systex | 8565173b5ea03c50cb29a689f2f4b87933e1dd319d1cc08a3fa379319501d466

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
Size 230KB
Sample260818-wlj5hsxeja
SHA256 8565173b5ea03c50cb29a689f2f4b87933e1dd319d1cc08a3fa379319501d466
MD5 4eb1ee5728a89fc9df6f67f6ea8f2657
SHA1 18a00672bf7837b126c8722513c5ff923e1a4690
SHA512 8a22c10f9969edb2b956ca043d13ab5bea41ba59297ee30cb3db5fe1dab25fddda671b826e455ca3b5b30074aecaa0d7285c0e9a090931b7f665e0e4278c1069
SSDEEP 3072:YJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:YghLQ0sQmpcF8BzXfwVfAI
TLSH
T13A344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba8102
http://xytets.com:2345/ll/out.txt
http://xytets.com:2345/t.asp?os=home8102

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
2236	CP.exe
2660	aysnifavpk.exe
4280	CP.exe
2892	CP.exe
1588	i_aysnifavpk.exe
5840	kicaxspnhf.sys
5720	CP.exe
5888	fzxvpnkica.exe
4704	CP.exe
3028	CP.exe
3272	i_fzxvpnkica.exe
5016	cxupnhfzxr.sys
4184	CP.exe
2824	urmhezxrpj.exe
4232	CP.exe
1748	CP.exe
2120	i_urmhezxrpj.exe
1464	urpjhfzxro.sys
2636	CP.exe
2064	mjhbztromg.exe
5884	CP.exe
2768	CP.exe
2324	i_mjhbztromg.exe
2528	bzwuojgezw.sys
3612	CP.exe
1828	rojhbwuomg.exe
3572	CP.exe
4132	CP.exe
3340	i_rojhbwuomg.exe
5816	ojgbztrljg.sys
1232	CP.exe
1356	ljgbzwqolj.exe
1136	CP.exe
124	CP.exe
5504	i_ljgbzwqolj.exe
4940	dbywqolgay.sys
1260	CP.exe
5064	idaytqoigb.exe
5300	CP.exe
4340	CP.exe
4116	i_idaytqoigb.exe
5836	lidbvtnlfd.sys
4336	CP.exe
5336	vqnigavsnl.exe
6096	CP.exe
4276	CP.exe
4368	i_vqnigavsnl.exe
5032	sqkidavsqk.sys
4112	CP.exe
5232	ifdxvpnica.exe
236	CP.exe
2028	CP.exe
616	i_ifdxvpnica.exe
1296	axspkifaxv.sys
3012	CP.exe
3820	xspkiczxsp.exe
4512	CP.exe
1912	CP.exe
5284	i_xspkiczxsp.exe
1500	zxrpjhczxu.sys
1932	CP.exe
5032	xuspkhczus.exe
4564	CP.exe
5504	CP.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_2002693885\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_818909817\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_818909817\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_770795387\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_2002693885\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_818909817\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_818909817\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1569888755\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping704_1569888755\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkiczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	romhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmhfzwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojhbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbzwqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbzwqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysnifavpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vqnigavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_romhbztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xromgebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxvpnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vqnigavsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xuspkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xuspkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdxvpnica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkiczxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqolgdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmhfzwupj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbztromg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysnifavpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idaytqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xromgebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojhbwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idaytqoigb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3960	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2764	ipconfig.exe
3348	ipconfig.exe
5840	ipconfig.exe
3492	ipconfig.exe
3720	ipconfig.exe
2676	ipconfig.exe
5500	ipconfig.exe
4548	ipconfig.exe
1144	ipconfig.exe
2484	ipconfig.exe
4072	ipconfig.exe
3828	ipconfig.exe
2492	ipconfig.exe
1528	ipconfig.exe
3068	ipconfig.exe
4692	ipconfig.exe
5116	ipconfig.exe
2544	ipconfig.exe
5012	ipconfig.exe
4352	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315496403807893"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{3165D2E7-F12A-49AD-B4CB-8F4647A5948B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe
2660	aysnifavpk.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe
704	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	i_aysnifavpk.exe
Token: SeDebugPrivilege	3272	i_fzxvpnkica.exe
Token: SeDebugPrivilege	2120	i_urmhezxrpj.exe
Token: SeDebugPrivilege	2324	i_mjhbztromg.exe
Token: SeDebugPrivilege	3340	i_rojhbwuomg.exe
Token: SeDebugPrivilege	5504	i_ljgbzwqolj.exe
Token: SeDebugPrivilege	4116	i_idaytqoigb.exe
Token: SeDebugPrivilege	4368	i_vqnigavsnl.exe
Token: SeDebugPrivilege	616	i_ifdxvpnica.exe
Token: SeDebugPrivilege	5284	i_xspkiczxsp.exe
Token: SeDebugPrivilege	2452	i_xuspkhczus.exe
Token: SeDebugPrivilege	4420	i_romhbztrmj.exe
Token: SeDebugPrivilege	5020	i_xromgebzwr.exe
Token: SeDebugPrivilege	2676	i_ojhbztrlje.exe
Token: SeDebugPrivilege	1500	i_dbytqolgdb.exe
Token: SeDebugPrivilege	1984	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	1244	i_qnlfdxvqni.exe
Token: SeDebugPrivilege	1800	i_axvpnicaxv.exe
Token: SeDebugPrivilege	4176	i_uspkhfzxus.exe
Token: SeDebugPrivilege	1752	i_usmhfzwupj.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 1928	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	89
PID 4768 wrote to memory of 5104	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	90
PID 5104 wrote to memory of 3164	5104	iexplore.exe	91
PID 1928 wrote to memory of 704	1928	iexplore.exe	92
PID 704 wrote to memory of 4372	704	msedge.exe	93
PID 704 wrote to memory of 3960	704	msedge.exe	94
PID 704 wrote to memory of 4820	704	msedge.exe	95
PID 704 wrote to memory of 4820	704	msedge.exe	95
PID 704 wrote to memory of 4820	704	msedge.exe	95
PID 704 wrote to memory of 3776	704	msedge.exe	96
PID 704 wrote to memory of 3776	704	msedge.exe	96
PID 704 wrote to memory of 4120	704	msedge.exe	98
PID 704 wrote to memory of 2968	704	msedge.exe	99
PID 704 wrote to memory of 4120	704	msedge.exe	98
PID 704 wrote to memory of 4120	704	msedge.exe	98
PID 704 wrote to memory of 2968	704	msedge.exe	99
PID 704 wrote to memory of 2968	704	msedge.exe	99
PID 704 wrote to memory of 1820	704	msedge.exe	100
PID 704 wrote to memory of 1820	704	msedge.exe	100
PID 704 wrote to memory of 1820	704	msedge.exe	100
PID 704 wrote to memory of 5592	704	msedge.exe	101
PID 704 wrote to memory of 5544	704	msedge.exe	102
PID 704 wrote to memory of 5592	704	msedge.exe	101
PID 704 wrote to memory of 5592	704	msedge.exe	101
PID 704 wrote to memory of 5544	704	msedge.exe	102
PID 704 wrote to memory of 5544	704	msedge.exe	102
PID 704 wrote to memory of 5064	704	msedge.exe	103
PID 704 wrote to memory of 5064	704	msedge.exe	103
PID 704 wrote to memory of 1988	704	msedge.exe	105
PID 704 wrote to memory of 952	704	msedge.exe	106
PID 704 wrote to memory of 1988	704	msedge.exe	105
PID 704 wrote to memory of 952	704	msedge.exe	106
PID 4768 wrote to memory of 2236	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	107
PID 704 wrote to memory of 3000	704	msedge.exe	110
PID 2660 wrote to memory of 4280	2660	aysnifavpk.exe	112
PID 704 wrote to memory of 5960	704	msedge.exe	115
PID 704 wrote to memory of 5960	704	msedge.exe	115
PID 704 wrote to memory of 1300	704	msedge.exe	118
PID 704 wrote to memory of 1300	704	msedge.exe	118
PID 4768 wrote to memory of 2892	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	119
PID 4768 wrote to memory of 5720	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	123
PID 5888 wrote to memory of 4704	5888	fzxvpnkica.exe	125
PID 4768 wrote to memory of 3028	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	128
PID 4768 wrote to memory of 4184	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	132
PID 2824 wrote to memory of 4232	2824	urmhezxrpj.exe	134
PID 4768 wrote to memory of 1748	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	137
PID 4768 wrote to memory of 2636	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	141
PID 2064 wrote to memory of 5884	2064	mjhbztromg.exe	143
PID 4768 wrote to memory of 2768	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	146
PID 704 wrote to memory of 3956	704	msedge.exe	149
PID 704 wrote to memory of 3196	704	msedge.exe	150
PID 704 wrote to memory of 2804	704	msedge.exe	151
PID 4768 wrote to memory of 3612	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	154
PID 1828 wrote to memory of 3572	1828	rojhbwuomg.exe	156
PID 4768 wrote to memory of 4132	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	159
PID 4768 wrote to memory of 1232	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	163
PID 1356 wrote to memory of 1136	1356	ljgbzwqolj.exe	165
PID 4768 wrote to memory of 124	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	168
PID 4768 wrote to memory of 1260	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	172
PID 5064 wrote to memory of 5300	5064	idaytqoigb.exe	174
PID 4768 wrote to memory of 4340	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	177
PID 4768 wrote to memory of 4336	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	181
PID 5336 wrote to memory of 6096	5336	vqnigavsnl.exe	183
PID 4768 wrote to memory of 4276	4768	2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe	186

C:\Users\Admin\AppData\Local\Temp\2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_4eb1ee5728a89fc9df6f67f6ea8f2657_elex_redline-stealer_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home8102
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home8102"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ff9c3c3c188,0x7ff9c3c3c194,0x7ff9c3c3c1a0
      4⤵
      PID:4372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2096,i,3044933034613331496,218407665375852785,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
      4⤵
      System Time Discovery
      PID:3960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,14524788700447830984,12075660854988018022,262144 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2716,i,17442744621160002448,10263001495403172670,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:13
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,9280417128690440901,10328088181018907597,2097152 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
      4⤵
      PID:4120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,1030593681326481055,14776152424222453815,2097152 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:1
      4⤵
      PID:2968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,10757317665105291187,15465017363379276317,2097152 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:1820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,16627601441448505090,14382725101447765694,2097152 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
      4⤵
      PID:5592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4468,i,8550895282516377202,18224337837868087224,2097152 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      PID:5544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,17342845866008129598,7050546554677853764,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,12683540102937304596,13425712013758301928,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:1988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,2567780953188729412,8014958254486363355,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,9842995109218376741,9075026175626546161,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,9842995109218376741,9075026175626546161,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,6155397507945550327,2593422547966253499,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:14
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,12035808065870619149,6226248278900804234,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
      4⤵
      PID:1300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,12166544134730707505,9915915119080139893,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
      4⤵
      PID:3956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4788,i,8259244375716846558,14106742721855678230,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:14
      4⤵
      PID:3196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,15461521187420869670,8559152425799160118,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
      4⤵
      PID:2804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,9364387172620248098,3107573059525048641,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:3624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,4672684066382892985,12461194815820116961,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,11210631912426941288,12473037802445396321,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,13952465865725016199,2650876518584278140,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6400,i,8762068511796323585,5289869289436903355,262144 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:10
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,8786015686068827651,8216333243355250901,524288 --field-trial-handle=2576,i,375994596804252719,11618161235800860346,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:3444
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/ll/out.txt
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/ll/out.txt"
    3⤵
    PID:3164
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\aysnifavpk.exe ups_run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2236
- - C:\Temp\aysnifavpk.exe
    C:\Temp\aysnifavpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2660
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4280
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4548
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_aysnifavpk.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2892
- - C:\Temp\i_aysnifavpk.exe
    C:\Temp\i_aysnifavpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\fzxvpnkica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:5720
- - C:\Temp\fzxvpnkica.exe
    C:\Temp\fzxvpnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5888
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4704
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1528
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_fzxvpnkica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:3028
- - C:\Temp\i_fzxvpnkica.exe
    C:\Temp\i_fzxvpnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\urmhezxrpj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4184
- - C:\Temp\urmhezxrpj.exe
    C:\Temp\urmhezxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4232
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2764
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_urmhezxrpj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1748
- - C:\Temp\i_urmhezxrpj.exe
    C:\Temp\i_urmhezxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2120
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\mjhbztromg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:2636
- - C:\Temp\mjhbztromg.exe
    C:\Temp\mjhbztromg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5884
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3348
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_mjhbztromg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2768
- - C:\Temp\i_mjhbztromg.exe
    C:\Temp\i_mjhbztromg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\rojhbwuomg.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3612
- - C:\Temp\rojhbwuomg.exe
    C:\Temp\rojhbwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:3572
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:1144
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_rojhbwuomg.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4132
- - C:\Temp\i_rojhbwuomg.exe
    C:\Temp\i_rojhbwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3340
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ljgbzwqolj.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1232
- - C:\Temp\ljgbzwqolj.exe
    C:\Temp\ljgbzwqolj.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:1136
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2544
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ljgbzwqolj.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:124
- - C:\Temp\i_ljgbzwqolj.exe
    C:\Temp\i_ljgbzwqolj.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5504
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\idaytqoigb.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1260
- - C:\Temp\idaytqoigb.exe
    C:\Temp\idaytqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:5300
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5840
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_idaytqoigb.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4340
- - C:\Temp\i_idaytqoigb.exe
    C:\Temp\i_idaytqoigb.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vqnigavsnl.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4336
- - C:\Temp\vqnigavsnl.exe
    C:\Temp\vqnigavsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5336
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:6096
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3068
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vqnigavsnl.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:4276
- - C:\Temp\i_vqnigavsnl.exe
    C:\Temp\i_vqnigavsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4368
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ifdxvpnica.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:4112
- - C:\Temp\ifdxvpnica.exe
    C:\Temp\ifdxvpnica.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5232
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:236
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ifdxvpnica.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:2028
- - C:\Temp\i_ifdxvpnica.exe
    C:\Temp\i_ifdxvpnica.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:616
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xspkiczxsp.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:3012
- - C:\Temp\xspkiczxsp.exe
    C:\Temp\xspkiczxsp.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3820
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4512
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2484
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xspkiczxsp.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:1912
- - C:\Temp\i_xspkiczxsp.exe
    C:\Temp\i_xspkiczxsp.exe ups_ins
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5284
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xuspkhczus.exe ups_run
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Temp\xuspkhczus.exe
    C:\Temp\xuspkhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5032
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      Executes dropped EXE
      PID:4564
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3720
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xuspkhczus.exe ups_ins
  2⤵
  - Executes dropped EXE
  PID:5504
- - C:\Temp\i_xuspkhczus.exe
    C:\Temp\i_xuspkhczus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\romhbztrmj.exe ups_run
  2⤵
  PID:1076
- - C:\Temp\romhbztrmj.exe
    C:\Temp\romhbztrmj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4848
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5168
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_romhbztrmj.exe ups_ins
  2⤵
  PID:2056
- - C:\Temp\i_romhbztrmj.exe
    C:\Temp\i_romhbztrmj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4420
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\xromgebzwr.exe ups_run
  2⤵
  PID:5200
- - C:\Temp\xromgebzwr.exe
    C:\Temp\xromgebzwr.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:5360
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4072
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_xromgebzwr.exe ups_ins
  2⤵
  PID:5396
- - C:\Temp\i_xromgebzwr.exe
    C:\Temp\i_xromgebzwr.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\ojhbztrlje.exe ups_run
  2⤵
  PID:4068
- - C:\Temp\ojhbztrlje.exe
    C:\Temp\ojhbztrlje.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5932
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:632
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:3828
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_ojhbztrlje.exe ups_ins
  2⤵
  PID:4116
- - C:\Temp\i_ojhbztrlje.exe
    C:\Temp\i_ojhbztrlje.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2676
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\dbytqolgdb.exe ups_run
  2⤵
  PID:1528
- - C:\Temp\dbytqolgdb.exe
    C:\Temp\dbytqolgdb.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1016
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2784
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4692
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_dbytqolgdb.exe ups_ins
  2⤵
  PID:4924
- - C:\Temp\i_dbytqolgdb.exe
    C:\Temp\i_dbytqolgdb.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\vtnlfdyvqo.exe ups_run
  2⤵
  PID:1108
- - C:\Temp\vtnlfdyvqo.exe
    C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2512
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:3312
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5500
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
  2⤵
  PID:4760
- - C:\Temp\i_vtnlfdyvqo.exe
    C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\qnlfdxvqni.exe ups_run
  2⤵
  PID:5740
- - C:\Temp\qnlfdxvqni.exe
    C:\Temp\qnlfdxvqni.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:800
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6120
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5116
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_qnlfdxvqni.exe ups_ins
  2⤵
  PID:3000
- - C:\Temp\i_qnlfdxvqni.exe
    C:\Temp\i_qnlfdxvqni.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\axvpnicaxv.exe ups_run
  2⤵
  PID:4136
- - C:\Temp\axvpnicaxv.exe
    C:\Temp\axvpnicaxv.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2868
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:4408
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:2492
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_axvpnicaxv.exe ups_ins
  2⤵
  PID:6040
- - C:\Temp\i_axvpnicaxv.exe
    C:\Temp\i_axvpnicaxv.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\uspkhfzxus.exe ups_run
  2⤵
  PID:5968
- - C:\Temp\uspkhfzxus.exe
    C:\Temp\uspkhfzxus.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3828
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:6132
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:5012
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_uspkhfzxus.exe ups_ins
  2⤵
  PID:1408
- - C:\Temp\i_uspkhfzxus.exe
    C:\Temp\i_uspkhfzxus.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\usmhfzwupj.exe ups_run
  2⤵
  PID:4668
- - C:\Temp\usmhfzwupj.exe
    C:\Temp\usmhfzwupj.exe ups_run
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4692
  - - C:\temp\CP.exe
      C:\temp\CP.exe C:\windows\system32\ipconfig.exe /release
      4⤵
      PID:2788
    - - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        5⤵
        Gathers network information
        
        PID:4352
- C:\temp\CP.exe
  C:\temp\CP.exe C:\Temp\i_usmhfzwupj.exe ups_ins
  2⤵
  PID:5692
- - C:\Temp\i_usmhfzwupj.exe
    C:\Temp\i_usmhfzwupj.exe ups_ins
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1752

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2308

C:\Temp\kicaxspnhf.sys
C:\Temp\kicaxspnhf.sys
1⤵
- Executes dropped EXE
PID:5840

C:\Temp\cxupnhfzxr.sys
C:\Temp\cxupnhfzxr.sys
1⤵
- Executes dropped EXE
PID:5016

C:\Temp\urpjhfzxro.sys
C:\Temp\urpjhfzxro.sys
1⤵
- Executes dropped EXE
PID:1464

C:\Temp\bzwuojgezw.sys
C:\Temp\bzwuojgezw.sys
1⤵
- Executes dropped EXE
PID:2528

C:\Temp\ojgbztrljg.sys
C:\Temp\ojgbztrljg.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\dbywqolgay.sys
C:\Temp\dbywqolgay.sys
1⤵
- Executes dropped EXE
PID:4940

C:\Temp\lidbvtnlfd.sys
C:\Temp\lidbvtnlfd.sys
1⤵
- Executes dropped EXE
PID:5836

C:\Temp\sqkidavsqk.sys
C:\Temp\sqkidavsqk.sys
1⤵
- Executes dropped EXE
PID:5032

C:\Temp\axspkifaxv.sys
C:\Temp\axspkifaxv.sys
1⤵
- Executes dropped EXE
PID:1296

C:\Temp\zxrpjhczxu.sys
C:\Temp\zxrpjhczxu.sys
1⤵
- Executes dropped EXE
PID:1500

C:\Temp\czupmkecwu.sys
C:\Temp\czupmkecwu.sys
1⤵
PID:5356

C:\Temp\wuomgecztr.sys
C:\Temp\wuomgecztr.sys
1⤵
PID:2904

C:\Temp\omjebwuolj.sys
C:\Temp\omjebwuolj.sys
1⤵
PID:3740

C:\Temp\bytqoigebw.sys
C:\Temp\bytqoigebw.sys
1⤵
PID:4108

C:\Temp\igaytqlidb.sys
C:\Temp\igaytqlidb.sys
1⤵
PID:4076

C:\Temp\xvqnigayvt.sys
C:\Temp\xvqnigayvt.sys
1⤵
PID:2424

C:\Temp\causnkfdxv.sys
C:\Temp\causnkfdxv.sys
1⤵
PID:2880

C:\Temp\xvpnhfzxup.sys
C:\Temp\xvpnhfzxup.sys
1⤵
PID:5016

C:\Temp\zuspnhfzur.sys
C:\Temp\zuspnhfzur.sys
1⤵
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CP.exe

Path C:\Temp\CP.exe
Size 4KB
SHA256 50b00a0816849edcc24eec9cfdd5443dbf33409ae05ee84202bfbcd00094485a
MD5 00d08d31f0ca0be125aa8ddb1c068a26
SHA1 c5e5cf5c0cb8a03c9146f5cd923cd620417eb75e
SHA512 6b5fe5899aa47239b53bc8dbd5ce6d9616ed2b0480fe55c34c27d6956f792a9c0796fe0dcd8949395284c3f5c59563efe333cc3e4e449fa9e9b7c219c88242a3
SSDEEP 48:i+HOtYCgTU534sKXG5BrBfdQSBe2nLB8JsU:fOWS3tpJ5un
TLSH
T11B912E2301A68472C8BD8FF711875AC9FABB51349322210C4BF70ED6EB70AB7446CB08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aysnifavpk.exe

Path C:\Temp\aysnifavpk.exe
Size 230KB
SHA256 2af9e136a523c7cf6f4a93039b0b5d16a56a0d455c781eec0fd22cc68fadcaf4
MD5 8d516b367e240b3261bbb0aeb3315cd1
SHA1 dc1922db4fcac48f18cbe65a1d428eb2f78157ba
SHA512 0dfe803ad4b310f337f6c67b6a92930894ed2025ece7764b032c5a75d8b76d38d206e5ace45860b9553ab3e898133aed07ef0592fa289934ba5b7903dfd59d2c
SSDEEP 3072:gJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:gghLQ0sQmpcF8BzXfwVfAI
TLSH
T110344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bzwuojgezw.sys

Path C:\Temp\bzwuojgezw.sys
Size 141KB
SHA256 7027a6d6b2d534b2ccb5f352d6c4688730b666e04580a02fc93f05c20eace898
MD5 967ddbfc404ab18b86d4089b51bf6f6e
SHA1 6372192a0517aaf235b39f4e8377e9a40d6a2d19
SHA512 55065cb9b14e08dd35aa29006fda15e012cac21f0b6433bdbe3fa6e35b2d6e6351bfc80dc117e882b3c831d303e9a29f436ebf25fa5a30a9bb252fed66bef309
SSDEEP 3072:qsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:qsQmpcF8BzXfwV
TLSH
T15CE38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxupnhfzxr.sys

Path C:\Temp\cxupnhfzxr.sys
Size 141KB
SHA256 4edc5698cf7d3e671084da89e0261f6c48d5dddf05e2d64b584b6633f3a2fec4
MD5 1aaa129fbef84ccd31e82d45b7d0d6b8
SHA1 1b56304acb4f9f1f3bcf40243027f9a7f2b45f56
SHA512 a6d185da172a8a27c26da7a09ef95ce149232dc1a01b4f43673bc8b5ad83d86772b0baa184583ad1e79ade5d3df43c644853a4ac3fddbdcc832d7123b7e418ac
SSDEEP 3072:TsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:TsQmpcF8BzXfwV
TLSH
T16DE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fzxvpnkica.exe

Path C:\Temp\fzxvpnkica.exe
Size 230KB
SHA256 8bbf571cd4886b83513e715218d480f74b83e94e8fcf132834d99141bfc3b601
MD5 4f64d0ccd6f134540e52939f9dc117db
SHA1 d8bcb3d9881091d00aa89073f4774def360ea6e1
SHA512 ca1a480c8c88c656311690592768947bab4e9e755bdd23260a60f9a4ccc627e6a252b6bfabb938bf79b5e2363e6539e192a36100d66e38c64681253e38ea4537
SSDEEP 3072:AJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:AghLQ0sQmpcF8BzXfwVfAI
TLSH
T11F344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysnifavpk.exe

Path C:\Temp\i_aysnifavpk.exe
Size 230KB
SHA256 d20be3c756c29ed3918428f95b40041b0b21401cf3608ffe9946baff247148ba
MD5 f8cb3ab8151c196657dbd035c3a29c4e
SHA1 e97eb7c79f99e29e518cc5ade41558f4327e8b0d
SHA512 370b47bafee23daf6b8a1b9d2f095318ed062453c7ab5edb680a08304b21bbf06891cc5cb6c5ca4711c247877e0aa28fc6de1d96c153f04fa2f67d428ec0bb4f
SSDEEP 3072:5JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:5ghLQ0sQmpcF8BzXfwVfAI
TLSH
T1A0344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fzxvpnkica.exe

Path C:\Temp\i_fzxvpnkica.exe
Size 230KB
SHA256 6b0720c7e1f61911ac4e8ed672ad88678edf8320d938a95ead6612b5ade90f35
MD5 53ae68e051469f452a4decb6b47b47d8
SHA1 a173241c35e4cb27f7ef7ec38c19ffe7d3a9a0f7
SHA512 304faf8025452e1765b1ba1c1c01f4ed25af8818fc74d1c826589cb1aaa80e202e7ea72a2a705a2c4c27ea6cbf8bceba9d2de7328c41bed7858ad5c302a16166
SSDEEP 3072:KJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:KghLQ0sQmpcF8BzXfwVfAI
TLSH
T103344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljgbzwqolj.exe

Path C:\Temp\i_ljgbzwqolj.exe
Size 230KB
SHA256 beb5831f8e216b0441cd63295fa72ffbf5232688194979ab56289757192d7388
MD5 87bc74e3bf25b500267c572b681cabd5
SHA1 ae75f901d380d59210e55c1a5226f63db26b9046
SHA512 4bc00320f0017d13b71e61de55fb80b4b52b034e6ba3d03e1e3ba1b0fe3a926b7adcf73a338151384301ad346b891e0becd854f1c683a498bb8449682f5d1e55
SSDEEP 3072:vJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:vghLQ0sQmpcF8BzXfwVfAI
TLSH
T123344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjhbztromg.exe

Path C:\Temp\i_mjhbztromg.exe
Size 230KB
SHA256 f225c2cfe0a6d2bc87e2041e2d2b6d434c68ec72856edb6024c40d00bdcaea88
MD5 dfad09b5884bf973c996330d5318efd8
SHA1 70da56aa0124f15f873f51d51912711d272e8e80
SHA512 8a5df5112840e087b9e01d0c50adf5d240531158b409dbad412b8476ca605392d19a626ab677debe9f2386ac573e227a907dda136312acbdfd62b65148793b16
SSDEEP 3072:wJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:wghLQ0sQmpcF8BzXfwVfAI
TLSH
T10E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rojhbwuomg.exe

Path C:\Temp\i_rojhbwuomg.exe
Size 230KB
SHA256 f4852c558ba17bfffe4e532ffd47467d901193b04c5b141c18d732c13b06056a
MD5 de1fdd17b4da3eded2b9d6d0eb7219f2
SHA1 f3cd99020db210edbfdf97311e167fdce87e64b7
SHA512 60f2158bca0fedcb10b7349a458b80887d4254890557def1ae5f87cd6e24cc23d5e601e66c3e2d605affc735b91d4b53283071199e4f91ba10b12c18ba0058c5
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T13C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_urmhezxrpj.exe

Path C:\Temp\i_urmhezxrpj.exe
Size 230KB
SHA256 6ec3a4e88c383ab25a5d06713994417d30156f08edcc1522f7eb93509fb83225
MD5 0feaff7a945c93b7380aa72706a7c827
SHA1 83492efb9d35f5555dd418aade0601c6c1a7fcea
SHA512 e7e63c65d0f37af3cc9c239764ccd7a42d97bd8b0baa919dab1aac7816acaaf0cb10bcecd80db1acaa38efae1b8fce7c6b9a02c5bd20b6aa0ec69babe178f74c
SSDEEP 3072:BJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:BghLQ0sQmpcF8BzXfwVfAI
TLSH
T14E344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaxspnhf.sys

Path C:\Temp\kicaxspnhf.sys
Size 141KB
SHA256 f780b5629af3ebaa9b9bee0f90ece30b1dfec05ed15150e0b888894164bfbe91
MD5 26d3736cc806819e36dc22b30e102cb6
SHA1 28abb9d6d6ad3bec3f42efdc339dd89a43fe9983
SHA512 b0cc901324e4c37b6cef58387e3f5e1e3689f9db2e5d665a2412468d4a450821b69e77055f3ff621be8e7c29290a68eb9b52959d49883e40bf36ee952e78bdb8
SSDEEP 3072:2sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:2sQmpcF8BzXfwV
TLSH
T159E38D12B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbzwqolj.exe

Path C:\Temp\ljgbzwqolj.exe
Size 230KB
SHA256 dd65d1169bad138d7bc122c467a379be42edbe5c67347f8555889f66b1680777
MD5 e3fd9fbb57ff69a78364d821bc2d8747
SHA1 7429b6bd07b5b0fcb4bd2f45ce7b414962921eaa
SHA512 c990d11f31d8c3d71e22930bf70d2f768360c76b2cf14fea3f8276f112af1dc4eefc407cabb02616e73b414a2c6e9ed9b36883616a49e85b7e630f096b23113d
SSDEEP 3072:xJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:xghLQ0sQmpcF8BzXfwVfAI
TLSH
T130344A1272808071E7550B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjhbztromg.exe

Path C:\Temp\mjhbztromg.exe
Size 230KB
SHA256 afe1cc704f1ff8d79abbb4b8add9938c914e73688e861be3ae0a305414e971ce
MD5 6c09a618cfb55d2a8dddeccd65e28414
SHA1 4a94686629f8e7c98f98e75d4f639094951a62dd
SHA512 d2a68345b231596c96778c55566340fd8f0e0a5ee7736adf208ecc34a62db88563738701a9f2589a6772f95a0cd2a2b5107052c6d606d01358729f21b51d2a0f
SSDEEP 3072:+JWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:+ghLQ0sQmpcF8BzXfwVfAI
TLSH
T101344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgbztrljg.sys

Path C:\Temp\ojgbztrljg.sys
Size 141KB
SHA256 e04f358e9b6afcf6703b4b581bb28fa570d34bbb222815d1e6872337117ebbf0
MD5 d4932022477f9a7c719825331417a3f6
SHA1 de83a411b74bb8d499ad954422f923b647a13f6f
SHA512 5ce1d01064e2b77e4bd7928b5c2cbd97be58e144261503cbd441003d34b8db58a17fc7e17b154001e94c2d5e1162720f6d02975ed964f48f52ffadb9003de2b4
SSDEEP 3072:8sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:8sQmpcF8BzXfwV
TLSH
T193E38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB950BAD5E683D0B93531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rojhbwuomg.exe

Path C:\Temp\rojhbwuomg.exe
Size 230KB
SHA256 ef6452208afc24edbbb115696734aa8f80d2dd341c16c468cc4278b4ae7da6cc
MD5 2c1d7be23de3137f6f1296d0df9c40e3
SHA1 93ff16972cc7418b5f6de7ac2680d5a72f07fdbb
SHA512 fdf7cdec65ef2a48911e89b519f67472e1600c0fd0a3d3a6ecee03f8b6c2d5eef73cfc547e7c6df550defce0e7e07f8be0b4cc037ce1706ffbfd59a552d5700f
SSDEEP 3072:iJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:ighLQ0sQmpcF8BzXfwVfAI
TLSH
T12C344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmhezxrpj.exe

Path C:\Temp\urmhezxrpj.exe
Size 230KB
SHA256 4b00b55b15c3b593e15ce3f563ae4b3514f98ce1b2db0e3a481a8dbe12f74b07
MD5 d4de5e8e8840872ec0404915538629fb
SHA1 120065a136b8dd729fcca66947847449dbf6970a
SHA512 6470a3aed7d5945c9e586fb29aa55a354d2ae28a4768022a01db4b079f1eb357fc9850b8f48ca9997db18f46f1099857230ab041724c60968f4172db3d224e16
SSDEEP 3072:PJWhLPcg3TC0sQB8BPFvdRcF8rFz1wxayNM3coteYnwrZCkAI9:PghLQ0sQmpcF8BzXfwVfAI
TLSH
T182344A1272808071E7560B78046AE7A14A7E7D344BA5E68FF7A43F795E302D3A93721F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urpjhfzxro.sys

Path C:\Temp\urpjhfzxro.sys
Size 141KB
SHA256 fddd82100a5db2c7513f6cc1795270bc399192175e392d7656c6de819bbc7a9a
MD5 f92083340edc386e7a9f0dbaf72f1208
SHA1 2a11baac7371667afd0e150c61d0b5c2a2775a07
SHA512 8b78fa7feebb3d42b2518dc25471966693e90f2eee7604df4208413db3e4818482886f26b0e36a4ad5fbd2a6b2b1215fad3434de003c07280ac9a41e499bc9f8
SSDEEP 3072:IsQB8BPFvdRcF8rFz1wxayNM3coteYnwrZ:IsQmpcF8BzXfwV
TLSH
T1DAE38D02B2D1D172E8A618BC106AC72196BE79304F76D9C3FB940BAD5E683D0B83531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

02d6c3fa-a2ac-4b9d-9ffe-8466b5b1664b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02d6c3fa-a2ac-4b9d-9ffe-8466b5b1664b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5538563e51258dc6690b12fa5096db7bfaafcee0ba3e9e5696b52d2d3d1327d6
MD5 b2a290f9eec92b8004ca6080bed91b32
SHA1 b09961241232f996a56a5a78635c23f3aec998d4
SHA512 eee99d9090d99c96015e01cbc0f584bfd7f18a260c5cfcb773a241af6e9ca3cf1261a8d25004e3d8d48b6cc2f8d1ec0ba3dfb787ba00e465d9a7126001d138dd
TLSH
T1FC618160A32E18FADB3DC5B160EE265832F788A90E4B2E5186C35DB02F26E3750D0037
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592512.TMP
Size 3KB
SHA256 e84439e4e2bf031f34284956e6b74de558858db5880360027090555a551b76c6
MD5 e361a2988ea0d2a008df3af3c97b7971
SHA1 bb13849e9b65ff9efec714f12f59672da273279c
SHA512 7265d215d372ade941d340983552f07efacb10ea51ed677440d10a2bf7c9e2bf591e74bfe11068c08d815bd3e73abd2d14db2297c67c8f299c976e2d67b77fd5
TLSH
T17D616261A32918F9DB3DC5B160EE165831F7C8A90E4B2E5156D35DB42F26E3751D0037
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 584674a7aab2907bb21697acaddf5afabe0de8e7f2b376230de8cdd832900bcf
MD5 f2d1bd87724400055bb1edc676d138fa
SHA1 481713fd0b13de237be1ec0dbe494669b072d590
SHA512 63937f5b2ae90ecaac44d3d44ce646d344e60e10860d176b9b8cc7b1ec787f031dd33d0b3c07cf6ef59f74d31a432a2dc71c2951c5425e6ba772bbd0399a2569
TLSH
T1F741C0F787F4857E8A0155F0AA186E1FCF2D0511432C7C9A88E0AE2B93E3471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 31acc7f166c636923705f88ddf11b4f8de39d0b4bd49094bc77ee9143e121e97
MD5 ce7c1aaf041b3b08c0c3f4bdc95d69d0
SHA1 5ac5a0c2cf0e325f0719acbca683214048ecaf2f
SHA512 c8e092f3057088e9a373db42eee7152096a85cdd0a10a910b2383af98008e00685731b1da5042d8a6c93260955d02e502e24608fe052a9dcbb0f0338e572e4a7
SSDEEP 192:sxRKR8yM/jK1Ml8wCx/f5sqJSzZ1qStzoA8p9I/g6+WNC/NfYlCZGIJtGsIgVadJ:sxRKm8x/f5sqs91LgG/5sf15wn
TLSH
T19E62E8156A646D378CDBD309FA527B53D2F85573A1901E44AAFC8A0C00EBBED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 da0be2ceb1b486b0248f24dd47fb10b9961a3a206f3dc09e147838f9043a7cff
MD5 761500d1f832c3a93e2f9a19298e23c2
SHA1 9aded803efc70486b0b7d5d9d90b2f5bd6bb0782
SHA512 22e3bb546ed97220d95c01c43e19a34bc0ac581f4f4ff6056bd51383654d3035cb17c39f0dbc5f8dfad69653b8c95dbefbbd95fa1f6d10e8907909de56ed37e6
SSDEEP 192:sxR5R8yM/jK1Ml8UQGCx/f5suJ0zZ1qStzoA8prI/g6+WNC/NfYlKZ+cJtGsIgDh:sxR5mqhx/f5suq91Lgk/5sft5dn
TLSH
T1D962E815AA646E778CDBD209FA527B53D2F85573A1501E44AAFCCA0C00E77ED211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02be57b529ffab6098efa3051830a10c7cabbe97f282a4a4e5af5c1a6cd64815
MD5 5858ec1710562ee05f3d873635ae084a
SHA1 c0137d05e83d0b305c35c8c25508294770184e95
SHA512 6995f6f69d81cc320e1f58da3f3c9c43252d39a9276130e12cf591c2e06138969f1d90d57e0a56d32f4a80638163308a2c2079604243ea541234e9368ba20070
SSDEEP 192:sxR5R8yM/jK1Ml8wCx/f5suJSzZ1qStzoA8p9I/g6+WNC/NfYlCZGIJtGsIgDian:sxR5m8x/f5sus91LgG/5sf15Hn
TLSH
T14162E815AA746E778CDBD309FA527B53D2F85573A1901E44AAFC8A0C00EB7ED211782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ee462f0a2b9c4e8a6a774b14d6e05717a7c6178db6ee0047e72a294d2978f641
MD5 b38a6d58ae1113921879b89609743138
SHA1 c0de90950750c1363d63726f19ce7a5a27f1b389
SHA512 1ab2b6fafd4ae5ec4fe901e6515cf7e08667cf44b99f5291d1835f866b77e9bc74c87af27b65afcb71bf610015e4de6d7f4e74290e3f4b82807e9469c70c3c85
SSDEEP 768:dhRA4j7pLuL7ExWgg+fAJ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOAa13fYroPo0g:dhRA4VE7ExWgg+fAJu1jaNAalfjA0g
TLSH
T199E2ED3B680CCB7E4F804A9CEC29BE9A6DE802CF56D8C95447EA441C03C6BEB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c000e19b44c33af905e363b5bc50b0ae90578fefa8cb519f8156dc41c6942910
MD5 ce4c223abe6ebef4a8f74c0280d1d038
SHA1 0ab86a9ac0009ea8d3c73a579d763512b9181aae
SHA512 c7779cfeebd547ca7711e9060ccccf80f8fc6790fd045db0bf0f715750edc4b40091849dc63daab96abc8054f6d4f5a6f7238b9988d82b7f15227b7907749e49
SSDEEP 96:KRjsJ9rhhdW1aQgldK4cgLdczLiVhmHSoSZSsS4SqS2S6SgWSeSDSzgSgSgK4S1Q:CjsJ9rhhY1ahl3cgLyzLiVhmHSoSZSsh
TLSH
T163914411357A57803C7F691C80BC895F9681F5A3311AA9BB7FB901620F6BE128CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d95413f-d5bf-48a0-874e-f566cb2ffede.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0d95413f-d5bf-48a0-874e-f566cb2ffede.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 fafc26575aea1fc397bf3c6ec1e549f250df82bc14db02c7564bda55011298df
MD5 c31452d148f790f940bbc61035c1957c
SHA1 63b0c2eab5978687ea09260071fe5c79217d022c
SHA512 e6665786a6f619e00355559017e684530055e6b866e96d67ef1a3930bff0bb2e7ad595d909794a57c2e7a050e7c047b0b80799c904b7ca03ac7517cfa456d51b
SSDEEP 768:OFQ/3fwgXGahhYycrKU+NHXmTWTbc+H70uTH/JBu6:l/3gDKUSeWn1b0cH/JB/
TLSH
T1241328F188D39677E9AE4B87673D6E069EBCC163B1985484BBD81D4DCC8607FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5d7636f0ac33cb38b6d57176cab4da022444954f5c25e799a4a4f20518055209
MD5 c2a55fde40a69c24ac56ed5b3c39f9b7
SHA1 769c13d972f69f788a5e9f7d702121d1012c83cb
SHA512 44a980e3b6876a36397ae9fa208a7a696fab096026edd675ae02fa425114d2aae3654ec633142935710d091dca9dcb653a13466824caa7b67dd274c330767e98
SSDEEP 768:w/3XGahQY7iJrKU9NHXmTWTbc+H70uTH/JBu6:w/3WYAKUreWn1b0cH/JB/
TLSH
T1E4F2BFB19CA5A977EDFA9B89750BBB026FE4516381DC1884CDED2B0E018756D0317C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 30aca3c3c2b6ce240fffacc3ea6992dbe5f145a7f167a28acf11f8b96e4c2d69
MD5 61561a718093b1fb19e6f76162950e8c
SHA1 01302b72ca20080b652b524580ad5c0f7ed1152c
SHA512 7a789d99626f09c34d2f1b0b972b9f90991d09b2916bed10fd6cc408e1ca7d80288a1e031e1af3ca83155ccedb1b3a6ffbc5fe911135ab5fc4cb7f00ed265a2d
SSDEEP 768:arv+4UNbdM3AXsiJrKUhNHXmTWTbc+H7eVH1Svyy:absb+3HAKUXeWn1bEH1dy
TLSH
T14603CF319CB99A37AEF69B84B44BBA077FB8116385C40984CCD92F4D428B49D031BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 241f4e705b4869c4e0357cb4ceaf8239d3517afb736b7291cb48cbabd18b872d
MD5 7940e3ed0a9f74f55efec15ae8bcc864
SHA1 cbb0fb7b721a2fef70488fbd1427f2498db5868a
SHA512 8cfccf6a4d4dbe94964e79252d1890f005607f43bfac5406cc8bc03d7cb455a3461f16fb5138c5d4204940bea4f878db28d49ad84f3aebe13345bc64726c6818
SSDEEP 768:arv+4UNbdM3nIGiJrKUONHXmTWTbc+/NeVH1SvyZ:absb+39AKUieWn1lEH1dZ
TLSH
T11603CF319CF98E379DF69788758BBA573EB8106389C40B88C9D96F4D428B44D170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 6eb06533c5eb135564d749a690b9682fe09f87687e11fcba238e58223a87eaed
MD5 30f6fdb3625890ecd685cfb29cd928c0
SHA1 794667a28434fd40bb4f1e741be07ef6b2940e2e
SHA512 8dad149684f44564225b9231a066bcbdc4620bdcbc52d77c5d22a876664c9187f555027f5ec062b21ecff79b6c133a1d0403ae7556daec31e6bab8ba9e801bd0
SSDEEP 768:Erv+4UNbdM3SGahQY7iJrKU+NHXmTWTbc+H70uTH/il:Ebsb+39YAKUSeWn1b0cH/il
TLSH
T18413C071ACA9AA77DEF69B84740BBA077FF411A381D80584CDD92F8E018B49D131B937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 de270d6baaddc7040633d3c79a3183b11b69beb06aa4c70b372b59ad619e104a
MD5 85b0a0234101cdbac04e1b3a35454fb4
SHA1 43871b77957cefc88a839f312998e8a89fb9c784
SHA512 fd2f1bc3c018c98c77a8ca2954a7cb3cbf7bc973e8941782302ab571132d5a9d2671d207ae64fbf0bf4e6c51845ba71e043ae6ad54d3afa7587af4cf899aa062
SSDEEP 768:g/3xGahQY7iJrKU9NHXmTWTbc+H70uTH/JBu6:g/3kYAKUreWn1b0cH/JB/
TLSH
T14DF2BFB19CA5A977EDFA9B89750BBB026FE4516381DC1884CDED2B0E018756D0317C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 73c0b6b59dde974cbd12ed9dc39b7a8aa9924aef07c7ab48ad7107f4531c44fb
MD5 93337e0863d50561d68ada714b3b8e17
SHA1 9140e8ccdbf19c669036b566d5a6d964450f3e69
SHA512 16446296bf2b442c457a2ac288d704301545c50ed16b83fda3056629a1d089f4f7bb7325c901e8d0a2ee1a35ef5d27f118467ba0fba6b6fbe61a1fb16ccf77b7
SSDEEP 768:Hrv+4UNbdM378KiJrKUhNHXmTWTbc+e7eVH1SvyZ:Hbsb+35AKUXeWn1sEH1dZ
TLSH
T17503BF3198B99A37AEF69F84B44BBA077FB8116385C40A84CCD92F8D428B45D031BD37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
MD5 c1bec3bc77db46888e279f8b3eeb18fc
SHA1 c2d14f387c796193ddc6378267768745c10dae14
SHA512 8d41fbab8134eec1a95a53d4d56d1d2edb1edced5b2f4987278e5b8f6ac9b169c9928a0c52ebe7a66393caddfa5a29e001890386b54105a8e69958661b40ec35
TLSH
T134F09E808C3E1AC5D6B90F6FE40716FC40D8591670D9287844CEE4A8A47B05B311586D
MD5 SHA1 SHA512 TLSH

Submit Download

75e1bf98-6bf5-4a62-9db2-aeba31779630.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75e1bf98-6bf5-4a62-9db2-aeba31779630.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir704_1041436672\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-358-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1464-274-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/1500-387-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2424-520-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2424-484-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2528-295-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2880-491-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-427-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/2904-448-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/3740-431-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4076-463-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4108-452-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/4940-335-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-516-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-245-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-280-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5016-538-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5032-354-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5356-407-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5816-308-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5836-339-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-197-0x0000000000010000-0x0000000000083000-memory.dmp

Download

memory/5840-251-0x0000000000010000-0x0000000000083000-memory.dmp

Download