systex | 2b6dd7e9040033a82829e2368c6c70f7d6d2701683226827ea45c075f2c2a249

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260707-dfphyagv81
SHA256 2b6dd7e9040033a82829e2368c6c70f7d6d2701683226827ea45c075f2c2a249
MD5 75ce188be4fa60da82d29b75adbf700a
SHA1 422b7cf07c28f1eca6dde8e941128023c2822191
SHA512 640b934a7f43845251c6e1bed651746aeaa21162f57b951898e6f917e10e080c945952e7ca1122ce7df77ef2204ff963ed7567ec99988bb8d68875161da6e180
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T15C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4628	CP.exe
2164	fzxrmkfzrm.exe
5936	CP.exe
1132	CP.exe
2956	i_fzxrmkfzrm.exe
996	rpecwuomhe.sys
2936	CP.exe
4672	ebztrmjecw.exe
5480	CP.exe
5652	CP.exe
1340	i_ebztrmjecw.exe
4576	jebzwrojge.sys
2528	CP.exe
2852	htrljgbztr.exe
4556	CP.exe
476	CP.exe
2512	i_htrljgbztr.exe
2992	bwtomgeywt.sys
3564	CP.exe
2808	bywtoljgby.exe
1464	CP.exe
2344	CP.exe
2028	i_bywtoljgby.exe
1852	ayvtolgdyw.sys
1128	CP.exe
5400	ytqoigaytq.exe
5204	CP.exe
1376	CP.exe
1156	i_ytqoigaytq.exe
236	gaysqoiyvq.sys
4800	CP.exe
2084	vsqkigaysq.exe
2844	CP.exe
1500	CP.exe
3412	i_vsqkigaysq.exe
5896	ayvqnlfcay.sys
3244	CP.exe
5768	faxvtnkfda.exe
1676	CP.exe
2508	CP.exe
924	i_faxvtnkfda.exe
5976	nkfdausnkf.sys
576	CP.exe
3448	pnhfzxvpki.exe
4152	CP.exe
5296	CP.exe
5952	i_pnhfzxvpki.exe
484	rpnhecausm.sys
5476	CP.exe
1084	smkecxupnh.exe
1392	CP.exe
2828	CP.exe
244	i_smkecxupnh.exe
3732	xrpjhfzxrp.sys
2636	CP.exe
4868	pmhezwrpjh.exe
4472	CP.exe
6064	CP.exe
2992	i_pmhezwrpjh.exe
2788	wurmjecwuo.sys
5364	CP.exe
3716	wrojhbztrm.exe
4272	CP.exe
5848	CP.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2044691454\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1988938144\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2095926536\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2095926536\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1619247204\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2044691454\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_1988938144\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2095926536\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4476_2095926536\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywtrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvqnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfcxukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrmkfzrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	htrljgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_htrljgbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvtnkfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnhfzxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywtrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkigaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvtnkfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnhfzxvpki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaurpmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkecxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaurpmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wrojhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfcxukec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrmkfzrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywtoljgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrojhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqnliga.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvqnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytqoigaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytrljgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5804	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
768	ipconfig.exe
3528	ipconfig.exe
3720	ipconfig.exe
2464	ipconfig.exe
5352	ipconfig.exe
1064	ipconfig.exe
2872	ipconfig.exe
3444	ipconfig.exe
2296	ipconfig.exe
4548	ipconfig.exe
1156	ipconfig.exe
4784	ipconfig.exe
3512	ipconfig.exe
3096	ipconfig.exe
956	ipconfig.exe
5176	ipconfig.exe
2420	ipconfig.exe
4952	ipconfig.exe
2352	ipconfig.exe
1916	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{8CEF6494-52D5-4DCC-9318-8DFEC6C011CB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe
2164	fzxrmkfzrm.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe
4476	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	i_fzxrmkfzrm.exe
Token: SeDebugPrivilege	1340	i_ebztrmjecw.exe
Token: SeDebugPrivilege	2512	i_htrljgbztr.exe
Token: SeDebugPrivilege	2028	i_bywtoljgby.exe
Token: SeDebugPrivilege	1156	i_ytqoigaytq.exe
Token: SeDebugPrivilege	3412	i_vsqkigaysq.exe
Token: SeDebugPrivilege	924	i_faxvtnkfda.exe
Token: SeDebugPrivilege	5952	i_pnhfzxvpki.exe
Token: SeDebugPrivilege	244	i_smkecxupnh.exe
Token: SeDebugPrivilege	2992	i_pmhezwrpjh.exe
Token: SeDebugPrivilege	4608	i_wrojhbztrm.exe
Token: SeDebugPrivilege	3944	i_ztrojhbztr.exe
Token: SeDebugPrivilege	5352	i_jgbytrljgb.exe
Token: SeDebugPrivilege	1900	i_gdyvqnliga.exe
Token: SeDebugPrivilege	3732	i_lfdxvqnlfa.exe
Token: SeDebugPrivilege	5180	i_vsnkfcxvpn.exe
Token: SeDebugPrivilege	3424	i_icaurpmkfc.exe
Token: SeDebugPrivilege	728	i_pmhfcxukec.exe
Token: SeDebugPrivilege	1416	i_mkecwuomhe.exe
Token: SeDebugPrivilege	4572	i_jgeywtrljh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1228	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	87
PID 1948 wrote to memory of 4920	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	88
PID 1228 wrote to memory of 4476	1228	iexplore.exe	89
PID 4920 wrote to memory of 6008	4920	iexplore.exe	90
PID 4476 wrote to memory of 1168	4476	msedge.exe	91
PID 4476 wrote to memory of 5028	4476	msedge.exe	92
PID 4476 wrote to memory of 5804	4476	msedge.exe	93
PID 4476 wrote to memory of 5028	4476	msedge.exe	92
PID 4476 wrote to memory of 5028	4476	msedge.exe	92
PID 4476 wrote to memory of 3124	4476	msedge.exe	94
PID 4476 wrote to memory of 3124	4476	msedge.exe	94
PID 4476 wrote to memory of 5176	4476	msedge.exe	96
PID 4476 wrote to memory of 5176	4476	msedge.exe	96
PID 4476 wrote to memory of 5176	4476	msedge.exe	96
PID 4476 wrote to memory of 2028	4476	msedge.exe	97
PID 4476 wrote to memory of 2028	4476	msedge.exe	97
PID 4476 wrote to memory of 2028	4476	msedge.exe	97
PID 4476 wrote to memory of 2436	4476	msedge.exe	98
PID 4476 wrote to memory of 2436	4476	msedge.exe	98
PID 4476 wrote to memory of 2436	4476	msedge.exe	98
PID 4476 wrote to memory of 4144	4476	msedge.exe	99
PID 4476 wrote to memory of 4144	4476	msedge.exe	99
PID 4476 wrote to memory of 4144	4476	msedge.exe	99
PID 4476 wrote to memory of 3512	4476	msedge.exe	100
PID 4476 wrote to memory of 3512	4476	msedge.exe	100
PID 4476 wrote to memory of 3512	4476	msedge.exe	100
PID 4476 wrote to memory of 5260	4476	msedge.exe	101
PID 4476 wrote to memory of 5260	4476	msedge.exe	101
PID 4476 wrote to memory of 5076	4476	msedge.exe	102
PID 4476 wrote to memory of 5076	4476	msedge.exe	102
PID 4476 wrote to memory of 5076	4476	msedge.exe	102
PID 4476 wrote to memory of 4516	4476	msedge.exe	104
PID 4476 wrote to memory of 4516	4476	msedge.exe	104
PID 4476 wrote to memory of 4516	4476	msedge.exe	104
PID 1948 wrote to memory of 4628	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	105
PID 2164 wrote to memory of 5936	2164	fzxrmkfzrm.exe	108
PID 4476 wrote to memory of 2136	4476	msedge.exe	112
PID 4476 wrote to memory of 3608	4476	msedge.exe	114
PID 4476 wrote to memory of 5752	4476	msedge.exe	113
PID 4476 wrote to memory of 3608	4476	msedge.exe	114
PID 4476 wrote to memory of 5752	4476	msedge.exe	113
PID 4476 wrote to memory of 3408	4476	msedge.exe	116
PID 4476 wrote to memory of 3408	4476	msedge.exe	116
PID 4476 wrote to memory of 2352	4476	msedge.exe	118
PID 4476 wrote to memory of 2352	4476	msedge.exe	118
PID 1948 wrote to memory of 1132	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4476 wrote to memory of 1920	4476	msedge.exe	121
PID 4476 wrote to memory of 1920	4476	msedge.exe	121
PID 4476 wrote to memory of 1920	4476	msedge.exe	121
PID 1948 wrote to memory of 2936	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	124
PID 4672 wrote to memory of 5480	4672	ebztrmjecw.exe	126
PID 1948 wrote to memory of 5652	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	129
PID 1948 wrote to memory of 2528	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	133
PID 2852 wrote to memory of 4556	2852	htrljgbztr.exe	135
PID 1948 wrote to memory of 476	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	138
PID 1948 wrote to memory of 3564	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	142
PID 2808 wrote to memory of 1464	2808	bywtoljgby.exe	144
PID 1948 wrote to memory of 2344	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	147
PID 4476 wrote to memory of 1424	4476	msedge.exe	149
PID 4476 wrote to memory of 3256	4476	msedge.exe	150
PID 4476 wrote to memory of 1964	4476	msedge.exe	151
PID 1948 wrote to memory of 1128	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 5400 wrote to memory of 5204	5400	ytqoigaytq.exe	156
PID 1948 wrote to memory of 1376	1948	2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe	159

C:\Users\Admin\AppData\Local\Temp\2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_75ce188be4fa60da82d29b75adbf700a_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4476
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbde98c188,0x7ffbde98c194,0x7ffbde98c1a0
      4⤵
      PID:1168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,12311840987769463767,15256207268280490298,262144 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,7234167707529865269,5685430733154433241,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
      4⤵
      System Time Discovery
      PID:5804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,11576099375555913325,4870029053937054329,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:13
      4⤵
      PID:3124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,12069396380679515851,10492128562935322747,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,17909806946894896996,13206993665490368885,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,8515481801950402730,10126689148173024859,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:9
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4364,i,15553142533127223029,12840213168515725832,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,8446737384994061766,17501490338045783208,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:1
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,9423944134358701955,12696110565046155666,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:5260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5456,i,16499123677987753013,16005051489354943371,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4448,i,12429296794259025038,10239974715685079665,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:4516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15755866529732147070,17372263473602838027,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:3732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,15755866529732147070,17372263473602838027,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,379663467906784104,11953093476737593780,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,9825359651026603368,11108471148094042020,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:3608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,12273099002622368399,13614739172243941961,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,16900064985633186706,14521090688991264152,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:2352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3920,i,11569873262342577537,1418040003577319118,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,17830119054066427727,1834718819563626455,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=1280 /prefetch:14
      4⤵
      PID:1424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,14502535813640305061,9501466056474864825,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:14
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1420,i,10991975771206989339,3090375699793566776,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
      4⤵
      PID:1964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5724,i,4513775236246352026,6697791030652740242,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
      4⤵
      PID:5988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6751802051016057652,35095468959360510,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=1464 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,16812801845247759586,11091789138596688477,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:5820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,15547285608769643849,14193956056523545497,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5892,i,3277812939680522469,6889741601373013691,2097152 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
      4⤵
      PID:4692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,11878672711432183239,8224787440526434708,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:14
      4⤵
      PID:368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2912,i,9202774834734917661,13079764891555101708,262144 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:10
      4⤵
      PID:5492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1264,i,5191242042973548974,2167111910842975504,524288 --field-trial-handle=2276,i,10496694441861101133,4616192149808086950,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:2668
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:6008
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxrmkfzrm.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4628
- - C:\Temp\fzxrmkfzrm.exe
    C:\Temp\fzxrmkfzrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5936
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1064
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxrmkfzrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Temp\i_fzxrmkfzrm.exe
    C:\Temp\i_fzxrmkfzrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebztrmjecw.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2936
- - C:\Temp\ebztrmjecw.exe
    C:\Temp\ebztrmjecw.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4672
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5480
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebztrmjecw.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5652
- - C:\Temp\i_ebztrmjecw.exe
    C:\Temp\i_ebztrmjecw.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\htrljgbztr.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2528
- - C:\Temp\htrljgbztr.exe
    C:\Temp\htrljgbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4784
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_htrljgbztr.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:476
- - C:\Temp\i_htrljgbztr.exe
    C:\Temp\i_htrljgbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bywtoljgby.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Temp\bywtoljgby.exe
    C:\Temp\bywtoljgby.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1464
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bywtoljgby.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2344
- - C:\Temp\i_bywtoljgby.exe
    C:\Temp\i_bywtoljgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ytqoigaytq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Temp\ytqoigaytq.exe
    C:\Temp\ytqoigaytq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5400
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5204
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3512
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ytqoigaytq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1376
- - C:\Temp\i_ytqoigaytq.exe
    C:\Temp\i_ytqoigaytq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsqkigaysq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4800
- - C:\Temp\vsqkigaysq.exe
    C:\Temp\vsqkigaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2844
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3444
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsqkigaysq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1500
- - C:\Temp\i_vsqkigaysq.exe
    C:\Temp\i_vsqkigaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3412
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\faxvtnkfda.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3244
- - C:\Temp\faxvtnkfda.exe
    C:\Temp\faxvtnkfda.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5768
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1676
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_faxvtnkfda.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2508
- - C:\Temp\i_faxvtnkfda.exe
    C:\Temp\i_faxvtnkfda.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:924
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pnhfzxvpki.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:576
- - C:\Temp\pnhfzxvpki.exe
    C:\Temp\pnhfzxvpki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3448
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4152
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pnhfzxvpki.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5296
- - C:\Temp\i_pnhfzxvpki.exe
    C:\Temp\i_pnhfzxvpki.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkecxupnh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5476
- - C:\Temp\smkecxupnh.exe
    C:\Temp\smkecxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1084
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1392
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3096
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkecxupnh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2828
- - C:\Temp\i_smkecxupnh.exe
    C:\Temp\i_smkecxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhezwrpjh.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\pmhezwrpjh.exe
    C:\Temp\pmhezwrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4472
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:768
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhezwrpjh.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:6064
- - C:\Temp\i_pmhezwrpjh.exe
    C:\Temp\i_pmhezwrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\wrojhbztrm.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5364
- - C:\Temp\wrojhbztrm.exe
    C:\Temp\wrojhbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3716
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4272
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_wrojhbztrm.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5848
- - C:\Temp\i_wrojhbztrm.exe
    C:\Temp\i_wrojhbztrm.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ztrojhbztr.exe ups_run
  2⤵
  PID:4740
- - C:\Temp\ztrojhbztr.exe
    C:\Temp\ztrojhbztr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2764
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3964
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ztrojhbztr.exe ups_ins
  2⤵
  PID:1056
- - C:\Temp\i_ztrojhbztr.exe
    C:\Temp\i_ztrojhbztr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3944
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgbytrljgb.exe ups_run
  2⤵
  PID:5348
- - C:\Temp\jgbytrljgb.exe
    C:\Temp\jgbytrljgb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1496
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgbytrljgb.exe ups_ins
  2⤵
  PID:712
- - C:\Temp\i_jgbytrljgb.exe
    C:\Temp\i_jgbytrljgb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\gdyvqnliga.exe ups_run
  2⤵
  PID:5844
- - C:\Temp\gdyvqnliga.exe
    C:\Temp\gdyvqnliga.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:956
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_gdyvqnliga.exe ups_ins
  2⤵
  PID:2332
- - C:\Temp\i_gdyvqnliga.exe
    C:\Temp\i_gdyvqnliga.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1900
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\lfdxvqnlfa.exe ups_run
  2⤵
  PID:5312
- - C:\Temp\lfdxvqnlfa.exe
    C:\Temp\lfdxvqnlfa.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6136
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_lfdxvqnlfa.exe ups_ins
  2⤵
  PID:4940
- - C:\Temp\i_lfdxvqnlfa.exe
    C:\Temp\i_lfdxvqnlfa.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3732
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vsnkfcxvpn.exe ups_run
  2⤵
  PID:5368
- - C:\Temp\vsnkfcxvpn.exe
    C:\Temp\vsnkfcxvpn.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2256
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1916
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vsnkfcxvpn.exe ups_ins
  2⤵
  PID:2348
- - C:\Temp\i_vsnkfcxvpn.exe
    C:\Temp\i_vsnkfcxvpn.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5180
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\icaurpmkfc.exe ups_run
  2⤵
  PID:5376
- - C:\Temp\icaurpmkfc.exe
    C:\Temp\icaurpmkfc.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2352
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6024
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_icaurpmkfc.exe ups_ins
  2⤵
  PID:3648
- - C:\Temp\i_icaurpmkfc.exe
    C:\Temp\i_icaurpmkfc.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\pmhfcxukec.exe ups_run
  2⤵
  PID:1608
- - C:\Temp\pmhfcxukec.exe
    C:\Temp\pmhfcxukec.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2244
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_pmhfcxukec.exe ups_ins
  2⤵
  PID:2304
- - C:\Temp\i_pmhfcxukec.exe
    C:\Temp\i_pmhfcxukec.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mkecwuomhe.exe ups_run
  2⤵
  PID:4776
- - C:\Temp\mkecwuomhe.exe
    C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3956
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3908
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mkecwuomhe.exe ups_ins
  2⤵
  PID:4976
- - C:\Temp\i_mkecwuomhe.exe
    C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeywtrljh.exe ups_run
  2⤵
  PID:2368
- - C:\Temp\jgeywtrljh.exe
    C:\Temp\jgeywtrljh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1340
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeywtrljh.exe ups_ins
  2⤵
  PID:1468
- - C:\Temp\i_jgeywtrljh.exe
    C:\Temp\i_jgeywtrljh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5116

C:\Temp\rpecwuomhe.sys
C:\Temp\rpecwuomhe.sys
1⤵
- Executes dropped EXE
PID:996

C:\Temp\jebzwrojge.sys
C:\Temp\jebzwrojge.sys
1⤵
- Executes dropped EXE
PID:4576

C:\Temp\bwtomgeywt.sys
C:\Temp\bwtomgeywt.sys
1⤵
- Executes dropped EXE
PID:2992

C:\Temp\ayvtolgdyw.sys
C:\Temp\ayvtolgdyw.sys
1⤵
- Executes dropped EXE
PID:1852

C:\Temp\gaysqoiyvq.sys
C:\Temp\gaysqoiyvq.sys
1⤵
- Executes dropped EXE
PID:236

C:\Temp\ayvqnlfcay.sys
C:\Temp\ayvqnlfcay.sys
1⤵
- Executes dropped EXE
PID:5896

C:\Temp\nkfdausnkf.sys
C:\Temp\nkfdausnkf.sys
1⤵
- Executes dropped EXE
PID:5976

C:\Temp\rpnhecausm.sys
C:\Temp\rpnhecausm.sys
1⤵
- Executes dropped EXE
PID:484

C:\Temp\xrpjhfzxrp.sys
C:\Temp\xrpjhfzxrp.sys
1⤵
- Executes dropped EXE
PID:3732

C:\Temp\wurmjecwuo.sys
C:\Temp\wurmjecwuo.sys
1⤵
- Executes dropped EXE
PID:2788

C:\Temp\trljebztrl.sys
C:\Temp\trljebztrl.sys
1⤵
PID:2184

C:\Temp\dbvtolgdyw.sys
C:\Temp\dbvtolgdyw.sys
1⤵
PID:4444

C:\Temp\oigaytqolg.sys
C:\Temp\oigaytqolg.sys
1⤵
PID:2348

C:\Temp\lfdayvqoig.sys
C:\Temp\lfdayvqoig.sys
1⤵
PID:2032

C:\Temp\snlfdxvpnk.sys
C:\Temp\snlfdxvpnk.sys
1⤵
PID:5896

C:\Temp\hfvpnkhczx.sys
C:\Temp\hfvpnkhczx.sys
1⤵
PID:3056

C:\Temp\pnhfcausmk.sys
C:\Temp\pnhfcausmk.sys
1⤵
PID:6032

C:\Temp\omhezxrpjh.sys
C:\Temp\omhezxrpjh.sys
1⤵
PID:3676

C:\Temp\jecwtrljeb.sys
C:\Temp\jecwtrljeb.sys
1⤵
PID:5456

C:\Temp\wtomjebwuo.sys
C:\Temp\wtomjebwuo.sys
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvtolgdyw.sys

Path C:\Temp\ayvtolgdyw.sys
Size 141KB
SHA256 11cbb624e3636e1d002b0fb068abd1b9af6fa403709f296eb7986f4a162e9ad2
MD5 a0ec37c0bd7fdc5fcd9e262e51b376ed
SHA1 9d00c7b2cb9575315d84bf5c90ab7c82ec7e709d
SHA512 51409b659377d3aa1a56cd745934534f48583ee6940408023bce1762ddd94f844eac949101920fe43d7e4d0a25cbcd508c29dcaf2ecc6e419efed8cd197a24df
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T1E4E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bwtomgeywt.sys

Path C:\Temp\bwtomgeywt.sys
Size 141KB
SHA256 9ca3430813b89644efda5cff361da87ff84ac474eb7459f1f86c716ff4116979
MD5 187a5e8195ea5c114b2e3800a6be49c8
SHA1 ffff41e57b900103426ed5064d99b01812ed29a1
SHA512 3982a4cecf9f21ff86398eb82975dbfff39c3c8df4361b12a6a287cca3739239983ea4dd1e0b986b743223be8347e06e3cd8efdb6c5ab20e6ed807cf075cf228
SSDEEP 3072:zsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:zsQmpcF8BzXfwV
TLSH
T1F4E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywtoljgby.exe

Path C:\Temp\bywtoljgby.exe
Size 230KB
SHA256 d2c1581826892430e5f34ffbd7ed61a8e9e4d8b71bb95197cd875cf7b9b30ce8
MD5 e474bd5802a39dae58d23431c8bf9ab2
SHA1 16fcf1d9e911004064fcc449f008de8e2b0c2356
SHA512 18ca03078acc2e68cc97854d9ea2d1a4f274450024059e0725e694f898ddb0635b8b144ee178026e495e61a146b0b46d8833c4dde563081b8377bfd4f832d986
SSDEEP 3072:CJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:CghLQ0sQmpcF8BzXfwVfAI
TLSH
T17D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebztrmjecw.exe

Path C:\Temp\ebztrmjecw.exe
Size 230KB
SHA256 cecd22ba919b5195695195c86bcfd3090a2a4ef47af493c82640340c9269998e
MD5 7617c9c3e292a3e5929bd469973d000a
SHA1 0e7edef74f0d1da2632cb1f0bea4fe89f395ec63
SHA512 ba13db28a1e927e3f9d26f1e819e344867afda2e85f90179753fc5e8b25f3b71f5d06604293a87761d5e51f36b0d0a7267b5674e44d12d3013c466cfbb90e2b9
SSDEEP 3072:rJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:rghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxrmkfzrm.exe

Path C:\Temp\fzxrmkfzrm.exe
Size 230KB
SHA256 a499d7416e82d31400d884419b4d7b74655859ee343796f1a4f7f34016e60487
MD5 b26cf772ca1985c86341c9e1a0f34e35
SHA1 c38cc0fb1ba8fb98c9f5a6c69413adb4dff1e0c5
SHA512 12c93f8ed56a9d143ee649c8adec69fde71bf7d8bdd9c1a9c86862c745c135e374ae78a56267d5f3dc234867722da1a9d2c4e0f2b3d76849630a597e9c0a7a66
SSDEEP 3072:8JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:8ghLQ0sQmpcF8BzXfwVfAI
TLSH
T11C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqoiyvq.sys

Path C:\Temp\gaysqoiyvq.sys
Size 141KB
SHA256 db83e41d6aef26050a02478b815fc74358f11efbad9f8a8d1cd84322afcff55b
MD5 49102213bdf8d52a0825498c080f6b66
SHA1 4463433b81d8dd33dbe0fb97480de7d000a68f31
SHA512 51c765cd47834c262ec00f834b39f746b222a546c41283a8167e567cdc09fa828d365abad0934e3807b9890897ab04c17767bb1c8e0c077b58e997bdd52c7011
SSDEEP 3072:dsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:dsQmpcF8BzXfwV
TLSH
T1DEE38D02B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

htrljgbztr.exe

Path C:\Temp\htrljgbztr.exe
Size 230KB
SHA256 ddd9c8964cdddc4bce572a98c1453404a15e10c6ad6ab65069a34938c5eb5437
MD5 59fc5bd22a14178759e2c3b40556d1e8
SHA1 79db77745e16ae0d14494d01b2cf8e7f3b934567
SHA512 59035dc7992fa7a575ccc7f0dba677e901a8451fc29ba56d17797842d0fa90fd5dfc3f2b885100f2b4aa95bd431ee72d1547a184173f582fac55283d236f6a44
SSDEEP 3072:IJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:IghLQ0sQmpcF8BzXfwVfAI
TLSH
T177344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bywtoljgby.exe

Path C:\Temp\i_bywtoljgby.exe
Size 230KB
SHA256 93722faf11287c5861cc83b623bec232c68a897cfb1fe5a0cc9a6c0bd79d3291
MD5 939260e0b997196ab0c85667ab47d837
SHA1 cd0748ec74dbdc196051c7dfd6ffef551c552443
SHA512 e3164803a8fb3736584e554db3fdcf53218db0ffee1b22b3889bed9e4fc8c3e990f5c5fd9974451c42a2becd7547f627c2b02303056fb95519be4c6bc510a53d
SSDEEP 3072:eJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:eghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ebztrmjecw.exe

Path C:\Temp\i_ebztrmjecw.exe
Size 230KB
SHA256 168042fea12724b4d045d5329ea8a810f9ae45dee4a56e99f4f1b3f8392bdc92
MD5 812523e0726f32472eaf185f7c0b7c8b
SHA1 1fadd734496ad13330b4f71af31d634e9d6561bf
SHA512 ae978b92404acceb48d04998a7d236ace7501322c070ab512a4bc1b6c9e6c6987bc5145a9db880ef54024befb2ccafcb504703f4055a2f706bca491b19ca4be2
SSDEEP 3072:qJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:qghLQ0sQmpcF8BzXfwVfAI
TLSH
T1D4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxrmkfzrm.exe

Path C:\Temp\i_fzxrmkfzrm.exe
Size 230KB
SHA256 3dc7ad4dea93dff6e3e6d70fbea4f1282ace2a7929d978b0349ad5e97f64815e
MD5 d27fa43015050f58a39d37420d0a64b0
SHA1 1bd6e3ca2efa64bd9c88b206efd51380929ebf2b
SHA512 893c7d44a65902ff0842105eda6ee37a1c037bab0db3bd4e5d47879b60d27e263a6e7b6fc4ff7888871c8c7eb5498dbc80da314be723f2c15168b0e7f77699ec
SSDEEP 3072:VJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:VghLQ0sQmpcF8BzXfwVfAI
TLSH
T186344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_htrljgbztr.exe

Path C:\Temp\i_htrljgbztr.exe
Size 230KB
SHA256 6cb04c4bf0d7d7c9d56f23c7c0e86a5eda17df38afcb20b657ee157f0354a63a
MD5 6145d40becaa2f4dcac0522e473113a2
SHA1 46b06dfbbb97e181669f39cf7ccae2e88a60b5b5
SHA512 3764f64279f12378563075fa352fbfe2bb720560536507f1aaeca526815abe094ec6bb68696e80a9029fc53eb46dbd345feed8c9e459329445e8c9ba73f19a2d
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T10D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytqoigaytq.exe

Path C:\Temp\i_ytqoigaytq.exe
Size 230KB
SHA256 e21b0aec50d7b573640afedf32d68b082d14ef2816960826404ca8b07449a526
MD5 df955dc6907aad942f51bf035f039f65
SHA1 d5314c7cd53f0c8dea540be43b4d660956520ee5
SHA512 c56142f81fd3ee50afc0e8a6ed2a6bb02d9809cae72501f1995dd6f3a72a95ecbbc98af7aca62b430c6103e69ecee0551ad6ad0cfd3d5fe0103937bd5819c491
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T164344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebzwrojge.sys

Path C:\Temp\jebzwrojge.sys
Size 141KB
SHA256 6e3fc867f8bdc5a54a47b71c735f3f259ae6e0398e61a957b06f4de9b846fbdf
MD5 1b5c6c6abcc25edc991fae7ffe7c6355
SHA1 82cf6dc1bde5458f5ec9a9911efb0006961e0185
SHA512 4e7a56cb1956614af85e16658725de8eab1a97bc237052aa914131c4bf97b3817fd602143183644da970f170cacbb810ce1bc5b61c1316b2444f7107a38c9718
SSDEEP 3072:MsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:MsQmpcF8BzXfwV
TLSH
T18CE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpecwuomhe.sys

Path C:\Temp\rpecwuomhe.sys
Size 141KB
SHA256 6f216dad77a38b1f5d7d2ef17ce9be8a9d85bb0fd718bc5d83df62399512598d
MD5 936c70496b0f4da8eb44c75b845f04ac
SHA1 b40db602b598bb51ccd067cca93a7a648037b678
SHA512 493397848079ed632a901a9d996df312591a3bf319758f8e0842d7fba8d6ed8359b913511adcad3aa25f2dd82eec8e763962ca6a9ac4b46a6f1028962bad4ecf
SSDEEP 3072:8sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:8sQmpcF8BzXfwV
TLSH
T1E2E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkigaysq.exe

Path C:\Temp\vsqkigaysq.exe
Size 230KB
SHA256 d06fc5b04ddf7b7b4df981e5061e238da9fc6c1a3e3816ce33de43927724f776
MD5 8ba6d68006f95677beb77ea0b80c03ff
SHA1 7fe3c3a31da3dfdafc776fd047bc03067ee887b0
SHA512 05327dc23c8dc818dfa3f16c2231a56e24660e5818b6450efb8f48ca88f07699b78bfc1d216418cba627ef0ed2e5b9616f35f06ea178de9613274b8d336cd032
SSDEEP 3072:yJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:yghLQ0sQmpcF8BzXfwVfAI
TLSH
T1F5344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigaytq.exe

Path C:\Temp\ytqoigaytq.exe
Size 230KB
SHA256 2c27ef05d84fad7cca80fff97c4b1dd0bdf988e43d94b3534e880caae8b59824
MD5 47325e01e00d165776eb04b27b9991d3
SHA1 08710abd4f9f61d07cf6f646248f3223cedb682c
SHA512 68b897cef5e26430048f7695a692eb9fbc8f76ff98efe9618ab263ca848e2e9a17ed02d2a3f09707c2855011fd8b2e975cf9d33ab35148cadb1e465029d90cb5
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E4344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d0eccd9de1dbbf6cbedcb541fa52903c78d66d4d260136bc73243b056beb74
MD5 12c06f300a4b88646d6fda378a48455e
SHA1 86d58840d0666ad8999198dad1983a8cfd61fd18
SHA512 76e813720fc8cd4d829570b1b32d711d2d751540dea1fcac581dd9a5963c4e3161cffa07350cc8d5477fa02d0eb7b1c29b8ffb567f85b5a94259654ff2af3928
TLSH
T118D092A8BB40ED0ECA91287B25B59A19B6509831FC56061A8866B0E88C517831A1B0FE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b2d903efec8d558eba6ee4ac12873ce1439014705e9d819ff4dfcffa10c4b270
MD5 d9964ad138b9b56ea7891b8576b8a6ce
SHA1 e8153c0a553b8b81a07f1bbc77037f1700b79956
SHA512 7028c8597edeb715bb44be72ae48ceb181161e73b5380897f449df22a8c2b5302f664d632f2373c4c7a712d85a4b0ca70a4a062d6af265eefcac45dd99a660f1
TLSH
T1FCD092A4BB40EC0ECA91287B25B69A19B6409831BC56061A8966B0F88C517831A1B0EE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 97ac0dfbe777df2acfe284633a40fab7a7e579b6cd87f44dc250cb314ec4a8cf
MD5 2ab4ef0f1e01d7d98b269c5e8d59cc1c
SHA1 1754d30a32a166d4dc072baeed5bf2de9ab17d82
SHA512 44affc80d1840af1362dc30133939bb79da0d2c0e3c6009747725f2d74c764f419719976876476a821ecce3f1c9bc1be12b1fecafbbc155037901455ee492772
TLSH
T11151570343FA8BE1CB1DEDB272EF5E8636B04476651B5F1060A4B1B01977FAAE442CE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596344.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596344.TMP
Size 2KB
SHA256 84cf923344f266be54fae7010192b7b3079596d1f7de0ce89e865f862c77306d
MD5 68781e9bee8e0bc4073d7b9a51eab9b3
SHA1 81e899dbd6e6af1726ed51e21659a3543181b21e
SHA512 7cafeb47197c24eb74bb60f740ea9e4c9031c6467ab6251334ff44943173da30ffeabffbb41b98cc8d867dc2e79fc9f22efb6ab3cfc1d37fc299fb2c69cbc702
TLSH
T13B51570343FA8BE1CB1DEDB272EF5E8636B04476651B5F1060A4B1B01977FAAE446CE4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 60c9df523f8de00e178261d9ac2744653c902dd64c4019731fa73f89ef37b87a
MD5 a32104236e1230e4e2ea77ded87b21d2
SHA1 6b08e7a1789a983f3f7d55c443b02dab93465dc3
SHA512 4175eda3eb308f58d9d2f755308409eaa00d9e8731e2f7035147e18a6dd7d222defaff87c504a9cf05fdc0e65393b7bae276c12818142012e531b4c187658aeb
TLSH
T16241CEF3C3E4866E890156F0AA187E1BCE2D0955832C3D5AC9E4EF5B93E2471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dc840c61403fc1d0c18f6c4d4d27a87720bbe7d301b2356ea504761e74fe0129
MD5 364c3ec26535d46214ca3cddf9747771
SHA1 e4ccb260bf7b890903cb0dcb0b3c626247b175a1
SHA512 80668a192b9dccd25ae68ecdb224b4ec1d158bd5324a6765972f28e914469d1e462399a8e7901a9bd71c50499e21c01909793d1624c28dba359f63590a3358d7
SSDEEP 192:sxRcRIyM/jK1Ml8wCs/fhsISKb3Z6QzoA8p9f/g6+WNIYnot6G8IgtJ:sxRcm8s/fhsISyJS1/5ITC3
TLSH
T1F152EB156A34997BCCDBD209FA557F53D6F81573A2901E44AAFCCA0C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 24dd7d2c1cbdf27b68e25060271a95ea2a69305c0499a9b0f7ab43be891cab6d
MD5 622eb5ac4258707c458a1aa579e36f65
SHA1 351aa589a22bb88c750a821d93ec5edc80e66937
SHA512 3bee306eb21f6260f5f72395646efee530b6150075b6eb8ba21da78b11751aa2516bdd3959ddafc2a4bf5713c843d38128af1c26cc4dd53f87896ee2e6af935a
SSDEEP 192:sxR3RIyM/jK1Ml8UQzCs/fhs7SKb3Z6QzoA8prf/g6+WNIYnmt6G8IgDuJ:sxR3mqWs/fhs7SyJSr/5IDCO
TLSH
T1E262D9156A38997BCCDBD209FA557F53D6F81573A2901E44AAFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c5e38f62a644b047364e1d036b39b518eb9af10640a7b33a3d5e79eae133358f
MD5 a19c57c54b25d0134fb48b70e146c015
SHA1 0b274f0aeba75a516f884430496b4f9ecf583028
SHA512 d86029f7cd1a12c0e67343d36a30501a47cd4c91077c331057434cc1634618dfada01b1ff62ac63ea2deac88e729d54bdac50cf3cd9bd8fd86ca142ba2b187ab
SSDEEP 192:sxR3RIyM/jK1Ml8wCs/fhs7SKb3Z6QzoA8p9f/g6+WNIYnot6G8IgDuJ:sxR3m8s/fhs7SyJS1/5ITCO
TLSH
T1EE52EA156A34997BCCDBD209FA557F53D6F81573A2901E44AAFC8A0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 1593c5b84e88a297573ce1053dfde734139bbf96f1bd61a8a0cc867a76336ced
MD5 0579ecbab3c39520ae0e9c62b5459630
SHA1 357823c32410a6ef6ec17d55663e6bc5a3de870d
SHA512 5185d7003b27f5c56f209bc6faee4e8adf92f8f1e5eba0e517f3f1176c04376e244a3fbb1dfb87bedb62204749b84fea2372fccaf7fcb1d3b15587421c584b8b
SSDEEP 768:Jl6hhs7pLuL7b2WgqcfHw8F1+UoAYDCx9Tuqh0VfUC9xbog/OVUR3XgugroM90Bd:Jl6hhQE7b2WgqcfHwu1jaLR3QurM9k
TLSH
T152E2EC3B780CCB7F4F804A9CEC29799A6DE801CB96D8CD5447FA894C03C66EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f604075db6a36117f2f74d15e0346921d4df5a771ceae4ecb6a7fe509a13153c
MD5 56f7703d9e234dd1b6e75d5bd2a830a5
SHA1 1b88c1d49b61f34039066c1569c24fc3efc82cd2
SHA512 0ae9987fc3e7413637da14ea2056a453c78f7b38220768e9fd6a2e53b830a3a7fb243089c72be1109c86fb145a9834653b12a3b494f925a333f46f24070cd8ab
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHtaTHd3LfWTI2gPfK4Ogxfc1NAj7wBUAyi:CjsJ9rhhY1ahl3cgLyzLiVhmHtaTHd3C
TLSH
T128A12C16303F03C1787E259E84699D9782C270E6315E682B7BAD12D72F66D018FFE4E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fee8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fee8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a36161885d2a8d8bcc82f2420244b506159026ab3a3f7d6eeccf9bff274e240e
MD5 2423a290270423a2bf7e399f366f16f8
SHA1 273c32c1875b58b051088fdd02456c0d2296d802
SHA512 25cc9b2f0a30f12379daaa10c55ce1cb7e9fc698ed19f8047c858863c21ab290b895112d54cf673d95a7b502ec03a14c4380a7dba4fed74d4fdfcd1399d83a36
SSDEEP 768:WF1j+9M3fwgBAGdNCVfCfyHUX7DGFzoqPcNMCNFFb9Mm:j9M3+fCfSU3WkqPa3b+m
TLSH
T1D6039E76ECA4CA7B9CE3C7C5B7163A4AEFE001A785885ED4D9D96E0D028B1ED030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5c0055b1d5144702124dbcc3db60a8b2ddffe1be804e3b18445eacdad06a5fab
MD5 cf58a8d94cfe81998a4a17cdbb69da58
SHA1 38fa3f175c8281acedf5a9b3f39d156e84cb5494
SHA512 a6c5adf7e768479abaf39b65971b2f1576a20b7b34bdf7fa6e7abeca210f57d1ef5d5d8d1e65d62b33228d8a1108daf8584f623188dd38b31f61fe4b7a87daa3
SSDEEP 768:Vrv+4UNbda3c5YreNSLfCfyIX7DGFzoqPcNMCNZUeVH1SkM:Vbsb43HpfCfX3WkqPaqEH1Y
TLSH
T1CC03BFB5ACB459374CE3C289B75A3617BFF0016746840B94D8EE2F0E479F5AD130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f10ed88fc4bad71e5801cffc7df3957d9d38ba3b9a27983c0139e3494be3bd1a
MD5 df2ac8766d3d54e12b80a7925cc9c1bb
SHA1 16eec41c03b582d38d98db7e425d894f1a05102b
SHA512 35fa19aea72c6e97b1c1ebe86f9a7dcee24247b6bd4f491e3b94c2d74906b483951b6e22de3a1b8239892cbf390b052c5f677150ea7e51a383ddeb9f3d3af36a
SSDEEP 768:wrv+4UNbda3CAGRN1YreNSLfCfyHnX7DGFzoqPcNMCNFF533E:wbsb43tpfCfSn3WkqPa3pE
TLSH
T1CF03AEB5A8B899378CF7C288B75A3697BFF0156345840B54D8EA6B0E434F1AE130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 8fac7c5f87c39cda3b85114e1fd6278adc73305b4e64e471c651d8c0e904ed4f
MD5 e490bbd379bbd6cd2760bd692e41a447
SHA1 49bf5b79abbc73756ed32c4270c25ba2f401a5a7
SHA512 19dd047ec7c232c88669e8ec3d8f64bacd2ff8e92ae4d40a071a82099318c0f16e0777689ba22b3e18823c6072d3e25acfa69166e5a637fb902fc3427305dd0a
SSDEEP 768:Jj+9M3CAGdN1YreNSLfCfyHRX7DGFzoqPcNMCNFFb9Mm:U9M3rpfCfSR3WkqPa3b+m
TLSH
T16DF2BFB5AC649D774CE6C288B71B3A57EFE0157745841F88D8ED6F0E078B2AD030B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3580bd8c59195dd967f78e5f085fec8dc6b7a81333a5722f9ade2cb5c906b55a
MD5 8d04e10c2f121aa49fde5ed5db348bd7
SHA1 3a817440e616549f0a79ce7c9d194a16f98556a9
SHA512 bf6c4d0bce7be55bdd97fba4d94088cdf755d3d6250c4669043280e8f338af2227eb999146c75c3719659f314f5f1984d4bc8493d86ae04c8db73938c30fd633
SSDEEP 768:Wrv+4UNbda3B3YreNSLfCfyH0X7DGFzoqPcNMCNFFeVH1SkH:Wbsb43ipfCfS03WkqPa3EH1b
TLSH
T1EC03BEB5A8B899374CE7C288B75A3657BFF0106745800B54D8EA6F0E474F2AD130F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

e3eb71b8-2712-4404-9703-37d524c254f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3eb71b8-2712-4404-9703-37d524c254f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4476_385663330\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-298-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/484-362-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/484-329-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/996-195-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1852-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2032-438-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2184-386-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2228-524-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2348-418-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2788-374-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-270-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2992-290-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3056-453-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3676-486-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3732-344-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4444-414-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4576-242-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5456-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5896-321-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5896-449-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5976-325-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-501-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6032-474-0x0000000000010000-0x0000000000083000-memory.dmp

Download