systex | 6006c513ac5801a80d35003a5d095636ec721894c58c9d1263e98e1bf3838ab6

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260629-a3c7msax7j
SHA256 6006c513ac5801a80d35003a5d095636ec721894c58c9d1263e98e1bf3838ab6
MD5 04fb315157791653a531f8dfe0cbbd34
SHA1 d60ac1da35fd8d3f6f54d0222266c1fad6f36083
SHA512 29f6337660643507dfd70f00d2428bec2a891c62bb4e07b1575a64c7c0310084a04af8f8b729630d9306b66a93988183340d8072ab8995456df9c34e27f9e10f
SSDEEP 6144:/flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:/flfAsiVGjSGecvX
TLSH
T1EF747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
6024	bvtqljdbywrligay.exe
3460	bvtqljdbywrligay.sys
3016	CreateProcess.exe
5568	igayvtnljg.exe
3368	CreateProcess.exe
4288	CreateProcess.exe
2544	i_igayvtnljg.exe
1084	aysqlidavt.sys
4664	CreateProcess.exe
1872	vtnlidavtn.exe
3044	CreateProcess.exe
5412	CreateProcess.exe
824	i_vtnlidavtn.exe
4452	kifdxvpnif.sys
5356	CreateProcess.exe
1260	nkfdxvpnhf.exe
4480	CreateProcess.exe
4788	CreateProcess.exe
572	i_nkfdxvpnhf.exe
3424	hfaxvpnhfc.sys
5244	CreateProcess.exe
5944	kfcaxvpnki.exe
4256	CreateProcess.exe
1772	CreateProcess.exe
1244	i_kfcaxvpnki.exe
2420	xvsmkhfcxv.sys
3900	CreateProcess.exe
5024	jhczuspkhc.exe
1836	CreateProcess.exe
4308	CreateProcess.exe
4548	i_jhczuspkhc.exe
5388	wupmhfzxrp.sys
4452	CreateProcess.exe
1892	urmkecwupm.exe
3528	CreateProcess.exe
2772	CreateProcess.exe
5796	i_urmkecwupm.exe
3680	gezwuomjeb.sys
5756	CreateProcess.exe
2660	gebwtrmjeb.exe
2632	CreateProcess.exe
1632	CreateProcess.exe
5976	i_gebwtrmjeb.exe
4808	wrojgerojg.sys
5132	CreateProcess.exe
2876	ojgbztrojg.exe
1532	CreateProcess.exe
2684	CreateProcess.exe
2544	i_ojgbztrojg.exe
4568	oigbywtolj.sys
2760	CreateProcess.exe
4896	igbywigbyw.exe
2288	CreateProcess.exe
852	CreateProcess.exe
3612	i_igbywigbyw.exe
6012	bvqoigaytq.sys
1720	CreateProcess.exe
572	vtnlgdyvqo.exe
1292	CreateProcess.exe
1992	CreateProcess.exe
1240	i_vtnlgdyvqo.exe
1652	snlfdxvpnl.sys
2340	CreateProcess.exe
5584	nlfdxvsqni.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1561062167\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1561062167\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_189677326\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1651514114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_188268496\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1561062167\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1651514114\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_188268496\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5652_1561062167\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtqljdbywrligay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvtnljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhczuspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvtnljg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcaxvpnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igbywigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvsqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhczuspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkicausnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfdxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igbywigbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbzwromge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwtrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwtrmjeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qojgbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdyvqoigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxspkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1220	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2648	ipconfig.exe
2992	ipconfig.exe
4420	ipconfig.exe
2880	ipconfig.exe
2980	ipconfig.exe
892	ipconfig.exe
5576	ipconfig.exe
2656	ipconfig.exe
2448	ipconfig.exe
2692	ipconfig.exe
2400	ipconfig.exe
3660	ipconfig.exe
2804	ipconfig.exe
1560	ipconfig.exe
5028	ipconfig.exe
5136	ipconfig.exe
4836	ipconfig.exe
5348	ipconfig.exe
1552	ipconfig.exe
5540	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-537605601-1362463912-856654178-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271674414810877"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-537605601-1362463912-856654178-1000\{58280E8C-BBDC-4F35-ABBE-C6BF333CD53D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe
6024	bvtqljdbywrligay.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe
5652	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	i_igayvtnljg.exe
Token: SeDebugPrivilege	824	i_vtnlidavtn.exe
Token: SeDebugPrivilege	572	i_nkfdxvpnhf.exe
Token: SeDebugPrivilege	1244	i_kfcaxvpnki.exe
Token: SeDebugPrivilege	4548	i_jhczuspkhc.exe
Token: SeDebugPrivilege	5796	i_urmkecwupm.exe
Token: SeDebugPrivilege	5976	i_gebwtrmjeb.exe
Token: SeDebugPrivilege	2544	i_ojgbztrojg.exe
Token: SeDebugPrivilege	3612	i_igbywigbyw.exe
Token: SeDebugPrivilege	1240	i_vtnlgdyvqo.exe
Token: SeDebugPrivilege	808	i_nlfdxvsqni.exe
Token: SeDebugPrivilege	3532	i_spkicausnk.exe
Token: SeDebugPrivilege	1832	i_fcxspkicau.exe
Token: SeDebugPrivilege	4652	i_causmkhfzx.exe
Token: SeDebugPrivilege	2752	i_hbztrmjecw.exe
Token: SeDebugPrivilege	5484	i_jgbzwromge.exe
Token: SeDebugPrivilege	4012	i_qojgbytrlj.exe
Token: SeDebugPrivilege	2612	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	3812	i_gdyvqoigay.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 6024	5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5900 wrote to memory of 832	5900	2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 832 wrote to memory of 5652	832	iexplore.exe	91
PID 5652 wrote to memory of 2944	5652	msedge.exe	92
PID 5652 wrote to memory of 2512	5652	msedge.exe	93
PID 5652 wrote to memory of 1220	5652	msedge.exe	94
PID 5652 wrote to memory of 2512	5652	msedge.exe	93
PID 5652 wrote to memory of 2512	5652	msedge.exe	93
PID 5652 wrote to memory of 3828	5652	msedge.exe	96
PID 5652 wrote to memory of 3828	5652	msedge.exe	96
PID 5652 wrote to memory of 5980	5652	msedge.exe	97
PID 5652 wrote to memory of 2936	5652	msedge.exe	98
PID 5652 wrote to memory of 5980	5652	msedge.exe	97
PID 5652 wrote to memory of 5980	5652	msedge.exe	97
PID 5652 wrote to memory of 2936	5652	msedge.exe	98
PID 5652 wrote to memory of 2936	5652	msedge.exe	98
PID 5652 wrote to memory of 3996	5652	msedge.exe	99
PID 5652 wrote to memory of 2212	5652	msedge.exe	100
PID 5652 wrote to memory of 3996	5652	msedge.exe	99
PID 5652 wrote to memory of 3996	5652	msedge.exe	99
PID 5652 wrote to memory of 2212	5652	msedge.exe	100
PID 5652 wrote to memory of 2212	5652	msedge.exe	100
PID 5652 wrote to memory of 3184	5652	msedge.exe	102
PID 5652 wrote to memory of 3184	5652	msedge.exe	102
PID 5652 wrote to memory of 2012	5652	msedge.exe	104
PID 5652 wrote to memory of 2012	5652	msedge.exe	104
PID 5652 wrote to memory of 1248	5652	msedge.exe	105
PID 5652 wrote to memory of 1248	5652	msedge.exe	105
PID 6024 wrote to memory of 3016	6024	bvtqljdbywrligay.exe	107
PID 5652 wrote to memory of 4896	5652	msedge.exe	110
PID 5568 wrote to memory of 3368	5568	igayvtnljg.exe	112
PID 5652 wrote to memory of 6100	5652	msedge.exe	115
PID 5652 wrote to memory of 6100	5652	msedge.exe	115
PID 5652 wrote to memory of 3424	5652	msedge.exe	118
PID 5652 wrote to memory of 3424	5652	msedge.exe	118
PID 6024 wrote to memory of 4288	6024	bvtqljdbywrligay.exe	119
PID 6024 wrote to memory of 4664	6024	bvtqljdbywrligay.exe	123
PID 1872 wrote to memory of 3044	1872	vtnlidavtn.exe	125
PID 6024 wrote to memory of 5412	6024	bvtqljdbywrligay.exe	128
PID 6024 wrote to memory of 5356	6024	bvtqljdbywrligay.exe	132
PID 1260 wrote to memory of 4480	1260	nkfdxvpnhf.exe	134
PID 6024 wrote to memory of 4788	6024	bvtqljdbywrligay.exe	137
PID 6024 wrote to memory of 5244	6024	bvtqljdbywrligay.exe	141
PID 5944 wrote to memory of 4256	5944	kfcaxvpnki.exe	143
PID 6024 wrote to memory of 1772	6024	bvtqljdbywrligay.exe	147
PID 5652 wrote to memory of 1832	5652	msedge.exe	149
PID 5652 wrote to memory of 1956	5652	msedge.exe	150
PID 5652 wrote to memory of 2684	5652	msedge.exe	151
PID 6024 wrote to memory of 3900	6024	bvtqljdbywrligay.exe	154
PID 5024 wrote to memory of 1836	5024	jhczuspkhc.exe	156
PID 6024 wrote to memory of 4308	6024	bvtqljdbywrligay.exe	159
PID 6024 wrote to memory of 4452	6024	bvtqljdbywrligay.exe	163
PID 1892 wrote to memory of 3528	1892	urmkecwupm.exe	165
PID 6024 wrote to memory of 2772	6024	bvtqljdbywrligay.exe	168
PID 6024 wrote to memory of 5756	6024	bvtqljdbywrligay.exe	172
PID 2660 wrote to memory of 2632	2660	gebwtrmjeb.exe	174
PID 6024 wrote to memory of 1632	6024	bvtqljdbywrligay.exe	177
PID 6024 wrote to memory of 5132	6024	bvtqljdbywrligay.exe	181
PID 2876 wrote to memory of 1532	2876	ojgbztrojg.exe	183
PID 6024 wrote to memory of 2684	6024	bvtqljdbywrligay.exe	186
PID 5652 wrote to memory of 1496	5652	msedge.exe	188
PID 5652 wrote to memory of 1496	5652	msedge.exe	188
PID 6024 wrote to memory of 2760	6024	bvtqljdbywrligay.exe	194
PID 4896 wrote to memory of 2288	4896	igbywigbyw.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_04fb315157791653a531f8dfe0cbbd34_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Temp\bvtqljdbywrligay.exe
  C:\Temp\bvtqljdbywrligay.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvtnljg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3016
  - - C:\Temp\igayvtnljg.exe
      C:\Temp\igayvtnljg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5568
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvtnljg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\i_igayvtnljg.exe
      C:\Temp\i_igayvtnljg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidavtn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4664
  - - C:\Temp\vtnlidavtn.exe
      C:\Temp\vtnlidavtn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1872
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3044
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidavtn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5412
  - - C:\Temp\i_vtnlidavtn.exe
      C:\Temp\i_vtnlidavtn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfdxvpnhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\nkfdxvpnhf.exe
      C:\Temp\nkfdxvpnhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfdxvpnhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\i_nkfdxvpnhf.exe
      C:\Temp\i_nkfdxvpnhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcaxvpnki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5244
  - - C:\Temp\kfcaxvpnki.exe
      C:\Temp\kfcaxvpnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcaxvpnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1772
  - - C:\Temp\i_kfcaxvpnki.exe
      C:\Temp\i_kfcaxvpnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhczuspkhc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3900
  - - C:\Temp\jhczuspkhc.exe
      C:\Temp\jhczuspkhc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhczuspkhc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4308
  - - C:\Temp\i_jhczuspkhc.exe
      C:\Temp\i_jhczuspkhc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwupm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4452
  - - C:\Temp\urmkecwupm.exe
      C:\Temp\urmkecwupm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwupm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2772
  - - C:\Temp\i_urmkecwupm.exe
      C:\Temp\i_urmkecwupm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwtrmjeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5756
  - - C:\Temp\gebwtrmjeb.exe
      C:\Temp\gebwtrmjeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2632
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5028
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwtrmjeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1632
  - - C:\Temp\i_gebwtrmjeb.exe
      C:\Temp\i_gebwtrmjeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5132
  - - C:\Temp\ojgbztrojg.exe
      C:\Temp\ojgbztrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1532
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2684
  - - C:\Temp\i_ojgbztrojg.exe
      C:\Temp\i_ojgbztrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igbywigbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2760
  - - C:\Temp\igbywigbyw.exe
      C:\Temp\igbywigbyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2288
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igbywigbyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:852
  - - C:\Temp\i_igbywigbyw.exe
      C:\Temp\i_igbywigbyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1720
  - - C:\Temp\vtnlgdyvqo.exe
      C:\Temp\vtnlgdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1992
  - - C:\Temp\i_vtnlgdyvqo.exe
      C:\Temp\i_vtnlgdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvsqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2340
  - - C:\Temp\nlfdxvsqni.exe
      C:\Temp\nlfdxvsqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5584
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvsqni.exe ups_ins
    3⤵
    PID:5336
  - - C:\Temp\i_nlfdxvsqni.exe
      C:\Temp\i_nlfdxvsqni.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkicausnk.exe ups_run
    3⤵
    PID:5304
  - - C:\Temp\spkicausnk.exe
      C:\Temp\spkicausnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkicausnk.exe ups_ins
    3⤵
    PID:2976
  - - C:\Temp\i_spkicausnk.exe
      C:\Temp\i_spkicausnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxspkicau.exe ups_run
    3⤵
    PID:4960
  - - C:\Temp\fcxspkicau.exe
      C:\Temp\fcxspkicau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3508
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxspkicau.exe ups_ins
    3⤵
    PID:4964
  - - C:\Temp\i_fcxspkicau.exe
      C:\Temp\i_fcxspkicau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkhfzx.exe ups_run
    3⤵
    PID:5368
  - - C:\Temp\causmkhfzx.exe
      C:\Temp\causmkhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkhfzx.exe ups_ins
    3⤵
    PID:2532
  - - C:\Temp\i_causmkhfzx.exe
      C:\Temp\i_causmkhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrmjecw.exe ups_run
    3⤵
    PID:2264
  - - C:\Temp\hbztrmjecw.exe
      C:\Temp\hbztrmjecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrmjecw.exe ups_ins
    3⤵
    PID:3280
  - - C:\Temp\i_hbztrmjecw.exe
      C:\Temp\i_hbztrmjecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbzwromge.exe ups_run
    3⤵
    PID:2668
  - - C:\Temp\jgbzwromge.exe
      C:\Temp\jgbzwromge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbzwromge.exe ups_ins
    3⤵
    PID:2932
  - - C:\Temp\i_jgbzwromge.exe
      C:\Temp\i_jgbzwromge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qojgbytrlj.exe ups_run
    3⤵
    PID:4956
  - - C:\Temp\qojgbytrlj.exe
      C:\Temp\qojgbytrlj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qojgbytrlj.exe ups_ins
    3⤵
    PID:2020
  - - C:\Temp\i_qojgbytrlj.exe
      C:\Temp\i_qojgbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    PID:2752
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    PID:2492
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdyvqoigay.exe ups_run
    3⤵
    PID:2156
  - - C:\Temp\gdyvqoigay.exe
      C:\Temp\gdyvqoigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1096
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdyvqoigay.exe ups_ins
    3⤵
    PID:6064
  - - C:\Temp\i_gdyvqoigay.exe
      C:\Temp\i_gdyvqoigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicavs.exe ups_run
    3⤵
    PID:1240
  - - C:\Temp\aysqkicavs.exe
      C:\Temp\aysqkicavs.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5348
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3660
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x260,0x7ffa86fdc188,0x7ffa86fdc194,0x7ffa86fdc1a0
      4⤵
      PID:2944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,15436149647278096919,4883458942208382534,262144 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:2
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6375391296780922863,7362948385514458295,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:11
      4⤵
      System Time Discovery
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10451016035160629269,4339666414519987464,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:13
      4⤵
      PID:3828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,6435446298863585294,10893734235541436731,2097152 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17768020311767225125,16305314614043616096,2097152 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:2936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,11246994287081922642,10643166052134423252,2097152 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13407168330136055525,2630874553160947442,2097152 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:9
      4⤵
      PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,7975398256219069335,16733278924504717758,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,17146173173634769053,3601800116942562700,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:14
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,9945464928445768744,11803156642306146723,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:1248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,10349058795193928132,9711390821102461492,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:5024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,10349058795193928132,9711390821102461492,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:4896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,12971233858769005459,17387210004264574647,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,16531575333394190582,7049824730724426496,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,3022112896330061869,2996078221159226614,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      PID:1832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,6378432096496453505,10751500731823036602,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
      4⤵
      PID:1956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,3695236013553690732,5738527803332656944,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:14
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,16549615423785187241,12355393448749066615,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:14
      4⤵
      PID:1496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,4680461836584667728,13195136626810847691,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
      4⤵
      PID:3552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,7293877550051552295,16706091099968732990,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:14
      4⤵
      PID:2020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,2752242153050891388,1086539871999364306,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,11636694151464793312,914172304130307920,262144 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:10
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,8456174828826419382,16115348460963026650,524288 --field-trial-handle=2972,i,5878546524311223331,13908145272710477703,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2020

C:\Temp\bvtqljdbywrligay.sys
C:\Temp\bvtqljdbywrligay.sys
1⤵
- Executes dropped EXE
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3160

C:\Temp\aysqlidavt.sys
C:\Temp\aysqlidavt.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Temp\kifdxvpnif.sys
C:\Temp\kifdxvpnif.sys
1⤵
- Executes dropped EXE
PID:4452

C:\Temp\hfaxvpnhfc.sys
C:\Temp\hfaxvpnhfc.sys
1⤵
- Executes dropped EXE
PID:3424

C:\Temp\xvsmkhfcxv.sys
C:\Temp\xvsmkhfcxv.sys
1⤵
- Executes dropped EXE
PID:2420

C:\Temp\wupmhfzxrp.sys
C:\Temp\wupmhfzxrp.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\gezwuomjeb.sys
C:\Temp\gezwuomjeb.sys
1⤵
- Executes dropped EXE
PID:3680

C:\Temp\wrojgerojg.sys
C:\Temp\wrojgerojg.sys
1⤵
- Executes dropped EXE
PID:4808

C:\Temp\oigbywtolj.sys
C:\Temp\oigbywtolj.sys
1⤵
- Executes dropped EXE
PID:4568

C:\Temp\bvqoigaytq.sys
C:\Temp\bvqoigaytq.sys
1⤵
- Executes dropped EXE
PID:6012

C:\Temp\snlfdxvpnl.sys
C:\Temp\snlfdxvpnl.sys
1⤵
- Executes dropped EXE
PID:1652

C:\Temp\avtnlfdxni.sys
C:\Temp\avtnlfdxni.sys
1⤵
PID:4864

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
PID:2240

C:\Temp\zxusmkeczu.sys
C:\Temp\zxusmkeczu.sys
1⤵
PID:3564

C:\Temp\keczurmkec.sys
C:\Temp\keczurmkec.sys
1⤵
PID:1356

C:\Temp\rpjhbzurmj.sys
C:\Temp\rpjhbzurmj.sys
1⤵
PID:3276

C:\Temp\qojgbywtol.sys
C:\Temp\qojgbywtol.sys
1⤵
PID:3932

C:\Temp\wqolgdywqo.sys
C:\Temp\wqolgdywqo.sys
1⤵
PID:4276

C:\Temp\lfdyvqoiga.sys
C:\Temp\lfdyvqoiga.sys
1⤵
PID:5920

C:\Temp\nlfdxvpnlf.sys
C:\Temp\nlfdxvpnlf.sys
1⤵
PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqlidavt.sys

Path C:\Temp\aysqlidavt.sys
Size 293KB
SHA256 3aca8ffe564109cd5466ede03809c189ace72ae1a0e6fae8a632e37d01ea04d9
MD5 f23ebb25df7c7a24ee023b0840eedb2d
SHA1 61240ef0c1d938bb7b50d4dd6f9e7546baaef429
SHA512 5e5f86354bcb7d7c8f05c06fd05b724ccdcb1b124d9823126606e8978b8c4671e12b0fc93d6a7dbf2736388ed1a7f33855f904bc09493fafb07294a499efcfff
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqljdbywrligay.exe

Path C:\Temp\bvtqljdbywrligay.exe
Size 361KB
SHA256 3bc60bb298c2f2faf95c13c57c782c0262105cb952f7eed73db7ea281b921d34
MD5 0799c9f50ca3a61ad462bbacb80d596d
SHA1 98e2419b5b84372cd8295e8e1ab49200d5589e4c
SHA512 047f63744a43b0c4c6f9c6440350cb2a622c87fa8c4d2487fdf404e5ece5abe712f97d229e89603a57bfbb32f0517afcbf189fb57196c9e03cac5bd651da7f8e
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T15F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtqljdbywrligay.sys

Path C:\Temp\bvtqljdbywrligay.sys
Size 293KB
SHA256 bd3a5c90c6d7a275790ecda1dbbd84455c8801adb9a8f4f59c17afdbf2186df8
MD5 1ae2fe3b566b2412f34de941c00777c2
SHA1 fe6a96eb57ce6d94195a4a8d79c177830a2225d2
SHA512 1423501f2f59a695cae865aea51226ca381f17f119fe8bb1fbfcae2073ac95699849c06d168e5800097a73cf310831de8e0c60c164d332e4d1c06ce61ab3b6e5
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxvpnhfc.sys

Path C:\Temp\hfaxvpnhfc.sys
Size 293KB
SHA256 b47e33ad167a85e42bfaa153f0960b8ac86a11d06b70020ba0083fe3575e6465
MD5 f1eac32f95fd766787d8d082914de06c
SHA1 107b1ca06bf274f77c9f69b01c5d87f1181a5bf9
SHA512 ff90ce51b636dbdde68bd7c0a63c31e72bd9bf043381083e467079b89b45d01d2fb4d0e12c81345e8e38962426b58a80c083589774296ba74f99705a7e92904d
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igayvtnljg.exe

Path C:\Temp\i_igayvtnljg.exe
Size 361KB
SHA256 c44cc28ec85cf65e81738fb6466d53269d8d34bd073d7ff93e0655db50bbbbca
MD5 4d4de9c1b0d6ba81e215eacb66870748
SHA1 1290ae88de6f013264532cd74cc7ff5237673cdd
SHA512 e85bf3eefbe2db59e80b3cd29285431f1a73a09c0119d047c6ca36543fd98053d62780098603dd96b71f87e207ee48443dd348983de29c161f8f294878332d6d
SSDEEP 6144:qflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:qflfAsiVGjSGecvX
TLSH
T11F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhczuspkhc.exe

Path C:\Temp\i_jhczuspkhc.exe
Size 361KB
SHA256 91dbea918f878ddfc9f34f4e70e09f338ae6fcb09f1dd83ff954c3abed9e33dd
MD5 37306481e64b86f7bca8303c4586777b
SHA1 4f998f9fbf4dd8eeac3baea8dbbb84ef717af491
SHA512 e863c5d9e58082f84401bd2345af26841f645d0d8d71f556f364183928a77dcffe2072d3c36296cdfc59be9f82280a4600505f367151556c13aa6ce330f68298
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T1D4747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kfcaxvpnki.exe

Path C:\Temp\i_kfcaxvpnki.exe
Size 361KB
SHA256 840786aaf55ad6b91626f016997f7d646699aeee0493dff0d1cb658d6e0e6c6b
MD5 668630d3a1aa906193047832691e7418
SHA1 757f8a512166a78a7391ec3a6f982369da1ce2c6
SHA512 8bff66b7527276ca531c5d7364d57e715cc141f4719691df559a0aca7678c7b86c87dd915171520b2b536047e8506dc2c6df635543d116c022cf82298e52da04
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T1EB747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nkfdxvpnhf.exe

Path C:\Temp\i_nkfdxvpnhf.exe
Size 361KB
SHA256 28fda9ebc3a2aff5c501b764f52426b2270e4cef4a84afd4e24f0a35e2796bea
MD5 15f65e294cc97d65d083cb77c940c9f6
SHA1 cd0fe68f411bfde3d8cef720c13b5bbeb3c17940
SHA512 0f5237f527bcbaa2729d855444c8285d849f0e7bfffb102b67f65250a622e94fea81b82eba462eae433639fae3c88e125b767216faeb5f7d39f86152a19203b9
SSDEEP 6144:zflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:zflfAsiVGjSGecvX
TLSH
T111747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlidavtn.exe

Path C:\Temp\i_vtnlidavtn.exe
Size 361KB
SHA256 7b5b041b1ced2f1a8c8e342523ed37650745d8af2fcc77ebed397a2b7fa52c4d
MD5 5a4c58bddf5627b7feb6e5e160e87509
SHA1 26f47f109ed5b25c97a60e0f0daa6482483c793f
SHA512 b53b756874ad3e85cd92ee1dde40af69b9ba029e1a4138f21ddad138dbe5ff3e3741df6eab504b6f126824aa3cf1a66489b33573a791bca5ea5d686f3550bbbf
SSDEEP 6144:aflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:aflfAsiVGjSGecvX
TLSH
T17F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igayvtnljg.exe

Path C:\Temp\igayvtnljg.exe
Size 361KB
SHA256 e4887cde21eafe79b281760084708347846836f72b9fe4b963c0be40bc02c74d
MD5 2cdd320569edcdeb98f06cb2a0393c61
SHA1 b8c890b21bbced8b708fd5d3f8f2d7c007d5ab29
SHA512 0d0bdbf5a5c7903e3e976ac76d225cea80ab49256e2270f49e8fa1c36653a1579fb79425ca4f5979a0344b7e9329a0ff54bcf7cfb2940a2aaed1752af4369a0c
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1D8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhczuspkhc.exe

Path C:\Temp\jhczuspkhc.exe
Size 361KB
SHA256 1270f548a860a9b64eb38f0f55e21924b8652bce617e543ae3d41360653defb4
MD5 970bac347c7f85f391d77c4e7c624d8b
SHA1 d785c5a8cba645a2042f6e21ea18e09c36c200f7
SHA512 c52c00271c9f0c3d44121a8fe5c8480ad87096fe31305044e78c4e5d9cced5191215cf39e7645daaba47548d0de25ad905c4009ff920e9c350d158df3c9c5dc0
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcaxvpnki.exe

Path C:\Temp\kfcaxvpnki.exe
Size 361KB
SHA256 b7034af9bbb39050b6597643c2f33a2d45520aad617aa37f5f24115589462d24
MD5 34e47efb0cc03f705de97cd66bf177fc
SHA1 283333489385c445b2613dbef924685eac9c48dd
SHA512 3bbb6753dd799e378d2e60a4ebf1585c3fbd20118d512f19ea929747e976a380433bfd45fb3d4a3c597347b1b7ac9ffaea8bae7a3290c786370363facbd95f7c
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T1A1747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kifdxvpnif.sys

Path C:\Temp\kifdxvpnif.sys
Size 293KB
SHA256 7fc5454ca4e1b05abaa2fa11e18bf579fdea12b4afbc33bcee96b8c887039360
MD5 ed2c3e07d0f5375c8540053d6b771f02
SHA1 62208da2b5fde041006cbda317ce480dea7764bc
SHA512 b618676365287248bb5351783675993cb42e32a6ff58f82762d7907a5793993094ce6b395d11247b0385d026f02df41de4354a072fe4b753d21434ab8cfc2850
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkfdxvpnhf.exe

Path C:\Temp\nkfdxvpnhf.exe
Size 361KB
SHA256 23b3892b42fa9baf5eee5d3128252a9f44c7067fab5a73b41d848e0438a7dc7d
MD5 38dfae6933a2c15b25dc2249e50851de
SHA1 6d201c6821e5cdd529e782d0ca5cb037fb92745b
SHA512 f95ee03030fd879c5dfa36748fc8287d4def7123108237cd4a2d98345ef889a948fafa58beda219780ecd0f50f280b742cf04b955665a6b10afb2c4621860e6e
SSDEEP 6144:bflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:bflfAsiVGjSGecvX
TLSH
T1E9747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmkecwupm.exe

Path C:\Temp\urmkecwupm.exe
Size 361KB
SHA256 c06238f8f1095e42a68d4d1a61ff63eba469c03e072f033fc3e0d4f1fd54e8c5
MD5 a1762a1954a6b1e24fe335410c60ff86
SHA1 4406199df1bff872d733f65e6dfee28a39810600
SHA512 7951fdd5b1e1ae4432b3bb971de41b738753f4b62f6eb9a1c66c0521bb68203a48a2d5f99d6e30f95cd8832eda1876f258616e700034daeb9ddb25e9d57c038e
SSDEEP 6144:vflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:vflfAsiVGjSGecvX
TLSH
T157747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlidavtn.exe

Path C:\Temp\vtnlidavtn.exe
Size 361KB
SHA256 02f63af6a8e1338a0fe477c08ca576609f4e2a4609db42edfa4684e46b67556b
MD5 0b400b8921b0e290eccb317f794b9970
SHA1 924922639a16ec3588a4504c40d3fd2a55d3d355
SHA512 ac44068a911b9902b172060dff744483008726cff47847294d9ee862347501b00d36b7e71a49859377519d6621301a8ec9de0d48287c9dac647f531d07a98e36
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T1FE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wupmhfzxrp.sys

Path C:\Temp\wupmhfzxrp.sys
Size 293KB
SHA256 53e6ebc8fe33229e8fc8e4d6cc814704cd3456f6178da88024b1e3b735ab60e5
MD5 5939121d7a6879b485985849ee144544
SHA1 d89375039f266671e273ab3761e877fa4a2d564d
SHA512 6e0dbe9ff6de01f02d5773b281b30557c79ec3a4046437c47b3a2740f945fdf696ee44dcb1ad438f1fa77acedb8fcf0852d9c696eadfd74a19ec1e4b50f7d09b
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T16B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvsmkhfcxv.sys

Path C:\Temp\xvsmkhfcxv.sys
Size 293KB
SHA256 0119e9e19b48e65828c8198615b7cf2e29290bed9efa424b5b491eabb6f74955
MD5 737c8ed2762487f95d01c5b383b2cab4
SHA1 c6b992b1f487fcf7cd1acae62813fe9c923b1717
SHA512 05996812342be8678eb5009586b24af99bf34339fc3c4e4927985e00e7906ff5a400da2d91e650dc558ea2de160e546f80a75f90f347b26e3e023f7180e64f6d
SSDEEP 3072:ctKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:cIJjiJcbI03GBc3ucY5DCSj
TLSH
T197545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5f46172781024fe58b7a7d87a406b81679d17de445e9e90110d33f5747ecc226
MD5 08a5ef0e8eb4590a7f0e6f821698071e
SHA1 1b756aceae48cf2649d310d7ab4883595c2e5bde
SHA512 95c72989df00c3caf1230ca41b6dcbc24f8a592c45202f7b16044b8d574fe569d4db8614652b0d1695d3fe1d795b07ea334de5b4fa9dcbb9d27de40a55592586
TLSH
T155D080757B467A11D58F0476D424E271A737455125D296057170C10E55602D1FFC90A7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ff19e848916f9346514f95113e3d80cd569935b36d785719b19d90f9f740fbd6
MD5 5ab41182d14eb22e7143c63d2e18b77b
SHA1 ca8c747e1a5e38b0f0a08b492fcea6d3a75865c2
SHA512 bbecb67f89826ee2bd219f14bbc8ca87fb260f8a22bd2d52b6ccdb72d47a4b58eeb897a42a6e591bd4e75fe870419162172353d5d3ec7f1fb0fbc7b5dc6adcf1
TLSH
T1AED080757B467B11D58F0472D424E271A737455135D296057170C10E55602D1FFCA0B7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e724daec9eed405b0345cfff8c3d20f74f29b6398ea77f1c0fd1fa8d879228d
MD5 edd0076c695b31d150dc5e16ed55f34f
SHA1 f1fc37327e9c0b2fbe96871bab0583b457b3f9ec
SHA512 1989a6c2df3a9a4b0fd54e98d4aed94b64c34f14503e895ac7609df3cb689dc4febc5f1fdf6e35b39e1e352c625269cbea82e98badbce10293ee8feaef834ecb
TLSH
T1B561B8E1A8E32929DBF0B1B5E1C1209B37FAD04D31275D3B7BAE73BF6505700A841080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc51.TMP
Size 3KB
SHA256 60e67f671ec2a20c831aecd157938045fffbaeaab4e6603500e13227c4282c12
MD5 77aa423337d339f3024f6d5c433697f7
SHA1 be16f5f074225458dacbeecc609b39dc3bb8cddf
SHA512 701a2087f5b5d4668c44250a2a00acfcc53cf9339a8c3910302a2428312c7e8aa189894c81decbcf74d536db11deec65c869bdfdde21cee54c9492c5e87b8a7e
TLSH
T14A61A8D5A8E32919DBF0B5B5D1D1209B37FAD04D31275D3B7BAE73BF6606700A851080
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25b6331375a249891aa68479745f8381d29bc315354e3907c9d7214987aaaf54
MD5 85a46ee8c7256071d78d6e2154b23c5f
SHA1 ef6d6b85fda02c9ce187c71e21eee4437dcfb43b
SHA512 3770f04ddce0715d8b1b5e936d5d32350a137a1fdba38c2c4db479e528f0ac55278a5c687dc4ccaae5ad23e7bc0368355b3fe231e3b75d03f0ab6001aae71843
TLSH
T1BC41AEF3C3E8856D890155F4BB182E2BCE1D0924832C3D5AC9E49F1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f642d14b36c3967450f9a4179f81bc4a8200670c4de238fecd30bdc9b42275ad
MD5 b6af3157d3272cef955239add213c638
SHA1 68c9fac7931c191fefa9b160977de134736d2a9d
SHA512 39fc1e978de7e04d58212189852da92c5d820b52d98bd14656efbf8b113bb07f9269a18bc7380186c5694d17715f50b5e38bb73d89e00bc3d3354a6986f77324
SSDEEP 192:sxRjRMyM/jK1Ml8wcu/fosPPRqIZozoA8p9U/g6+WNCLZ/Y4pWKGnIgD97J:sxRjCCu/fosPZq2xG/5s/0b
TLSH
T11D62EA15AA345A77CCDBD209FA957F53D7F84472A2901E44A9FCDA0C01E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 676b17f19c2a7feefa124f479a21ae7c986e01b26f9fb2749fa865accc9d35c2
MD5 111148b89c2327c0e02a61780683303c
SHA1 51dfe56be16eb4c48b502e8de24e64024f3e41ea
SHA512 4520b5258c5f035ed8313a77b2e850527dc8242baea5465a0cf843e58894953e183e22c249ebb7b9fb9d3419b81f2e443de18d67c530f633899bc7e1a76be1ec
SSDEEP 192:sxRjRMyM/jK1Ml8UQgcu/fosPPR3IZozoA8prU/g6+WNCLZ/Y4pOUKGnIgDn7J:sxRjCqfu/fosPZ32xI/5s/9x
TLSH
T13562EA15AA345A77CCDBD209F9957F53D6F84472A2901E44A9FCCB0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0a06ebafbd1d504e660b1f32fb03fff6103aec06f2728026c232216cff37ee2b
MD5 ceb5a89a41386f3160564f8bf0ef786f
SHA1 d21087aa8238a8361ea9fc58b635a7b4077f3484
SHA512 d74978ebffa0ecec1b1e0bcdd33bc5a4970e21732b57c5c95961c209fd87a9d666f7be7723b53730c46f6070ef16eeab5fc2c551bf21e837135019854324a3c1
SSDEEP 192:sxRkRMyM/jK1Ml8wcu/fossPRqIZozoA8p9U/g6+WNCLZ/Y4pWKGnIgV7J:sxRkCCu/fossZq2xG/5s/0/
TLSH
T16B62DA15AA345A77CCDBD209FA957F53D6F85572A2901E44A9FCDA0C00E7AEC2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 608057b5546f7813b078f65a1659dc11b50a8894fc8b3096225de7acd0166ccf
MD5 3e0c1ce78d23ffc1e4fb6232355dc703
SHA1 caf8db6e5ba1872183e644368cb9b9dc28fb3ffb
SHA512 cfe0520684f53648c558a1db4b4aa031a8bed3089da85d3f6b54d938475d5601629229214ca65ef717108a056c3c4e77e1f798814094529fd58e7a3c5d625d7a
SSDEEP 768:Nmym4/7pLuL7YpWgvHfSv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCt3LxgQroRLr08:Nmym45E7YpWgvHfSvu1jatt3Ng7RLrzj
TLSH
T188E2EC3B680CCB7E4F844AADEC29BD9A6DD801CB5AD8CD5447EA840C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c8686b36a8dd67d279884d22694821261cb908480bb122fd7e509ff73cc45d89
MD5 73dd7f0996d196b5bb1ed14b46f24fd9
SHA1 d66adfd6974b281bf3d149dad347f6034b908948
SHA512 07a00412d77fb1008cb4b4e3d3403769aa23faf9c0b534a7e36eba4376a0c08ed23c9411440c85bb7340bfc73f2e77fda4469d95cd3ac2db3be17a6ae30c0fab
SSDEEP 48:KQFINKWg4/yZIILKpK8oCZGycIEkUIrPIrakKeBmkkKS0pLcS5yY:KQFyKWgiKIoKpKK/WK8Eyn
TLSH
T1FE914904767B264138BDA50982A5995F158234B330AAA82B3BFC70FA1F67D405EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597824.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597824.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 b303cd1788ce2b1db32f952330ea1124faa3eb5aeccfccbea0a31f64d49e1a49
MD5 1627cf8691c07fc0a4a03ba977ac73f5
SHA1 a439b1336c0c7a022e1c3e50cf2674c5c81589e9
SHA512 2bd56127ace47858f4980321ed293dbe35a73272007d08a1ab3085c58a055948ac73a3b35339b29687e8d434b0be029af11c6d5d5a411130ef6d4915869ab56a
SSDEEP 768:3jaeqD4MlshiLdMmf3Bcfy4faeA7NpespIRM0UmkTziwjgzGtnApXLPQTU:3qcjhIdMo3WfTfiQsZ0UmYlnKXD
TLSH
T16D03CF7698605EB78CB7E68A264376576FB00293C2C43BC8DCED6E0D41936DC530B96B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 6c84d9fba774a600afe6ae1213e9773ea3234059fb02cd008cfbba79da059491
MD5 2cea7dc29020cdf55cb08f8dcf0e4099
SHA1 cd0396bb2c178c231a0156ffeb05835ceccbd6e7
SHA512 82ddbea62f139907824cdf4f0864b5b7c04d70c63dba9f37c34579d70e09ff8dd45b11df9ad6effd4fa18a52c62a405805230ecfcfaf54749ebc440608cf286c
SSDEEP 768:NjaeqD4MlshiLdMmL3UzFfy4faifmtPUA7NpespIRM0UmkTziwjgzSEnApXLPnTP:NqcjhIdMQ36fTf9fepQsZ0UmYknKXn
TLSH
T17413C07198245EB38DB7E689664377576FF00263C5C42E8CDDDA9E0D41836DC270B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 bc732659601d8f15df99658dc431841083506cea45c20b3c1da8a00d13905df6
MD5 fda76b4ce768c0fcb945f8bfca109ead
SHA1 ddf8b581fb4cb5cc7f5e0eb69c139fcdaaa73d64
SHA512 43018b73b26a0a7b57f9a1dd597766641485d9c816250d9ca268b751c30527b5def67403e46518bb5396f7d580cef1849d725b46ecef969554afe263b057ab70
SSDEEP 768:tj+9F32JFfy4faifmtEA7NpespIRM0UmkTziwjgzSEwn12bfJ6q:I9F3QfTf9fIQsZ0UmYkKyJ6q
TLSH
T191F2AF71A8245EA34DF6EB8D7A47374BAEE0016381C52E489DD98F0D45C37AC271B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 ce200d1030a9642278365858680a9b7f2db3d44e45561eb54b0d5c277fcde9f9
MD5 2ea152a86aacb522e517d0826af92166
SHA1 415a3da2329bd1d72ae7cca6dbd4ed8270ed49eb
SHA512 2a69addd32ca9a86098f074836b4d284a5817f4b3430a65393ffb42481589afa4fc3610bb24f847ee1d7033d12240a6370efe73ca0e379821dbb99c4b7539df2
SSDEEP 768:Mj+9F3PJFfy4faifmtEA7NpespIRM0UmkTziwjgzSEwn12bfJ6q:L9F3bfTf9fIQsZ0UmYkKyJ6q
TLSH
T1F7F2AF71E8244EA34DF6EB8D7A47374BAEE0016391C52A48DDD98F0D45C379C271B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 d3fe3de2e307f43bab0d0a033ca2a8e6f8b35c15f39cbc4a747289c8fd9a213e
MD5 d1f949b2c44062edcc234d8a309c8fa9
SHA1 cf5cf0fc6e88b2d00759201fa88d6677334360d0
SHA512 727caebef046cfd0462004e650e053314b044fc66ff3091700b1fd1b69d437ed1a43a444b765ba1ca3952180aa74de2f661f16d81ee4a11959e2d9eecdb4e480
SSDEEP 768:3F1j+9U3gwgNhZcfy4faifmtFA7NpespIRM0UmkTziwjgzSEwn12bfJ6q:+9U3rfTf9fdQsZ0UmYkKyJ6q
TLSH
T1A8234AF194D38A77D9AE9B87677D2E0699FCC153B1841984BBD44D0CCC822BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5652_310289453\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 c44c12c5f14c0d3cd7cbe8523fb8fb0ba7ae4f34ab21db028f53dd768c40f382
MD5 54c73720b263ee4af954256e07dc8bf6
SHA1 8c01393927694de47216adb37a2d682fdc90de5e
SHA512 924c7c1d9a32b9048b45ae9b8c2134eb40ceb190429c468fb9bac0601e012adb6b3d23f62fe6bc38c6b3d1581f8cc6b49799d6c21574457c1eb0a38665033396
TLSH
T15C71008396BDC6F2C29A5FF102C35644F2BB223C076330240B956586EA70A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-198-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1356-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1356-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1652-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2240-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2420-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3276-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3424-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3460-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3564-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3680-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3932-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4276-506-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4452-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4808-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4864-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-489-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5920-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6012-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download