,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
      4⤵
      PID:3932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,13604614236395747041,11597762843995926663,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:14
      4⤵
      PID:4948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,5681072161735778844,690030983798344892,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:14
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5836,i,2763288558367088780,15474918098441902394,262144 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:10
      4⤵
      PID:1048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,10071524065423955590,18141895176101844829,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,7423201201969504021,9539875279001003676,524288 --field-trial-handle=2416,i,1841294421020554272,11909101921456379533,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
      4⤵
      PID:5512
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4564
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrmhfzu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2852
- - C:\Temp\hezxrmhfzu.exe
    C:\Temp\hezxrmhfzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5456
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrmhfzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1264
- - C:\Temp\i_hezxrmhfzu.exe
    C:\Temp\i_hezxrmhfzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5088
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztomgeztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4940
- - C:\Temp\bztomgeztr.exe
    C:\Temp\bztomgeztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2948
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztomgeztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5908
- - C:\Temp\i_bztomgeztr.exe
    C:\Temp\i_bztomgeztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgeywuom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3056
- - C:\Temp\romgeywuom.exe
    C:\Temp\romgeywuom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1752
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1160
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgeywuom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5964
- - C:\Temp\i_romgeywuom.exe
    C:\Temp\i_romgeywuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojgbztrlj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4864
- - C:\Temp\rojgbztrlj.exe
    C:\Temp\rojgbztrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3924
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojgbztrlj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3124
- - C:\Temp\i_rojgbztrlj.exe
    C:\Temp\i_rojgbztrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2980
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdbytqlidb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4692
- - C:\Temp\gdbytqlidb.exe
    C:\Temp\gdbytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:824
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdbytqlidb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3588
- - C:\Temp\i_gdbytqlidb.exe
    C:\Temp\i_gdbytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4292
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ysqkicavsn.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5424
- - C:\Temp\ysqkicavsn.exe
    C:\Temp\ysqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3596
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ysqkicavsn.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4784
- - C:\Temp\i_ysqkicavsn.exe
    C:\Temp\i_ysqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5752
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\avsqkidavt.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4908
- - C:\Temp\avsqkidavt.exe
    C:\Temp\avsqkidavt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2992
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3080
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_avsqkidavt.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2996
- - C:\Temp\i_avsqkidavt.exe
    C:\Temp\i_avsqkidavt.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifaxsqkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3716
- - C:\Temp\ifaxsqkica.exe
    C:\Temp\ifaxsqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5632
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:448
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifaxsqkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:776
- - C:\Temp\i_ifaxsqkica.exe
    C:\Temp\i_ifaxsqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ausmkecxup.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1412
- - C:\Temp\ausmkecxup.exe
    C:\Temp\ausmkecxup.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3936
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4372
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ausmkecxup.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3396
- - C:\Temp\i_ausmkecxup.exe
    C:\Temp\i_ausmkecxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5716
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rmjhczurmk.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5388
- - C:\Temp\rmjhczurmk.exe
    C:\Temp\rmjhczurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5372
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1296
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2660
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rmjhczurmk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\i_rmjhczurmk.exe
    C:\Temp\i_rmjhczurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cztrmjhbzu.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5180
- - C:\Temp\cztrmjhbzu.exe
    C:\Temp\cztrmjhbzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2112
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1028
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cztrmjhbzu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:824
- - C:\Temp\i_cztrmjhbzu.exe
    C:\Temp\i_cztrmjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3260
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bztrljebwt.exe ups_run
  2⤵
  PID:3916
- - C:\Temp\bztrljebwt.exe
    C:\Temp\bztrljebwt.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3644
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bztrljebwt.exe ups_ins
  2⤵
  PID:1404
- - C:\Temp\i_bztrljebwt.exe
    C:\Temp\i_bztrljebwt.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wqoigbytql.exe ups_run
  2⤵
  PID:716
- - C:\Temp\wqoigbytql.exe
    C:\Temp\wqoigbytql.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wqoigbytql.exe ups_ins
  2⤵
  PID:5268
- - C:\Temp\i_wqoigbytql.exe
    C:\Temp\i_wqoigbytql.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5772
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igayvqniga.exe ups_run
  2⤵
  PID:3812
- - C:\Temp\igayvqniga.exe
    C:\Temp\igayvqniga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5344
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3412
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4228
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igayvqniga.exe ups_ins
  2⤵
  PID:4436
- - C:\Temp\i_igayvqniga.exe
    C:\Temp\i_igayvqniga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nlidavtnlf.exe ups_run
  2⤵
  PID:5716
- - C:\Temp\nlidavtnlf.exe
    C:\Temp\nlidavtnlf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1020
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nlidavtnlf.exe ups_ins
  2⤵
  PID:4344
- - C:\Temp\i_nlidavtnlf.exe
    C:\Temp\i_nlidavtnlf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3132
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\kicaysqkic.exe ups_run
  2⤵
  PID:1056
- - C:\Temp\kicaysqkic.exe
    C:\Temp\kicaysqkic.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:728
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5492
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2848
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_kicaysqkic.exe ups_ins
  2⤵
  PID:5444
- - C:\Temp\i_kicaysqkic.exe
    C:\Temp\i_kicaysqkic.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2556
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfzxupnhfz.exe ups_run
  2⤵
  PID:3192
- - C:\Temp\hfzxupnhfz.exe
    C:\Temp\hfzxupnhfz.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6024
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5520
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1996
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfzxupnhfz.exe ups_ins
  2⤵
  PID:5956
- - C:\Temp\i_hfzxupnhfz.exe
    C:\Temp\i_hfzxupnhfz.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ezxrpjhbzu.exe ups_run
  2⤵
  PID:4948
- - C:\Temp\ezxrpjhbzu.exe
    C:\Temp\ezxrpjhbzu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1316
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:612
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ezxrpjhbzu.exe ups_ins
  2⤵
  PID:1536
- - C:\Temp\i_ezxrpjhbzu.exe
    C:\Temp\i_ezxrpjhbzu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urpjhbztrm.exe ups_run
  2⤵
  PID:4196
- - C:\Temp\urpjhbztrm.exe
    C:\Temp\urpjhbztrm.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5712
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urpjhbztrm.exe ups_ins
  2⤵
  PID:1676
- - C:\Temp\i_urpjhbztrm.exe
    C:\Temp\i_urpjhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2456
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romgeywuom.exe ups_run
  2⤵
  PID:492
- - C:\Temp\romgeywuom.exe
    C:\Temp\romgeywuom.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4956
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5380
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romgeywuom.exe ups_ins
  2⤵
  PID:2372
- - C:\Temp\i_romgeywuom.exe
    C:\Temp\i_romgeywuom.exe ups_ins
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:712

C:\Temp\zxrpmhfzxr.sys
C:\Temp\zxrpmhfzxr.sys
1⤵
- Executes dropped EXE
PID:5076

C:\Temp\wrojhbywur.sys
C:\Temp\wrojhbywur.sys
1⤵
- Executes dropped EXE
PID:5540

C:\Temp\ljgbytrljd.sys
C:\Temp\ljgbytrljd.sys
1⤵
- Executes dropped EXE
PID:5896

C:\Temp\oigaytqnlj.sys
C:\Temp\oigaytqnlj.sys
1⤵
- Executes dropped EXE
PID:5996

C:\Temp\qlidbvtqlj.sys
C:\Temp\qlidbvtqlj.sys
1⤵
- Executes dropped EXE
PID:252

C:\Temp\avsnkicays.sys
C:\Temp\avsnkicays.sys
1⤵
- Executes dropped EXE
PID:4312

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
- Executes dropped EXE
PID:4532

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\cwupmhfzxr.sys
C:\Temp\cwupmhfzxr.sys
1⤵
- Executes dropped EXE
PID:1404

C:\Temp\zwuomgezwr.sys
C:\Temp\zwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:4780

C:\Temp\bwtrljhbzw.sys
C:\Temp\bwtrljhbzw.sys
1⤵
PID:2296

C:\Temp\wqoljgbytr.sys
C:\Temp\wqoljgbytr.sys
1⤵
PID:1252

C:\Temp\wqoigaytqo.sys
C:\Temp\wqoigaytqo.sys
1⤵
PID:5088

C:\Temp\nlidaysqki.sys
C:\Temp\nlidaysqki.sys
1⤵
PID:5504

C:\Temp\nkfcavsnkf.sys
C:\Temp\nkfcavsnkf.sys
1⤵
PID:2872

C:\Temp\kicaxrpnhf.sys
C:\Temp\kicaxrpnhf.sys
1⤵
PID:6128

C:\Temp\pkhcausmke.sys
C:\Temp\pkhcausmke.sys
1⤵
PID:2320

C:\Temp\zxrpjhczur.sys
C:\Temp\zxrpjhczur.sys
1⤵
PID:4576

C:\Temp\uomgebztrl.sys
C:\Temp\uomgebztrl.sys
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztomgeztr.exe

Path C:\Temp\bztomgeztr.exe
Size 230KB
SHA256 507a29bfa5922521715e77a7f517fd03b54c10e30d8feace3a952efca4bba3ce
MD5 0ffa527db9dd0c9472f07d3910f85e95
SHA1 1756ee0c36a2552c06e0ff44757b300b419edcca
SHA512 737831bd36fde5cab05cd5f6f88979168538629976359886b262aa1d2983caa92d6a10bee130be76c729a64ac1ba47b7f49a4cb66b61d58f95ff13c39a471bd1
SSDEEP 3072:bJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:bghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdbytqlidb.exe

Path C:\Temp\gdbytqlidb.exe
Size 230KB
SHA256 25068b30b86c0ef71f2bdabf97728f0d88e3e939126d6b9eff9f1cdf32160784
MD5 41dac5b82e8acefb039e6d11829d0e12
SHA1 d6e3bc2c6ad2b2b96560c123af7d3394ad847497
SHA512 da7cd9bfea83c6ed513721ea3b2cdc7a1cc30186b45242d0a27cfc0e8a024d63248d0a63dcff1b2ae54979c75b98859b25f51b1f2e846aea3a0597833e27171e
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T136344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrmhfzu.exe

Path C:\Temp\hezxrmhfzu.exe
Size 230KB
SHA256 e9a91703dda2723f67708e623dce73a168642672187f626548d70ec3307b0790
MD5 392095dd7269936be1c829a75d4b9056
SHA1 4f46a6767be778e2271bb7039a0db91cbdb53296
SHA512 945dee11edbbc01590cd58a4738547042957d3ce7af0d12c09d842fff256d242b925f7b7e43a545bf898bf46e26d67053c8c25d78e373402ff32c53ebfe66ecd
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T16E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bztomgeztr.exe

Path C:\Temp\i_bztomgeztr.exe
Size 230KB
SHA256 30a7ed7f03fc3924ba6a9f182f7f8fe43a5622efbff8e595ef6baa935d970c28
MD5 ef55d09dcdccf031fbac9128776f804a
SHA1 e8cd26c7af85dd52b7ba121342e0a9054da3c2c5
SHA512 8ff256f1eb2090e0f74b735edbf419eca42096251ee93ffb3107bb2f72630cb7929c48de9b607b64e7788609abf493a12dfb1d35b9c60c575ea08f4109e9d56c
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdbytqlidb.exe

Path C:\Temp\i_gdbytqlidb.exe
Size 230KB
SHA256 5403ad9d735e5f41be57d6e44076718f0c18dea2da0b5ed4bcf7e5678467556c
MD5 2288f6066e072ab64dde2885104a7e2e
SHA1 e12f18e7f053031ad85d5c603e6bedca979cbd09
SHA512 53f309fd3167cd5f2c49f15568496d29985a6460a27fe0938dd93beaf86fcd891c4d0c879babcec344f7bcf01e3af053d8fae6a6ba60020dbab04753784d6f8e
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T19C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrmhfzu.exe

Path C:\Temp\i_hezxrmhfzu.exe
Size 230KB
SHA256 097073ebb96040100cff53fe542841166b7d08827d678202a25d7a5fdbcacfea
MD5 35811380873b3ebf7369623369a4e40d
SHA1 08604abbab260f275b8e2b6e53b77eb35f793b28
SHA512 e43af5c0a76b2c9cf4c6c28360c2f4ade83548ad0d28b4fffe21b62323f4f1fa1185c7176472a7d5ff3b21f576781e31a7475391b88d7d8d5e46b400e62eca77
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T15A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojgbztrlj.exe

Path C:\Temp\i_rojgbztrlj.exe
Size 230KB
SHA256 f674584b77707f8a4643276aff6b9ea7216e69dbf74955ea121763026136bc25
MD5 89602eb602785d90851fc17a51f92840
SHA1 9e5dd05fec06d31485e8bca63dada3b935c072bb
SHA512 e1935fcb589480de42ad2a4aa6f1a5e1f6ecfbe702a4e411f04dedff36c4ccc0b81fc64a354a6ccd1a3abf3487b9942ce6a2127ca534239a55dcd650ff3b46e0
SSDEEP 3072:TJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:TghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_romgeywuom.exe

Path C:\Temp\i_romgeywuom.exe
Size 230KB
SHA256 43e7bc3c7848a92b364e6adbf0e0114d1aa8aec0df6db626f699b7101a32f0fc
MD5 c69887b161c30178348f17c883b7f8b6
SHA1 f22596f428d09d4d6c1ce062ec32080d673e37fc
SHA512 320f05b8f4687346a8bb48df36b3cc6561a894d67db857ed7dda3037d18ff2d89d61ef77a0d78d9e42f9da761d90e00d4703815487015b8d1248bd83fd0c118b
SSDEEP 3072:mJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:mghLQ0sQmpcF8BzXfwVfAI
TLSH
T1EF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbytrljd.sys

Path C:\Temp\ljgbytrljd.sys
Size 141KB
SHA256 008d5ac8ad7652c7696f0fe5f6c86d5f663f92a16260bfe04274038c98e59a92
MD5 1046ee4330f94e720c94f75f4fbf978b
SHA1 8404091e56d2583c9cd44b7237516321aa7b5c7c
SHA512 bd6a3ddfef03330b91642004f625c9d459b8d8ee2cd2097d4ced135b346c374e6806c6a179d59402966b3bc2a5f7d53c5ffa94c29c4877b38f3d8706f82eb2f7
SSDEEP 3072:AsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:AsQmpcF8BzXfwV
TLSH
T103E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaytqnlj.sys

Path C:\Temp\oigaytqnlj.sys
Size 141KB
SHA256 87c1f46f33f562260f3c2d59576c635a0c23ab2c25928a05fb37af3ec8fc84fd
MD5 60d7d023414820c992de4aab0ae4ae06
SHA1 d40f3240b6dbb924d23d1a198419ac88b0351e5e
SHA512 2b517a3aca096a3750dc770dcde679bf7ad02d84bf5719709f19d388aa922d33dcc08413a019eb67483742673468e0fba4ded56928ef08221040a4b223f5dde4
SSDEEP 3072:4sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:4sQmpcF8BzXfwV
TLSH
T118E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlidbvtqlj.sys

Path C:\Temp\qlidbvtqlj.sys
Size 141KB
SHA256 aa8864cd991852d0d8419034b3149765357cf727939fb0a566367557b36934cd
MD5 a2d710cc24b7e11af2d81c968b6e91f1
SHA1 2aaaf8b8375d4042844ed6043870d8bb8cdfeb9f
SHA512 d32b16cc38927680e6aa006b8e7a47cbf007c6123ac94f553e49e61602a03c4b9c816572528e3dd41ecbe4a86ad65322ffb06422dbc5eea941a83a0e8fa4b185
SSDEEP 3072:FsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:FsQmpcF8BzXfwV
TLSH
T101E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojgbztrlj.exe

Path C:\Temp\rojgbztrlj.exe
Size 230KB
SHA256 a461bffb1edce9492590c22564411104a69509ad3b8f572f21274ab61b27ae81
MD5 28c859aec43cfdc62862c9955c3180e7
SHA1 1bbae519ff10439f84ddc8f10736b05185fce925
SHA512 1fdc13d9f25c3e78c3eb5538fa494ff0936e64a51fbdbbb8e586db77af1603155c8d8178a3a02faa43a30e1e98a1f2bb53870dfd8450be454c7a996b9408ed95
SSDEEP 3072:zJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:zghLQ0sQmpcF8BzXfwVfAI
TLSH
T14E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgeywuom.exe

Path C:\Temp\romgeywuom.exe
Size 230KB
SHA256 7e4137bbbf79fcd3af0b9e749c9ee90930f796f32db6b1ad62eaf460ac40e481
MD5 a38409622a42c314e3867d400ba820e7
SHA1 980e6ff3bbe65286879131e970a24650d072db51
SHA512 6ff22d21cd19d5ec3604dc02ddf8e184d0668b50a93113078492d516ab44bdbf7b5811546778d208f0be6bcaac28757d32ac39a9eb6f941714c3b59f41df5f59
SSDEEP 3072:cJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:cghLQ0sQmpcF8BzXfwVfAI
TLSH
T13B344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wrojhbywur.sys

Path C:\Temp\wrojhbywur.sys
Size 141KB
SHA256 ba47dbf490119d3c55bb535484adba951fddf9273534fc6aed3aad01ee6e8676
MD5 afabdda0b089fd326debde6a524588a6
SHA1 cded7945776b92f8b8ae08864207f989ea1ef5a7
SHA512 c3f96bafaf07762980ccc1059033d3216a258d63e4962604a95827901cb8d59efba6e08a50f6a216c2cd430b7b6a3e31c442c55d7fff76c51d54e337b1dba093
SSDEEP 3072:DsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:DsQmpcF8BzXfwV
TLSH
T193E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicavsn.exe

Path C:\Temp\ysqkicavsn.exe
Size 230KB
SHA256 2c2095276955bffb2073cbd6900beeb63ca41d2b4e240e2cceae6bc70495b998
MD5 6be61d912b301a89a1a6842489eca8d7
SHA1 e34bcbe2c2ea6ca88a1161def8268636596a7b54
SHA512 41502b1b53d700af06126f271cca8ca6f3e492275b083dc399dc188d01c6dc1ad4269275a11e25d758e00e0d26d284ea976d6827fb65b1f138b65c1edfa042bd
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T159344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpmhfzxr.sys

Path C:\Temp\zxrpmhfzxr.sys
Size 141KB
SHA256 82c8963cbf9bc4de646f1cacfe14fe2828530854ca7725378446628ca27b86bd
MD5 917a41e63d3ead52e9293f44e49767ca
SHA1 6dfe96391252e552df23fe57551efcc4dd203029
SHA512 57801ad86553703143808d62925400125bbb6689173f41251ffe50f2b76dbc33c032cdf85897b4f1aca398c5de013bdfcb2330d96010752870a9457ec4b5bdbc
SSDEEP 3072:0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:0sQmpcF8BzXfwV
TLSH
T1B1E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d17214595c87dd8a5fb392cb8368d6ea3568bdc0c7d4cf6577eb124de4ae3839
MD5 f57eb397ba07a3b1eef90a66d376f298
SHA1 7c97dc1abbff37c5a1bdf63f815e2cbe21bff7cb
SHA512 9b49417ebf51084c087e9155be6b119addeee43a474926a9e79db8ad3b559c1029d60184fa7df866c4b4584d6194a9887106b8b038eca008efdec4559a9ee10b
TLSH
T18051540343FA8BE1CB1DEDB272EF5E8636B04476651B5F1060A4B1B41977FAAE442CE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596363.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596363.TMP
Size 2KB
SHA256 4de43f76778acdb30a1d82dda73977560abb02f907562f25175221ddf4ca9aba
MD5 a65cf554798cb8931df024771f390236
SHA1 f9d0f7d7803df17420f6171f9edd3233528e767c
SHA512 0cee9c6510e1d69a798805e15855281570017e2f233d6a1ab7a090501c5c0b7332dfedc65d483914aa15013a14bfc494d37b397f682534350e162501c9298207
TLSH
T1BE51550343FA8BE1CB1DEDB272EF5E8636B04476651B5F1060A4B1B01977FAAE442CE4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 55b846efd997c54797560fb06a8ff2f6bde8bb560878d203385722f1286feaaa
MD5 d70d2607106630517888d7fc92515299
SHA1 1383a502e36e822de0f779e03ff91446cbe7eeec
SHA512 ad29fba15a1b29763e122a58b21f79177b66eae524ca46e82822fdc01fde20e90cb1fb8e9fbdae3fb1ccc896e3c0d9e51561147fd4159559989d55cfba07d799
TLSH
T16151DDF3C3E9862DC90156F0AA14AE2BDE1D0A15832C3D5AC9D4EF5B93E3471E142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1f8cc607a4e9042202b169bc0bf88439bf628389490084f8c3d82ac24a951b3e
MD5 a37369ba3ddf7d1d72a9484e166586a2
SHA1 4b5d3d976c2f7e32aab04da593c0bb29e80fa275
SHA512 6d12ca097b186249218d6d729854b3b8540f1121aa86a45ea4168a1d976d64514f832d1938cc05d6e3a70d25906347de21c96630b2c0851da6008a85a8534640
SSDEEP 192:sxRVRWyM/jK1Ml8wCs/fqsXS53Zn73zoA8p93/g6+WNCDRfYnxtWGcIgtJ:sxRVQ8s/fqsXUJ7eJ/5sfym3
TLSH
T1AA62EB15AA285977CCDBD20DFA557F53D6F81573A2901E44A9FCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bc63ce0b94ddad8174808ae14ed43eebd21521054beac33d80a854afe1538da8
MD5 a8858089a2927aa3d1d6ccf0253ded73
SHA1 73e837ca24bf55750c1c5afec284eee08a9fa1cc
SHA512 093429a3bdd431ccee01ce4193d4624e6ecbd097bec6c8d257f7998ce68f0bcd8239c2fac3f486db75b73eac53d0527226e823c6da3648311cc27de646176966
SSDEEP 192:sxRGRWyM/jK1Ml8UQvCs/fqskS53Zn73zoA8pr3/g6+WNCDRfYnxtWGcIgDyJ:sxRGQq6s/fqskUJ7eT/5sfImK
TLSH
T10E62DA16AA289977CCDBD20DFA517F53D6F81573A2901E44A9FCCA0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cc479da29e03c52c49082f7e5ce80ab2ba1c8418da19a3a823c66b4125a02390
MD5 4e3a66aecac1d8d99f781bba523a959c
SHA1 79d9a0d2742281f75d3a31853bbc07c37891f565
SHA512 23f422801fe318cd403e030ee4e8be99c2bf763e04c0f865707d6b70cefa7a04b25b01611661726cc14b6b442b9dc2acc0fbb07c120becd4e154f3e7f876231e
SSDEEP 192:sxRGRWyM/jK1Ml8wCs/fqskS53Zn73zoA8p93/g6+WNCDRfYnxtWGcIgDyJ:sxRGQ8s/fqskUJ7eJ/5sfymK
TLSH
T10562DA15AA285977CCDBD20DFA557F53D6F81563A2901E44A9FCCA0C01E7BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d04e8820c57045b3ba9c92505836fdde8865f7406e513b34189b4bd6f341ef00
MD5 d3e2fab9477bb58bc010551cf8d4559b
SHA1 a114ff0b562e5e95d92ede09d4bd2df34eb708ae
SHA512 7ad7e59fd7697089769f1230ccc069275321ad72f9d7454dd63e037de98120cce5910a6c6b9e9f72fc7df1a7eb66a0008d460b5a0631e90f3724b3324ab55a65
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrs3XguVroMjYB9:Jl6hhQE7b2WgqcfHwu1ja8s3QuuMjY
TLSH
T162E2EC3B780CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA984C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c51fad737eea8d0bde73c54a2d67f822647b83de59fc318ed787b734e116d1fe
MD5 566f30c6f5921555a834fd4f8843644c
SHA1 b5e1f815a8f56996597a9a1da4e977705c4eddf3
SHA512 81e1f40a4005eea37c5b769fb01223e33bd5409f0f1be5f1526b620f6d916b7dfd8a8f4b77d69805322e5890c0584d07720749bed71e53599a7d7eea5a23277e
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHtaTHd3LfWTI2gPfK4Ogxfc1NAj7wBUAya:CjsJ9rhhY1ahl3cgLyzLiVhmHtaTHd36
TLSH
T155A13D1A703F03C1787E254AC5698D9682C170E6315E692B7B6D12E32F67E018FFE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fda0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fda0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 709912387539e30156d0af020ec9c2902432083eafabebe02d0cefc245da1f6a
MD5 01a2743c1edf5c0a508bc245d23981de
SHA1 a13c062b70439e1d37168b541fa0c107b8a8e679
SHA512 2469e381fff0164a3296d5aa863db3434847ca978fe9da9df070797871b87f1be6642cb34144fa8e1e2b02af5eb58aebe1e6407ef01e3fd3bac65d85601708ae
SSDEEP 768:Hj+9M3AN1YreNSLfCfyHrX7DGFzoqPcNMCNF0b9Mq:q9M3VpfCfSr3WkqPaub+q
TLSH
T192F2BFB5AC755D374CE6C288B72A3A57EFE015B746841E48D8EE6F0E078B2AD0307919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 bda8b03ebcc15239829b874272dd028d105ba3e4c1fa71e0cc1c15c2d4286494
MD5 6ce79482b07ff19fd645deb0b6626d52
SHA1 6a2fb75bd951587b493dedf0353d5962aba39ce1
SHA512 318bb8ee15182b15849a10ea97bdf5c486a19773624ede55a7aaeb3a11ee96678b24d4129c82e76f3c8fdfbaf37fa3873f6bd09472980744155e6b82eb4d3369
SSDEEP 768:7j+9M3FN1YreNSLfCfyHrX7DGFzoqPcNMCNF0b9Mq:u9M3GpfCfSr3WkqPaub+q
TLSH
T1C7F2BFB5AC755D374CE6C288B72A3B5BEFE0157746841E48D8EE6F0E078B2AD0307919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 29398964372da6071a4e1447837e999b096bb377b17289a0eeb2713b5682f679
MD5 723d0c4e14f4cc316fc37df5a5db489c
SHA1 c7b05dae718ea45ee61b93de6800c4492b7fdb14
SHA512 8cee2a4ea5e3f75d3c27a7bfd3e3fddfa102d394c39a27867790fa5626e862f9843636dd0dbc7243db91873ac1793c7e9662e3aa03cb85d8cd307208d07a60f5
SSDEEP 768:Grv+4UNbda3TN1YreNSLfCfyHPX7DGFzoqPcNMCNF0/0nT:Gbsb438pfCfSP3WkqPauqT
TLSH
T13303BFB5AC7859378CF7D288F61B3657BFB0146345C00B54D8EA6B0E478F1AE130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 099a27d5235f85a90b8b2e0ed69ee9e2b810301b6b9ef99c73a7b0027611e9df
MD5 79d679a7574f7cf9d452856b5f7d4a9d
SHA1 492506a710b827e3d1f976917cf51acd1f66a92a
SHA512 a526d6eb01cad3b513212eb83ad5b74bf984c2168aaac538558791ad889fe477d1354dc217df84f9605fb72465406d72c32bd2753179d20c1dfd9303fb2c4007
SSDEEP 768:srv+4UNbda3R3YreNSLfCfyHuX7DGFzoqPcNMCNF0eVH1SkH:sbsb43ypfCfSu3WkqPauEH1b
TLSH
T1E603BFB5A8B899374CE7C288B71A3657BFF4116745800F54D8EA6F0E474F2AD130F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 afd6755e893963e7964b9c3f6e3630b885a45fee445e4114932c26e0b8024f5b
MD5 353c912f1c996b543708a8d1c62f74a0
SHA1 e79bdbf25234d44f0e350845ff277dc674916850
SHA512 81b1540a57b69938ee8fcca910a3058514368a4abb4184360151d49c48f1127a6038807b624377207d85243c2d67a715147766cf19ad6cc0f956b9004a44af75
SSDEEP 768:ZF1j+9M3fwg2NLVfCfyH7X7DGFzoqPcNMCNF0b9Mq:o9M3QfCfS73WkqPaub+q
TLSH
T15C1338F598E38936C8AE8787A73D2E469EFCC16371841984BBD91E0DCD871BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

e396138c-2aeb-45af-9adc-fd738c412f2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e396138c-2aeb-45af-9adc-fd738c412f2b.tmp
Size 38KB
SHA256 52687073aea95170dba93ce89c25866615417857e36f0cd7de004e4fe76e5f62
MD5 367b31b17a89bb7f62602d5523f427fc
SHA1 7f3c871118ae3541cddeecf93b5ac3c76cc1b4de
SHA512 cb89818798ef1f36aa59ea2ca471e1bed15347e647c04e5a064061894badcd90b011816977aff09da3982cc3a008664d517f1b161a635946ef5321354bd8e0c9
SSDEEP 768:Vrv+4UNbda3c5YreNSLfCfyIX7DGFzoqPcNMCNZpeVH1SkM:Vbsb43HpfCfX3WkqPa/EH1Y
TLSH
T1BE03BEB5ACB459374CE3C289B75A3617BFF0016746840B94D8EE2F0E479F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23747431-a5b3-4644-94d4-7544dd9e6892.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23747431-a5b3-4644-94d4-7544dd9e6892.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1736_1968925428\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-302-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1252-404-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1404-342-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2296-399-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2320-478-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-364-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2328-338-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-475-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2872-455-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4312-319-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4532-323-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-506-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4720-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4780-372-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5076-191-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5088-424-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5504-435-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5540-238-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5896-266-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5896-286-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5996-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6128-459-0x0000000000010000-0x0000000000083000-memory.dmp

Download