systex | b77e3cad22e4a49a7059269e93411a5d7f5df8f721a91539cf8d6d27201e7c7a

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260812-xee3nasgrb
SHA256 b77e3cad22e4a49a7059269e93411a5d7f5df8f721a91539cf8d6d27201e7c7a
MD5 e55a42e8890bc415a0a5aa5a563f2fe6
SHA1 63831660829b0713345bd7b1d7dfb48e3534344b
SHA512 715132d540e5baf22465e7f468067efcd9da207b2cdfa4150d409ebde6b426c68d9a7f85937c8839e4e50dd1e021d70e45a0c823a8eaa280eab55016b23f8ef0
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E1344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6684	CP.exe
4556	omhezmecwu.exe
6416	CP.exe
1740	CP.exe
7148	i_omhezmecwu.exe
3100	romgezwuom.sys
1940	CP.exe
1904	jgeuoljgbz.exe
3288	CP.exe
2604	CP.exe
6680	i_jgeuoljgbz.exe
4220	eywtoljdbw.sys
1620	CP.exe
2588	bytomgeywq.exe
2776	CP.exe
5084	CP.exe
3540	i_bytomgeywq.exe
6248	tnljdbvtnl.sys
5936	CP.exe
6004	tqnlgdyvqo.exe
6716	CP.exe
5340	CP.exe
3868	i_tqnlgdyvqo.exe
5572	vtnlyvqoig.sys
3116	CP.exe
4964	igaysnifay.exe
3300	CP.exe
4372	CP.exe
5448	i_igaysnifay.exe
7100	fdxvqnlfda.sys
6788	CP.exe
6080	fdankfdxvp.exe
1896	CP.exe
1364	CP.exe
6316	i_fdankfdxvp.exe
5640	ifdxvpnhfa.sys
5432	CP.exe
3536	hfaxspkica.exe
4164	CP.exe
700	CP.exe
6672	i_hfaxspkica.exe
5008	czurpnheca.sys
4232	CP.exe
6872	cwuspnhfzx.exe
4920	CP.exe
3808	CP.exe
952	i_cwuspnhfzx.exe
4884	rpmkecxupm.sys
7120	CP.exe
6128	hezxrpjhbz.exe
556	CP.exe
1096	CP.exe
2044	i_hezxrpjhbz.exe
4276	ecwuomgecw.sys
3952	CP.exe
1380	zwuomgezwj.exe
7148	CP.exe
4892	CP.exe
6440	i_zwuomgezwj.exe
1080	uomgeywqoj.sys
4344	CP.exe
2556	trljdbwtom.exe
2316	CP.exe
5496	CP.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_314520687\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1640971814\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_1640971814\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4984_861687005\_locales\fi\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeuoljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwuomgezwj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezmecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytomgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbztrmjwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigebwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvqnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezmecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeuoljgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davtnlfdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhczusmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cwuspnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrpjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbztrmjwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdankfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwuomgezwj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwuomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdankfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbwtom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvqnkf.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7116	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3416	ipconfig.exe
5608	ipconfig.exe
4504	ipconfig.exe
2688	ipconfig.exe
4468	ipconfig.exe
4220	ipconfig.exe
1464	ipconfig.exe
5192	ipconfig.exe
4264	ipconfig.exe
4872	ipconfig.exe
5640	ipconfig.exe
1536	ipconfig.exe
360	ipconfig.exe
6272	ipconfig.exe
4184	ipconfig.exe
4552	ipconfig.exe
6672	ipconfig.exe
4496	ipconfig.exe
6604	ipconfig.exe
4252	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310339549218594"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{B10A6A7A-3146-42DC-ABB8-373D6DF64FFA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe
4556	omhezmecwu.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	7148	i_omhezmecwu.exe
Token: SeDebugPrivilege	6680	i_jgeuoljgbz.exe
Token: SeDebugPrivilege	3540	i_bytomgeywq.exe
Token: SeDebugPrivilege	3868	i_tqnlgdyvqo.exe
Token: SeDebugPrivilege	5448	i_igaysnifay.exe
Token: SeDebugPrivilege	6316	i_fdankfdxvp.exe
Token: SeDebugPrivilege	6672	i_hfaxspkica.exe
Token: SeDebugPrivilege	952	i_cwuspnhfzx.exe
Token: SeDebugPrivilege	2044	i_hezxrpjhbz.exe
Token: SeDebugPrivilege	6440	i_zwuomgezwj.exe
Token: SeDebugPrivilege	2408	i_trljdbwtom.exe
Token: SeDebugPrivilege	2164	i_ljdbvtolge.exe
Token: SeDebugPrivilege	4480	i_davtnlfdxv.exe
Token: SeDebugPrivilege	3152	i_xsqkifaysq.exe
Token: SeDebugPrivilege	404	i_nkfdxvqnkf.exe
Token: SeDebugPrivilege	5568	i_smkfcxupnh.exe
Token: SeDebugPrivilege	1296	i_mjhczusmke.exe
Token: SeDebugPrivilege	5268	i_jhbztrmjwu.exe
Token: SeDebugPrivilege	5728	i_ebwuomgeyw.exe
Token: SeDebugPrivilege	6676	i_tqoigebwto.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 4196	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 6856 wrote to memory of 2960	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	91
PID 4196 wrote to memory of 4984	4196	iexplore.exe	92
PID 2960 wrote to memory of 4656	2960	iexplore.exe	93
PID 4984 wrote to memory of 7024	4984	msedge.exe	94
PID 4984 wrote to memory of 6768	4984	msedge.exe	95
PID 4984 wrote to memory of 7116	4984	msedge.exe	96
PID 4984 wrote to memory of 6768	4984	msedge.exe	95
PID 4984 wrote to memory of 6768	4984	msedge.exe	95
PID 4984 wrote to memory of 3512	4984	msedge.exe	97
PID 4984 wrote to memory of 3512	4984	msedge.exe	97
PID 4984 wrote to memory of 6252	4984	msedge.exe	99
PID 4984 wrote to memory of 6252	4984	msedge.exe	99
PID 4984 wrote to memory of 6632	4984	msedge.exe	98
PID 4984 wrote to memory of 6252	4984	msedge.exe	99
PID 4984 wrote to memory of 6632	4984	msedge.exe	98
PID 4984 wrote to memory of 6632	4984	msedge.exe	98
PID 4984 wrote to memory of 5080	4984	msedge.exe	101
PID 4984 wrote to memory of 5080	4984	msedge.exe	101
PID 4984 wrote to memory of 5080	4984	msedge.exe	101
PID 6856 wrote to memory of 6684	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	102
PID 4556 wrote to memory of 6416	4556	omhezmecwu.exe	105
PID 4984 wrote to memory of 2408	4984	msedge.exe	108
PID 4984 wrote to memory of 2408	4984	msedge.exe	108
PID 4984 wrote to memory of 6480	4984	msedge.exe	109
PID 4984 wrote to memory of 6480	4984	msedge.exe	109
PID 4984 wrote to memory of 3724	4984	msedge.exe	111
PID 6856 wrote to memory of 1740	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	114
PID 6856 wrote to memory of 1940	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	118
PID 1904 wrote to memory of 3288	1904	jgeuoljgbz.exe	120
PID 6856 wrote to memory of 2604	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 6856 wrote to memory of 1620	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	127
PID 2588 wrote to memory of 2776	2588	bytomgeywq.exe	129
PID 6856 wrote to memory of 5084	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 6856 wrote to memory of 5936	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	136
PID 6004 wrote to memory of 6716	6004	tqnlgdyvqo.exe	138
PID 6856 wrote to memory of 5340	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 4984 wrote to memory of 1496	4984	msedge.exe	144
PID 4984 wrote to memory of 2740	4984	msedge.exe	145
PID 4984 wrote to memory of 1680	4984	msedge.exe	146
PID 4984 wrote to memory of 2464	4984	msedge.exe	148
PID 4984 wrote to memory of 2464	4984	msedge.exe	148
PID 4984 wrote to memory of 5500	4984	msedge.exe	150
PID 4984 wrote to memory of 5500	4984	msedge.exe	150
PID 6856 wrote to memory of 3116	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	151
PID 4964 wrote to memory of 3300	4964	igaysnifay.exe	153
PID 6856 wrote to memory of 4372	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	156
PID 6856 wrote to memory of 6788	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	160
PID 6080 wrote to memory of 1896	6080	fdankfdxvp.exe	162
PID 6856 wrote to memory of 1364	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	165
PID 6856 wrote to memory of 5432	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	169
PID 3536 wrote to memory of 4164	3536	hfaxspkica.exe	171
PID 6856 wrote to memory of 700	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	174
PID 6856 wrote to memory of 4232	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	178
PID 6872 wrote to memory of 4920	6872	cwuspnhfzx.exe	180
PID 6856 wrote to memory of 3808	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	183
PID 4984 wrote to memory of 4724	4984	msedge.exe	185
PID 4984 wrote to memory of 4724	4984	msedge.exe	185
PID 6856 wrote to memory of 7120	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	190
PID 6128 wrote to memory of 556	6128	hezxrpjhbz.exe	192
PID 6856 wrote to memory of 1096	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	195
PID 6856 wrote to memory of 3952	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	199
PID 1380 wrote to memory of 7148	1380	zwuomgezwj.exe	201
PID 6856 wrote to memory of 4892	6856	2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe	204

C:\Users\Admin\AppData\Local\Temp\2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_e55a42e8890bc415a0a5aa5a563f2fe6_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x35c,0x7ff98efec188,0x7ff98efec194,0x7ff98efec1a0
      4⤵
      PID:7024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,8266707418799565385,9121747367896175339,262144 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
      4⤵
      PID:6768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,17042654024840664402,5587195836215918867,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
      4⤵
      System Time Discovery
      PID:7116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,7092993401208182268,358990877083235311,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
      4⤵
      PID:3512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,9796219283257490232,1842954598906329726,2097152 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:6632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,12191498490717582424,423810309666114741,2097152 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:6252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4300,i,10347133527185924331,14951048363852316416,2097152 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,2217524970036682171,16820911254373076353,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:2408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,12122634279604596155,8109934220668655359,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
      4⤵
      PID:6480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,522329948161830014,3153913823907437511,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,522329948161830014,3153913823907437511,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:14
      4⤵
      PID:3724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,1657376352241348701,2429606230046993840,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,10553598612063199068,17231283907923502157,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,14646601749851398376,3516090146357412484,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,3699734069499369646,139097449317034395,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,7489243660824343049,2164727125986986635,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,7591400555779816224,17875791709759817041,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=856,i,9452344117402567699,4192988326096264830,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:4600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6552,i,18285519154960070372,18343187675399393475,262144 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:10
      4⤵
      PID:5900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,18380404943460185612,8104524603409650731,524288 --field-trial-handle=2324,i,17290813600896357885,404468917141732680,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:5944
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:4656
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\omhezmecwu.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6684
- - C:\Temp\omhezmecwu.exe
    C:\Temp\omhezmecwu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6416
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:360
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_omhezmecwu.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1740
- - C:\Temp\i_omhezmecwu.exe
    C:\Temp\i_omhezmecwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:7148
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jgeuoljgbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1940
- - C:\Temp\jgeuoljgbz.exe
    C:\Temp\jgeuoljgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1904
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3288
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6604
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jgeuoljgbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2604
- - C:\Temp\i_jgeuoljgbz.exe
    C:\Temp\i_jgeuoljgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6680
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\bytomgeywq.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1620
- - C:\Temp\bytomgeywq.exe
    C:\Temp\bytomgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2776
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_bytomgeywq.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5084
- - C:\Temp\i_bytomgeywq.exe
    C:\Temp\i_bytomgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqnlgdyvqo.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5936
- - C:\Temp\tqnlgdyvqo.exe
    C:\Temp\tqnlgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6716
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4252
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqnlgdyvqo.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5340
- - C:\Temp\i_tqnlgdyvqo.exe
    C:\Temp\i_tqnlgdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3868
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\igaysnifay.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3116
- - C:\Temp\igaysnifay.exe
    C:\Temp\igaysnifay.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_igaysnifay.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4372
- - C:\Temp\i_igaysnifay.exe
    C:\Temp\i_igaysnifay.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5448
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fdankfdxvp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:6788
- - C:\Temp\fdankfdxvp.exe
    C:\Temp\fdankfdxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1896
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4184
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fdankfdxvp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1364
- - C:\Temp\i_fdankfdxvp.exe
    C:\Temp\i_fdankfdxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6316
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hfaxspkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5432
- - C:\Temp\hfaxspkica.exe
    C:\Temp\hfaxspkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3536
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4164
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4552
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hfaxspkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:700
- - C:\Temp\i_hfaxspkica.exe
    C:\Temp\i_hfaxspkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\cwuspnhfzx.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4232
- - C:\Temp\cwuspnhfzx.exe
    C:\Temp\cwuspnhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6872
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4920
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2688
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_cwuspnhfzx.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3808
- - C:\Temp\i_cwuspnhfzx.exe
    C:\Temp\i_cwuspnhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:952
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\hezxrpjhbz.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:7120
- - C:\Temp\hezxrpjhbz.exe
    C:\Temp\hezxrpjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:556
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3416
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_hezxrpjhbz.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1096
- - C:\Temp\i_hezxrpjhbz.exe
    C:\Temp\i_hezxrpjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\zwuomgezwj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3952
- - C:\Temp\zwuomgezwj.exe
    C:\Temp\zwuomgezwj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:7148
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4872
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_zwuomgezwj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4892
- - C:\Temp\i_zwuomgezwj.exe
    C:\Temp\i_zwuomgezwj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6440
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\trljdbwtom.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Temp\trljdbwtom.exe
    C:\Temp\trljdbwtom.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:2316
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4468
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_trljdbwtom.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5496
- - C:\Temp\i_trljdbwtom.exe
    C:\Temp\i_trljdbwtom.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljdbvtolge.exe ups_run
  2⤵
  PID:880
- - C:\Temp\ljdbvtolge.exe
    C:\Temp\ljdbvtolge.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6644
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4220
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljdbvtolge.exe ups_ins
  2⤵
  PID:6464
- - C:\Temp\i_ljdbvtolge.exe
    C:\Temp\i_ljdbvtolge.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\davtnlfdxv.exe ups_run
  2⤵
  PID:4620
- - C:\Temp\davtnlfdxv.exe
    C:\Temp\davtnlfdxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6008
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6016
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5640
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_davtnlfdxv.exe ups_ins
  2⤵
  PID:1600
- - C:\Temp\i_davtnlfdxv.exe
    C:\Temp\i_davtnlfdxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xsqkifaysq.exe ups_run
  2⤵
  PID:6292
- - C:\Temp\xsqkifaysq.exe
    C:\Temp\xsqkifaysq.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1208
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2220
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:6672
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xsqkifaysq.exe ups_ins
  2⤵
  PID:3496
- - C:\Temp\i_xsqkifaysq.exe
    C:\Temp\i_xsqkifaysq.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\nkfdxvqnkf.exe ups_run
  2⤵
  PID:2436
- - C:\Temp\nkfdxvqnkf.exe
    C:\Temp\nkfdxvqnkf.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6912
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:1788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1464
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_nkfdxvqnkf.exe ups_ins
  2⤵
  PID:3408
- - C:\Temp\i_nkfdxvqnkf.exe
    C:\Temp\i_nkfdxvqnkf.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\smkfcxupnh.exe ups_run
  2⤵
  PID:3416
- - C:\Temp\smkfcxupnh.exe
    C:\Temp\smkfcxupnh.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1056
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5600
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5608
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_smkfcxupnh.exe ups_ins
  2⤵
  PID:4276
- - C:\Temp\i_smkfcxupnh.exe
    C:\Temp\i_smkfcxupnh.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5568
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhczusmke.exe ups_run
  2⤵
  PID:3784
- - C:\Temp\mjhczusmke.exe
    C:\Temp\mjhczusmke.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3624
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3388
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5192
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhczusmke.exe ups_ins
  2⤵
  PID:6208
- - C:\Temp\i_mjhczusmke.exe
    C:\Temp\i_mjhczusmke.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1296
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\jhbztrmjwu.exe ups_run
  2⤵
  PID:5888
- - C:\Temp\jhbztrmjwu.exe
    C:\Temp\jhbztrmjwu.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4220
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6308
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4496
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_jhbztrmjwu.exe ups_ins
  2⤵
  PID:5396
- - C:\Temp\i_jhbztrmjwu.exe
    C:\Temp\i_jhbztrmjwu.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5268
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ebwuomgeyw.exe ups_run
  2⤵
  PID:4212
- - C:\Temp\ebwuomgeyw.exe
    C:\Temp\ebwuomgeyw.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3540
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6100
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4264
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ebwuomgeyw.exe ups_ins
  2⤵
  PID:5972
- - C:\Temp\i_ebwuomgeyw.exe
    C:\Temp\i_ebwuomgeyw.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5728
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\tqoigebwto.exe ups_run
  2⤵
  PID:1568
- - C:\Temp\tqoigebwto.exe
    C:\Temp\tqoigebwto.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6084
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1536
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_tqoigebwto.exe ups_ins
  2⤵
  PID:5840
- - C:\Temp\i_tqoigebwto.exe
    C:\Temp\i_tqoigebwto.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6152

C:\Temp\romgezwuom.sys
C:\Temp\romgezwuom.sys
1⤵
- Executes dropped EXE
PID:3100

C:\Temp\eywtoljdbw.sys
C:\Temp\eywtoljdbw.sys
1⤵
- Executes dropped EXE
PID:4220

C:\Temp\tnljdbvtnl.sys
C:\Temp\tnljdbvtnl.sys
1⤵
- Executes dropped EXE
PID:6248

C:\Temp\vtnlyvqoig.sys
C:\Temp\vtnlyvqoig.sys
1⤵
- Executes dropped EXE
PID:5572

C:\Temp\fdxvqnlfda.sys
C:\Temp\fdxvqnlfda.sys
1⤵
- Executes dropped EXE
PID:7100

C:\Temp\ifdxvpnhfa.sys
C:\Temp\ifdxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:5640

C:\Temp\czurpnheca.sys
C:\Temp\czurpnheca.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Temp\rpmkecxupm.sys
C:\Temp\rpmkecxupm.sys
1⤵
- Executes dropped EXE
PID:4884

C:\Temp\ecwuomgecw.sys
C:\Temp\ecwuomgecw.sys
1⤵
- Executes dropped EXE
PID:4276

C:\Temp\uomgeywqoj.sys
C:\Temp\uomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:1080

C:\Temp\tnljdbvtol.sys
C:\Temp\tnljdbvtol.sys
1⤵
PID:1004

C:\Temp\kigaysqlid.sys
C:\Temp\kigaysqlid.sys
1⤵
PID:4160

C:\Temp\khfaxsqkic.sys
C:\Temp\khfaxsqkic.sys
1⤵
PID:5848

C:\Temp\spkicauspk.sys
C:\Temp\spkicauspk.sys
1⤵
PID:1152

C:\Temp\xusmkecauk.sys
C:\Temp\xusmkecauk.sys
1⤵
PID:5576

C:\Temp\mjhcwurmje.sys
C:\Temp\mjhcwurmje.sys
1⤵
PID:5892

C:\Temp\ebztrljhbz.sys
C:\Temp\ebztrljhbz.sys
1⤵
PID:6432

C:\Temp\trljdbwtol.sys
C:\Temp\trljdbwtol.sys
1⤵
PID:1964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytomgeywq.exe

Path C:\Temp\bytomgeywq.exe
Size 230KB
SHA256 446be9df1b419048ab5a690cc2b03a223156847ae1cd7044930ee4a29339e21a
MD5 e7a4c0908bdb9887dd0536b7e7a1fd34
SHA1 08c56c22794be97ca822426713cb5f54722b138f
SHA512 7a2bab29f4739743efd09776020c1fde14b93671ea41ef8c7606217a61d0a25a81ffd731b1f83161c8a0a211ecd53e692f55a7e1e2aefb7c8328b8ef4bcccc2e
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T121344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eywtoljdbw.sys

Path C:\Temp\eywtoljdbw.sys
Size 141KB
SHA256 fd44ff42b505672fde5e7f01e7599e586deea5b72b4057a58370c099f66036e4
MD5 b2535c97a1fc1d58d9cae6e562b7b693
SHA1 b0760f3e046c883ae202d05d76645c7a52e5c70d
SHA512 f17ed61d0a8a54c44ce2b88b5600db9af174f25f15340bf08e3a22c13f344eae2898d99eddf9ab2b931364df0f220f5b5b6164791d510ab5cc585f3f9eb59d23
SSDEEP 3072:gsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:gsQmpcF8BzXfwV
TLSH
T13BE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdankfdxvp.exe

Path C:\Temp\fdankfdxvp.exe
Size 230KB
SHA256 421d9e3ea00b34ed4e73fad852eecfdf0d8971c02efb399217cc71d0d8faa8b6
MD5 40f7a98dd0ca4a1aacb5ddded2029092
SHA1 d496dd8fcc9021995dd2754ed4477634318ae2c0
SHA512 e66ee5d25af9a8a6379dffa775dbba52fab346b08c96307233e69a6f90e234cddbd0d368074f4840cea509c18ecd38ea27998e567a57d0ab494ed308fa4324e1
SSDEEP 3072:SJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:SghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A9344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvqnlfda.sys

Path C:\Temp\fdxvqnlfda.sys
Size 141KB
SHA256 44fea6a7131260189974bc6d75734a052ee7d391843156c39a31e6819f26581f
MD5 f101900b9250cfa0dbde37adedd3e0c1
SHA1 a645966b09261cbf55b3189b374a33204edd4586
SHA512 9fe048a68930d731c460bf3f66b865eabb9eb1beb4ab02016e5cd7fd6913031ac6d5ede0608295ad79bc58d04715a711a92f5036416bc90ca89bff6acf21a431
SSDEEP 3072:1sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:1sQmpcF8BzXfwV
TLSH
T13BE38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxspkica.exe

Path C:\Temp\hfaxspkica.exe
Size 230KB
SHA256 90cfad4b93ea9fa8e42e4115bed01693d5cba3f1eb0d6ea698ff7bf7e57640cc
MD5 0b314a2ea7b485fc38df6926650f0a1b
SHA1 1c4f42a57a1b8cc71e700f11b15f66bf46dd6e5c
SHA512 06d60df86b17c724ae525193ed95cf100c3a98211fd1385850057c22603ef1c3d1b3378650cf7f0852bbb685c6acef9d978ed9e66be0bc605b206a9618007112
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T1AD344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bytomgeywq.exe

Path C:\Temp\i_bytomgeywq.exe
Size 230KB
SHA256 6b96c93dad0d5549127f0ad4cedc8370325d601df636b01575635c010798047b
MD5 09e84b5402abbbe0c98c88199d11b471
SHA1 1afbc44784f1f5bf4420474cdcbc22d7b51df6d0
SHA512 cf2f0db76a254d9c309acb05e8d7f66de7c39e517877b44dd82a3bc780f7c903969b2fe1054c77450735be4617bd3e8f9d8c0f8aae5ec3c688e0f9952329cb3b
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1FF344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fdankfdxvp.exe

Path C:\Temp\i_fdankfdxvp.exe
Size 230KB
SHA256 c0a799991e27146ca30346cbe2745d227ce022af61b9e6f5f291609c3f14fd0d
MD5 fc65938ad8946fbb90c1567d7554a009
SHA1 b69ce2bff0cb19121efd7ca1766e47da95f02cc6
SHA512 10e730a25cdf57b0cc9e6864e8ddb8a0bbbec60cc458af8174b822cde9267be6ae8ced9b3edb1da82db6d8aaa9b015232d341a66704a2b35d7044474c6f39ce6
SSDEEP 3072:LJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:LghLQ0sQmpcF8BzXfwVfAI
TLSH
T11D344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysnifay.exe

Path C:\Temp\i_igaysnifay.exe
Size 230KB
SHA256 71dc916f4df74322cb77a4cbf364e7fd813157af6ce0cfc1e36cd03fa7c7d716
MD5 403d4f28eda34bdcf233f8ecd65aad91
SHA1 28d7031b74635778a2b78910b833045874b7cbf5
SHA512 edbc43fb037769b3ef0953b44b52c646bc155367a7d65f11eac8b3dc102bdce368c11c1cd50f6a974567aeb7e96dd10e9b3d4a9b74b9a184c9cbbe499c62c2b6
SSDEEP 3072:dJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:dghLQ0sQmpcF8BzXfwVfAI
TLSH
T177344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgeuoljgbz.exe

Path C:\Temp\i_jgeuoljgbz.exe
Size 230KB
SHA256 bde2241dc66fa3ddbc2fad1d9eecaf85c6e77919700111ae13a70d225e4a8250
MD5 fc9a4ab2c15bd202ea201dd7e49c1902
SHA1 729dad112464771085570f63f128585d9be1850f
SHA512 326d48c35aaaadec3d36ea576a4ac776cac313e600298c85da7a5217bfab0586d67c8308e77ce144b1344d429952af33602f43dafaccd7b91357cf5f0fb88e6b
SSDEEP 3072:QJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:QghLQ0sQmpcF8BzXfwVfAI
TLSH
T1E2344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omhezmecwu.exe

Path C:\Temp\i_omhezmecwu.exe
Size 230KB
SHA256 dcb187ac726baafd0853c3202bfbd97d310d05db4a0cc37f071037144f0ce568
MD5 27f286529b3e7b82ceef3f67d50dcb54
SHA1 8c1a39e8a850b00dd9931adc911feac2043ed799
SHA512 23ca501c78d5e3d7f63209e2359dfa81be01c67d876df7fbeab184210aa218256619ff89caf7e992a654b98e9cd40b2354ce4be1070f832cc00f7f5f339033d0
SSDEEP 3072:JJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:JghLQ0sQmpcF8BzXfwVfAI
TLSH
T138344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tqnlgdyvqo.exe

Path C:\Temp\i_tqnlgdyvqo.exe
Size 230KB
SHA256 cc43f19213a60086cc17125c48dadc138ddb2075e9ed171dbd8b7d6ed8c373f0
MD5 8ba401e784598f127613ebc288625d56
SHA1 d742df0a7b97a05321a9c04c9d30a6553e0c4363
SHA512 cbf2dbb53a29be6ff2a553f4f0adc7dbd9c9907f4d74d1c2a3bbed3dbdd20b23b0ab986ec9d38435f593f5fe7b6c6718cde8d7ea18dea10e8a628d418c0b189c
SSDEEP 3072:2JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:2ghLQ0sQmpcF8BzXfwVfAI
TLSH
T101344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifdxvpnhfa.sys

Path C:\Temp\ifdxvpnhfa.sys
Size 141KB
SHA256 356eeab6fb8204ac7d41bd659eb0a02813cb704f37df593d3d3a321b2bd93cf7
MD5 fd0010f85d3ae41de49c36d7818f380d
SHA1 46e924376f27ee301c6ab1376f04ff3b47972da1
SHA512 f21222a0251f63454f6ff8661a66857a2d0e88bf3112772b47205ef61faedf341936c8c4a455026bc8bc4502db8910e95dfc0dee664b36da2d2b1f25ba318016
SSDEEP 3072:KsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:KsQmpcF8BzXfwV
TLSH
T156E38D12B2D1D172E8A618BC106AC72186BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysnifay.exe

Path C:\Temp\igaysnifay.exe
Size 230KB
SHA256 49bbe24824587cfdede54e99afb745a7f6e6e16bf9cb108759c4024529d92f89
MD5 d3be79a2e4b80feec3e4d1b57616bedc
SHA1 5b7a4d8fcb24174a418c555916014b1605435ff5
SHA512 42279cf1bea466f842744acc3deb724b7b832c8e6dda5cf6b0bd52e96df96fe339ec74d60befeae7d37c10c86d123636de072235a52b29ad5170bed4ca7fecab
SSDEEP 3072:1JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:1ghLQ0sQmpcF8BzXfwVfAI
TLSH
T158344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgeuoljgbz.exe

Path C:\Temp\jgeuoljgbz.exe
Size 230KB
SHA256 0d74687bcd2c643c2fa00bf85cd6c2f333e7cb6be4a7b43d9be620d3337463f6
MD5 eb26888ed473568ad6c0c1d59b91f03f
SHA1 e8f8e92a636dace3b1983488749252eb35321e3e
SHA512 e9de768968ce53feaab7f6f28da216f16705c000d7a935090cec1cbc07f2ecaff9f1000f3b112e3a92a34685d89d28049d510ad49d1d018d4848217ccabe02c2
SSDEEP 3072:6JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:6ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1B0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omhezmecwu.exe

Path C:\Temp\omhezmecwu.exe
Size 230KB
SHA256 6c533c6c25cdf01bd714fb61c71bee683f507f528bc6375845df63723aa65fdc
MD5 2406d1488c6f01337f5231c26daa019e
SHA1 31cb77e622fae92ed7f57ce3b6148409390322a1
SHA512 7c1b45776d95d338f5973e322665c124f851c9044e097eba6b6bbf61c15606b57a9163d0859341939030f160dec053e8f7e712ce79364b2179bfbee87aa5d5d2
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T1C6344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

romgezwuom.sys

Path C:\Temp\romgezwuom.sys
Size 141KB
SHA256 1d6fd08675a7696d82006e28e3a6563022e75cfd192bf013a6175fda8f7c0f9e
MD5 159d6cecade8791fa4119b00c647890d
SHA1 cd2b5c320fd9c2a6066b175eec6d54e9a553f950
SHA512 a03b15a16f20c4cb84f4c3e8fe788df35659730ff1bd19d147cfa6fd6c8840f84968d47f55ed29694c4a620756d0dec4fdafe10fb73006f7dcc5e0f53c6c2384
SSDEEP 3072:XsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:XsQmpcF8BzXfwV
TLSH
T1F2E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnljdbvtnl.sys

Path C:\Temp\tnljdbvtnl.sys
Size 141KB
SHA256 6ca0f2e421938d2485cd292c68ba73d013ab9c1cc502bd88daf932d6e361a87e
MD5 d0254972da2b67f87c251da32de8fa98
SHA1 13a0301cd60e394142e90f1c4705fb7027f0fbb7
SHA512 a5ece19de444db7cbc666f2295f4a92fbad836fb20a6e8e5c1cb3d29d1690ea80e1e2b5efe72745192f1e25fc840100e18cf7ea93717d6b69976132d026fbf95
SSDEEP 3072:csQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:csQmpcF8BzXfwV
TLSH
T15CE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqnlgdyvqo.exe

Path C:\Temp\tqnlgdyvqo.exe
Size 230KB
SHA256 2b696ce84ee696fe519684ef31287ba975113aaf70cc565ae54b099fb89d3433
MD5 5d5174604a69067e1599595c2b09f7f3
SHA1 3e99d46f10c92ba0cc7b4f86e32d618487725516
SHA512 1b0d517755a3a6e6f05a7b355d36fcb6f910c1df18fb8ee451843c3b136f4ecc53ddbacb7602270c465ba882e7a5ca30168bf06be3654477f061b38bf973b62c
SSDEEP 3072:pJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:pghLQ0sQmpcF8BzXfwVfAI
TLSH
T1BA344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlyvqoig.sys

Path C:\Temp\vtnlyvqoig.sys
Size 141KB
SHA256 b68d370b15b52262068a50b3a1b896797591dd65fece1abeab525605623659db
MD5 318f0a5b4edbede201632422d4938a8e
SHA1 faa30777345ab87dfe8091cff6e165e1578fd5ff
SHA512 1e1d89ad75a1fb7fd19ddb03040ebde75bb5886a95b6b2e220ab30041b6b664f146a04133fe55805a0cb890c2ba683ab9f108d6bff141a8ec86f8f5d785bd38a
SSDEEP 3072:psQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:psQmpcF8BzXfwV
TLSH
T1EDE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e9e31f5fb014f6a7439a4e224bdae6d3d8b22db7c287d9c004b0184cc18e6bf8
MD5 00fe8112e1beaff1b09c3e772b0b70e6
SHA1 1d234f4d61d2fe0153bb63a7a246d37e6fc0aabe
SHA512 aaafc34862d38399e66858477aa9d3d624e9e071371fe2961aac0159845c41dbe1ed0ae62f8b9c52f327e4e4a97abdaf614ae741bcfd2627ec55b1d4f6fb6d74
TLSH
T1EAD08071B7286847D9551931D432CB017A57546365BAD1025160410C6C7BDB553CA155
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 d35918ad094478150749430312816517b2cdf8443da63c67a11779072196b736
MD5 b6aa667a1a8990ba9e2cab6e105c0c59
SHA1 3aabce304aada9c1fcfce3b47469b7fe6dcd7552
SHA512 2b940ef8c658b7962149558b1e81906c6299379d622fc946d7f4da10cf3bacecb0396c8e031454265b8cc11f80630e632d046d23df99ba54fe6fa10a0d341798
TLSH
T1BFE0E5A5C861BC6719FA1B2A60940787E750132B3B50C98B3B3D816C4FB0637469785C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 33d35550de21ca39fedabf2fb1a95a5ac939d938b41573fd21e622965576386a
MD5 9bdde2e51076a9dac12be060754f6eda
SHA1 e4ccc3f656c1cd89989f1b27ff868fb724272a05
SHA512 476c1bf44e9a36dada0255688b5231c9b88cbcfc24b43848e51bf00f6de346cb94be6cc4197fe2060f2b14f4b7bcdd705555d53513c2595140153b7079c8e2f0
TLSH
T14D41B0F383F4856DCA1195F0AA18AE2FCF1D0514432C7D5AC9E4AE1793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ec73de20-3fef-4cdc-95b9-33df7a7dbb25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec73de20-3fef-4cdc-95b9-33df7a7dbb25.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2a03811e43dbe24c80cd682277d2f91e9ddf4d7e48af0a5848979466710aca8
MD5 d7d74f92b5461e9e6d3ad4aeee7180d2
SHA1 d2a105575d022a2129ee204bf41c25604ba3c291
SHA512 0bc30aad9ab08f84e704a077f27673147c911fac7624bae5e5bc3f9355b9a6e0b8237b182147d8e92fa064466ea69983b01c0e2bbca830e2b15e2671a33679e2
SSDEEP 384:sxRh288/fdsEiN/RIuya/5MfW5QsGQKj0:sl78/fbAWi/5KW5QsGQn
TLSH
T1BA72F815AA249D7B8CDBD219FA957F93D3F81173A1905E44AAFCCA0C00E67EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 d6dd0c33a24086d34c147e0503376cba45b252900763a78400590c2d65618bdc
MD5 ac3003c683c3d8547f1c7310ba1cd7f7
SHA1 c5c87701aebbc78939be460dd7b984ed991dabc0
SHA512 55dfd35a4b20bace245ef2003e79c08f65bcc7c36545e7e79d031280818fd8c92ed3ccb417bc50c5a199075be780e70c1d0574a3000288efb587814f5834b3bb
SSDEEP 384:sxRh2q78/fdsPJN/RIuya/5MfW5xsGQKjI:slZ78/f4LWi/5KW5xsGQR
TLSH
T1E772E815AA249D7B9CDBE619FA857F93D3F8117391905E44AAFCCA0C00E67ED211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 d43413c2d8180387bc8e57e3383d7086928afbabccf1e799028e37cb308293a0
MD5 6b0c3e315435519299879c8ed5f8001e
SHA1 dd85366d89efc04c7b4b4ea34534e30732ba363f
SHA512 ffb2746e255d78b30c7641ec39cc0ea94a33978f14e0566d41fa12ecd306bda20938981152f1b1c01b61b52436f82af8cd6601ba8b66503d337525e41d323354
SSDEEP 768:Ob4YZx7pLuL7yTWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJobbDwzrot4No:Ob4YZnE7yTWg1NfwBu1ja+obHwACNo
TLSH
T1A7E2EB3B280CCB7E4F804ADDEC29BD9A6DA801CF5AD8C95447FA850C03C6BEB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 39ac0624e64372509dcd6e7daf91afe22f905f6de7eee300c85ef27c193090e0
MD5 3179441dada38f835c491bb013ef85a0
SHA1 251c8b59b600087aafc4a41a129fceb5d4ad1406
SHA512 b81420028b82958583cb40ecd1699320f5b1900b42cd975717783808cf7e450888be9b792c79b8ac3f1e44524b8c7f57d0ad85e4660b755b8f928bb7d6b2ccc5
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9Jb7:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRk
TLSH
T14FB25D11713F42803C7EB50C81B8981E92C2B4A37519E52F7BAC46A65F67E039DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a29878e41c7d0ec3a100a9c8da19d67efa9364e3c2f7f9df6b5676aa65a2dff4
MD5 a6377e32ee7732623036fe3ed50e97b7
SHA1 79e5417ee39ddf5d8fdefb8a95f8ae348e631672
SHA512 7183fdd1a968fec512356fe5fafccda248577d9ddd14b85bc80869abc91177d898f3be3a532cb24dd1adb698c0a1b3af752530f0e93189217a527e7acaf0499e
SSDEEP 768:IF1j+9SXgwgUud+GzDcsdHQWNFTAV5Xjq:l9SXVuBciNFTkzq
TLSH
T1C6C25C31E865DEB7ECE64ED9B34A7A86EEE011A384CD99D4D6D94D4C00C72ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ac017c7bdf570b6f07e5dc9c2d69a7979aca97244565807d327df76ff83cf4ce
MD5 7be4407eeb2b0b178dabdbab60ed0f70
SHA1 5c77e09c9d0593e62859e294667127e4f08899c4
SHA512 9aa8a0b19a0628b2e6269ebac51c75403aacdecf31ef8728b8e8249239558839e31969e7d09f535c1ebaef188ab5bf88d6d3709dee0fee9fde5b323b7db22535
SSDEEP 384:n2iF1tNn/s3n9Sn8NgV8TUNTUlIRiPvuTu1ReffoGGcuDgWcjYxIuLsFO6AV5XMJ:dF1j+9SXVwgUuQ6GzDcsXsFTAV5Xjq
TLSH
T1A0C24B32E865DABBDDE64FD9B34A7A46EEE0125381D859D8DAD84D0D00C72ED0307C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 aba8b74e32893b7b754c99e2ae415983e9a7a8cc52a944f3d59707ce871ce1ac
MD5 36e3adfe8ef2180d90ad2e78a99d59fe
SHA1 3c44dd06d82bc6ea8b6c4c955b60038ba089f7ff
SHA512 17fffd1a003795d5c26e1dea6bcf4fb6b975833c4ac91b2abe314afb138357e9846d3ccb393673fb560360e4b871b0976d3d872afc52f4b7b7fbf86fa502134d
SSDEEP 384:n+iFiZcIr8NLg8TUNTUlIRDPvuTd6G2effoGGcuDgWcjYxIWbrcaWNMsRnlYcb8v:VFQrQgwgZucGlGzDcsdHdWNhn2ca
TLSH
T1E1E2C4F198E78973E8AE4B87A77D2D4299FCD163B4889984B7C44D4CCC861BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cdeb11cfd12942fe905f17e48b8ba5b6e9c51f756c23ec2fefc4c5567275b49e
MD5 44604a0b73261a34bd2449b2bcdd2be0
SHA1 33f789100fae3de900dfdf19b5067c498b141721
SHA512 8776baa175c8c85a0ba8b96ec0af75d5326598fc3c32945850251347f64fd872653caf2280c2e6cd71c632ac5f6d1d08ffba7eccfb007f5e316b60e2900bd190
SSDEEP 768:kF1j+9SQgwgUu1+GzDcsdHQWNFTAV5Xjq:p9SQVu5ciNFTkzq
TLSH
T115C25B31E865CEB7ECE64ED9B34A7A86EEE011A384CD99D4D6D94D4C00C72ED070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 a6b35f10cf33752f87c8c1b72e214ab85c369633cdfea797e6b2e33d9edf8c80
MD5 db299df814cd23241e82865bcfcb9939
SHA1 7d147002bc51f5a236fca91cf8119fcf7e390e9f
SHA512 931813d23072fdf2ff8e20f2a30824596c4c658df5d258826248d775488e7266e511ff18de6aab54556a0489cf562e01228add5317a5e1926e390dafb089d761
SSDEEP 384:ntiFiZcI58NLg8TUNTUlIRDPvuTdYG2effoGGcuDgWcjYxIWbrFKWNMsRnlYcb8v:kFQ5QgwgZuyGlGzDcsdHwWNhn2ca
TLSH
T146D25C32DC64DEB7ECEB5E96B6497A86DEE0116384CCD9C4D6D89D4C00876EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d32aab3d9c5eee5845b0b025b7b434df5b9ef280659f210fcb4a76f6d5db6f7c
MD5 26312125e7964b203bb8c6020807d806
SHA1 6e590756c1c11feb5772849aed9ef638b354d0ec
SHA512 a53ab4f2ddaaa229378e0bd6598b4863573cc23c282e77aabe2681e65ab70619173fc2eaf86177517903f583be01039f69ed02aa8a211b620c4f8347b07592b4
SSDEEP 384:n6iFiZcI58NLg8TUNTUlIRDPvuTdYG2effoGGcuDgWcjYxIWbrFKWNMsRnlYcb8v:xFQ5QgwgZuyGlGzDcsdHwWNhn2ca
TLSH
T14AD25C32DC64DAB7ECEB5E96B6497A86DEE0116384CCDDC4D6D89D4C00876EE070BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 88b3706ce4342b3aae7d2cae689c67c2cc08cc1a82142aa2d20765799b16782c
MD5 1cf92343660e419985e1ee9a56e1b79c
SHA1 105e58795c48de5277ec4c44cbb1ac8248156763
SHA512 0a854f9cbc87a8e3afc56c0a64009556539cf225c40fcd54fff94972acc71aa5f43478999b3a8fba3dbb98506752e8f292527efe7827ec2f4f4e3f232ed3ff50
TLSH
T1CE3121E08C391AC1D4BE0DAFB44B25FC94E89326F5D034386859ED68967D65E354087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 004caaa21520df5124231909d0fcb3ce34b8499f4a23c1639b90c5aae94a17f5
MD5 9163faae5844d6e074a89c9d923d519b
SHA1 46c1227e4e137de9883d55e07f11326ad7f7bd98
SHA512 c0c6aa4a7b4abc7fb7fb64051fbcbd46a5462fd373d0cc57d70c41fa2a88b84f3356852aed80ad87cddb6cfc324d8314df79d41a97bbacd924df93263d1316e6
TLSH
T1973141E08C3D1AD2D4FE0D6FB44B25FC94E89322F89434386858E968963D61E354083F
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-547-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1004-554-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1080-543-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1080-548-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1152-594-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1964-650-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3100-156-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-553-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4160-574-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4220-183-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4276-518-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4884-514-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5008-510-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5572-282-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5576-599-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5640-504-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5848-590-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-604-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5892-630-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6248-203-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/6432-629-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/7100-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download