systex | d2e389c6d51bfead7f82527a670cfdd96a72fbb5f8984f2d615c1cc7cdbc88dd

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260702-tp8aeahv7s
SHA256 d2e389c6d51bfead7f82527a670cfdd96a72fbb5f8984f2d615c1cc7cdbc88dd
MD5 e6c332d0a6f24cb27901e6840fed1e53
SHA1 3beec803ff2500cdb9f322f448efcb5a36e563e2
SHA512 cf7f5b2877928e8b587c188b6df24596092bf84eefd39fc882a6baa928ff2b9fdde42fca56e5a3cbe0688382056dd166d564a75e65de0689fe9419bd3d7dfefb
SSDEEP 6144:HflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:HflfAsiVGjSGecvX
TLSH
T1F6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4768	ausmkfcxvpnhfzxs.exe
1820	ausmkfcxvpnhfzxs.sys
1808	CreateProcess.exe
5420	caurpnhcax.exe
2908	CreateProcess.exe
1684	CreateProcess.exe
4516	i_caurpnhcax.exe
2412	kecwurmkec.sys
4348	CreateProcess.exe
3276	ecwurmhecz.exe
1948	CreateProcess.exe
5668	CreateProcess.exe
1932	i_ecwurmhecz.exe
1952	omjecwuomg.sys
2484	CreateProcess.exe
3460	geywrojhbz.exe
1020	CreateProcess.exe
5564	CreateProcess.exe
2272	i_geywrojhbz.exe
4744	wtoljhbytr.sys
1452	CreateProcess.exe
5212	wtrljdbztr.exe
5764	CreateProcess.exe
2044	CreateProcess.exe
4516	i_wtrljdbztr.exe
4912	ywqoigbytr.sys
5772	CreateProcess.exe
4388	ljdbvtnlgd.exe
3916	CreateProcess.exe
5152	CreateProcess.exe
4900	i_ljdbvtnlgd.exe
5228	oigaysqolj.sys
4760	CreateProcess.exe
5252	oifdbytqlj.exe
2312	CreateProcess.exe
5336	CreateProcess.exe
1056	i_oifdbytqlj.exe
3468	kigaytnlid.sys
5932	CreateProcess.exe
2928	gaysqkicav.exe
6072	CreateProcess.exe
5084	CreateProcess.exe
3204	i_gaysqkicav.exe
2888	axspnkicau.sys
2868	CreateProcess.exe
5556	caxspnkica.exe
5916	CreateProcess.exe
2972	CreateProcess.exe
3976	i_caxspnkica.exe
2916	spnhfaxsqk.sys
4408	CreateProcess.exe
2736	uspkhfzurp.exe
2504	CreateProcess.exe
1708	CreateProcess.exe
4732	i_uspkhfzurp.exe
1420	CreateProcess.exe
3056	zxrpmkhczx.exe
2256	CreateProcess.exe
5776	CreateProcess.exe
4836	i_zxrpmkhczx.exe
2824	hbzxrpmhez.sys
5676	CreateProcess.exe
2340	ecwuomgezw.exe
3528	CreateProcess.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1975405733\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1975405733\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1975405733\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_2138079105\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_505270570\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_505270570\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1212089604\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1212089604\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3380_1975405733\llm_user_input_extractor_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmkecwuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oifdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eywqojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrljdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqligavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwurmhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gaysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkhfzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eywqojgebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbwtomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkicaxsqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oifdbytqlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caxspnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caurpnhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwurmhecz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrljdbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomgebzwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaysqkicav.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkhfzurp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmkecwuomk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caurpnhcax.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_caxspnkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbytqljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkicavsnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxvpnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpmkhczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbwtomywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqligavt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkicaxsqki.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1104	ipconfig.exe
1512	ipconfig.exe
2368	ipconfig.exe
1272	ipconfig.exe
5796	ipconfig.exe
4344	ipconfig.exe
5824	ipconfig.exe
5236	ipconfig.exe
4744	ipconfig.exe
2060	ipconfig.exe
4544	ipconfig.exe
3808	ipconfig.exe
2744	ipconfig.exe
3292	ipconfig.exe
1744	ipconfig.exe
2824	ipconfig.exe
3768	ipconfig.exe
6056	ipconfig.exe
600	ipconfig.exe
5360	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274825148302398"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{57C8D81E-59F2-4C50-A6B8-948AA910B534}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe
4768	ausmkfcxvpnhfzxs.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	4516	i_caurpnhcax.exe
Token: SeDebugPrivilege	1932	i_ecwurmhecz.exe
Token: SeDebugPrivilege	2272	i_geywrojhbz.exe
Token: SeDebugPrivilege	4516	i_wtrljdbztr.exe
Token: SeDebugPrivilege	4900	i_ljdbvtnlgd.exe
Token: SeDebugPrivilege	1056	i_oifdbytqlj.exe
Token: SeDebugPrivilege	3204	i_gaysqkicav.exe
Token: SeDebugPrivilege	3976	i_caxspnkica.exe
Token: SeDebugPrivilege	4836	i_zxrpmkhczx.exe
Token: SeDebugPrivilege	5524	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2380	i_eywqojgebw.exe
Token: SeDebugPrivilege	1760	i_jdbwtomywq.exe
Token: SeDebugPrivilege	2832	i_jgbytqljdb.exe
Token: SeDebugPrivilege	3088	i_aysqligavt.exe
Token: SeDebugPrivilege	3724	i_nkicavsnlf.exe
Token: SeDebugPrivilege	576	i_qkicaxsqki.exe
Token: SeDebugPrivilege	4476	i_pmkhcausmk.exe
Token: SeDebugPrivilege	4364	i_rmkecwuomk.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3380	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 4768	2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 2656 wrote to memory of 5028	2656	2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5028 wrote to memory of 3380	5028	iexplore.exe	90
PID 3380 wrote to memory of 3432	3380	msedge.exe	91
PID 3380 wrote to memory of 1404	3380	msedge.exe	92
PID 3380 wrote to memory of 2952	3380	msedge.exe	93
PID 3380 wrote to memory of 2952	3380	msedge.exe	93
PID 3380 wrote to memory of 2952	3380	msedge.exe	93
PID 3380 wrote to memory of 2460	3380	msedge.exe	94
PID 3380 wrote to memory of 2460	3380	msedge.exe	94
PID 3380 wrote to memory of 2544	3380	msedge.exe	96
PID 3380 wrote to memory of 2544	3380	msedge.exe	96
PID 3380 wrote to memory of 2544	3380	msedge.exe	96
PID 3380 wrote to memory of 6020	3380	msedge.exe	97
PID 3380 wrote to memory of 6020	3380	msedge.exe	97
PID 3380 wrote to memory of 6020	3380	msedge.exe	97
PID 3380 wrote to memory of 6068	3380	msedge.exe	98
PID 3380 wrote to memory of 6068	3380	msedge.exe	98
PID 3380 wrote to memory of 6068	3380	msedge.exe	98
PID 3380 wrote to memory of 1104	3380	msedge.exe	99
PID 3380 wrote to memory of 1104	3380	msedge.exe	99
PID 3380 wrote to memory of 1104	3380	msedge.exe	99
PID 3380 wrote to memory of 3204	3380	msedge.exe	100
PID 3380 wrote to memory of 3204	3380	msedge.exe	100
PID 3380 wrote to memory of 5464	3380	msedge.exe	104
PID 3380 wrote to memory of 5740	3380	msedge.exe	105
PID 3380 wrote to memory of 5464	3380	msedge.exe	104
PID 3380 wrote to memory of 5740	3380	msedge.exe	105
PID 3380 wrote to memory of 3776	3380	msedge.exe	107
PID 4768 wrote to memory of 1808	4768	ausmkfcxvpnhfzxs.exe	108
PID 5420 wrote to memory of 2908	5420	caurpnhcax.exe	113
PID 3380 wrote to memory of 1544	3380	msedge.exe	116
PID 3380 wrote to memory of 1544	3380	msedge.exe	116
PID 3380 wrote to memory of 5388	3380	msedge.exe	117
PID 3380 wrote to memory of 5388	3380	msedge.exe	117
PID 4768 wrote to memory of 1684	4768	ausmkfcxvpnhfzxs.exe	118
PID 4768 wrote to memory of 4348	4768	ausmkfcxvpnhfzxs.exe	122
PID 3276 wrote to memory of 1948	3276	ecwurmhecz.exe	124
PID 4768 wrote to memory of 5668	4768	ausmkfcxvpnhfzxs.exe	127
PID 4768 wrote to memory of 2484	4768	ausmkfcxvpnhfzxs.exe	131
PID 3460 wrote to memory of 1020	3460	geywrojhbz.exe	133
PID 4768 wrote to memory of 5564	4768	ausmkfcxvpnhfzxs.exe	136
PID 4768 wrote to memory of 1452	4768	ausmkfcxvpnhfzxs.exe	141
PID 5212 wrote to memory of 5764	5212	wtrljdbztr.exe	143
PID 4768 wrote to memory of 2044	4768	ausmkfcxvpnhfzxs.exe	146
PID 3380 wrote to memory of 4316	3380	msedge.exe	148
PID 3380 wrote to memory of 264	3380	msedge.exe	149
PID 3380 wrote to memory of 4304	3380	msedge.exe	150
PID 4768 wrote to memory of 5772	4768	ausmkfcxvpnhfzxs.exe	153
PID 4388 wrote to memory of 3916	4388	ljdbvtnlgd.exe	155
PID 4768 wrote to memory of 5152	4768	ausmkfcxvpnhfzxs.exe	158
PID 4768 wrote to memory of 4760	4768	ausmkfcxvpnhfzxs.exe	162
PID 5252 wrote to memory of 2312	5252	oifdbytqlj.exe	164
PID 4768 wrote to memory of 5336	4768	ausmkfcxvpnhfzxs.exe	167
PID 4768 wrote to memory of 5932	4768	ausmkfcxvpnhfzxs.exe	171
PID 2928 wrote to memory of 6072	2928	gaysqkicav.exe	173
PID 4768 wrote to memory of 5084	4768	ausmkfcxvpnhfzxs.exe	176
PID 4768 wrote to memory of 2868	4768	ausmkfcxvpnhfzxs.exe	180
PID 5556 wrote to memory of 5916	5556	caxspnkica.exe	182
PID 4768 wrote to memory of 2972	4768	ausmkfcxvpnhfzxs.exe	185
PID 3380 wrote to memory of 4848	3380	msedge.exe	187
PID 3380 wrote to memory of 4848	3380	msedge.exe	187
PID 4768 wrote to memory of 4408	4768	ausmkfcxvpnhfzxs.exe	193
PID 2736 wrote to memory of 2504	2736	uspkhfzurp.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e6c332d0a6f24cb27901e6840fed1e53_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Temp\ausmkfcxvpnhfzxs.exe
  C:\Temp\ausmkfcxvpnhfzxs.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caurpnhcax.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1808
  - - C:\Temp\caurpnhcax.exe
      C:\Temp\caurpnhcax.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caurpnhcax.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1684
  - - C:\Temp\i_caurpnhcax.exe
      C:\Temp\i_caurpnhcax.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwurmhecz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4348
  - - C:\Temp\ecwurmhecz.exe
      C:\Temp\ecwurmhecz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwurmhecz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5668
  - - C:\Temp\i_ecwurmhecz.exe
      C:\Temp\i_ecwurmhecz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2484
  - - C:\Temp\geywrojhbz.exe
      C:\Temp\geywrojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1020
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5564
  - - C:\Temp\i_geywrojhbz.exe
      C:\Temp\i_geywrojhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrljdbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1452
  - - C:\Temp\wtrljdbztr.exe
      C:\Temp\wtrljdbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5212
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrljdbztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2044
  - - C:\Temp\i_wtrljdbztr.exe
      C:\Temp\i_wtrljdbztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5772
  - - C:\Temp\ljdbvtnlgd.exe
      C:\Temp\ljdbvtnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4388
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5152
  - - C:\Temp\i_ljdbvtnlgd.exe
      C:\Temp\i_ljdbvtnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oifdbytqlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Temp\oifdbytqlj.exe
      C:\Temp\oifdbytqlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oifdbytqlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5336
  - - C:\Temp\i_oifdbytqlj.exe
      C:\Temp\i_oifdbytqlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gaysqkicav.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5932
  - - C:\Temp\gaysqkicav.exe
      C:\Temp\gaysqkicav.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6072
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gaysqkicav.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5084
  - - C:\Temp\i_gaysqkicav.exe
      C:\Temp\i_gaysqkicav.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\caxspnkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2868
  - - C:\Temp\caxspnkica.exe
      C:\Temp\caxspnkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5916
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_caxspnkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2972
  - - C:\Temp\i_caxspnkica.exe
      C:\Temp\i_caxspnkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkhfzurp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4408
  - - C:\Temp\uspkhfzurp.exe
      C:\Temp\uspkhfzurp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2504
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkhfzurp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1708
  - - C:\Temp\i_uspkhfzurp.exe
      C:\Temp\i_uspkhfzurp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpmkhczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1420
  - - C:\Temp\zxrpmkhczx.exe
      C:\Temp\zxrpmkhczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpmkhczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5776
  - - C:\Temp\i_zxrpmkhczx.exe
      C:\Temp\i_zxrpmkhczx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5676
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    PID:3800
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eywqojgebw.exe ups_run
    3⤵
    PID:5976
  - - C:\Temp\eywqojgebw.exe
      C:\Temp\eywqojgebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1512
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eywqojgebw.exe ups_ins
    3⤵
    PID:3844
  - - C:\Temp\i_eywqojgebw.exe
      C:\Temp\i_eywqojgebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbwtomywq.exe ups_run
    3⤵
    PID:3892
  - - C:\Temp\jdbwtomywq.exe
      C:\Temp\jdbwtomywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2940
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbwtomywq.exe ups_ins
    3⤵
    PID:2984
  - - C:\Temp\i_jdbwtomywq.exe
      C:\Temp\i_jdbwtomywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbytqljdb.exe ups_run
    3⤵
    PID:1584
  - - C:\Temp\jgbytqljdb.exe
      C:\Temp\jgbytqljdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbytqljdb.exe ups_ins
    3⤵
    PID:1056
  - - C:\Temp\i_jgbytqljdb.exe
      C:\Temp\i_jgbytqljdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqligavt.exe ups_run
    3⤵
    PID:1984
  - - C:\Temp\aysqligavt.exe
      C:\Temp\aysqligavt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2968
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1416
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqligavt.exe ups_ins
    3⤵
    PID:1336
  - - C:\Temp\i_aysqligavt.exe
      C:\Temp\i_aysqligavt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkicavsnlf.exe ups_run
    3⤵
    PID:1464
  - - C:\Temp\nkicavsnlf.exe
      C:\Temp\nkicavsnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3360
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1104
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkicavsnlf.exe ups_ins
    3⤵
    PID:5548
  - - C:\Temp\i_nkicavsnlf.exe
      C:\Temp\i_nkicavsnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkicaxsqki.exe ups_run
    3⤵
    PID:4540
  - - C:\Temp\qkicaxsqki.exe
      C:\Temp\qkicaxsqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkicaxsqki.exe ups_ins
    3⤵
    PID:4240
  - - C:\Temp\i_qkicaxsqki.exe
      C:\Temp\i_qkicaxsqki.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkhcausmk.exe ups_run
    3⤵
    PID:4496
  - - C:\Temp\pmkhcausmk.exe
      C:\Temp\pmkhcausmk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5936
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkhcausmk.exe ups_ins
    3⤵
    PID:4244
  - - C:\Temp\i_pmkhcausmk.exe
      C:\Temp\i_pmkhcausmk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmkecwuomk.exe ups_run
    3⤵
    PID:2272
  - - C:\Temp\rmkecwuomk.exe
      C:\Temp\rmkecwuomk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmkecwuomk.exe ups_ins
    3⤵
    PID:5264
  - - C:\Temp\i_rmkecwuomk.exe
      C:\Temp\i_rmkecwuomk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomgebzwro.exe ups_run
    3⤵
    PID:3484
  - - C:\Temp\uomgebzwro.exe
      C:\Temp\uomgebzwro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4744
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdff27c188,0x7ffdff27c194,0x7ffdff27c1a0
      4⤵
      PID:3432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,3074491260943176412,17286792167097196753,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
      4⤵
      System Time Discovery
      PID:1404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,3294212050772845919,14020309408567277890,262144 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
      4⤵
      PID:2952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,1191137854866118612,12098321503943398876,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:13
      4⤵
      PID:2460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,16961691096531379548,13401215856328230291,2097152 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,2481616741760782944,15873089578628595304,2097152 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,10359742140719094791,7201303141321455443,2097152 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:6068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,12989365990191528725,6423393941877626776,2097152 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,18251696878225590143,15445076108564766996,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
      4⤵
      PID:3204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,6951471807835320719,15669407610160606449,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:5464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,16226941421323003554,8931573038880951108,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
      4⤵
      PID:5740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6839886674052689467,15029264347403944967,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:4828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6839886674052689467,15029264347403944967,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,5455745765753928674,8248287209496997008,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,15051405006280228919,4559272670781699473,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,605233389031176773,18221908627787692166,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,2048459720445331122,6980784899902753685,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,10079445457925799508,12860188088327009276,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,6349446543653849987,10495544472209453452,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,16487669956116611258,1397692084338474377,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,12892911012419665019,17266516901350178658,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,12859306887743069937,10147513226691428538,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:1364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6068,i,6656247652197573832,4156504518538884824,262144 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:10
      4⤵
      PID:5768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,7043781966622503105,5050285145582247633,524288 --field-trial-handle=2596,i,11567001381468757362,17880066282938352467,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
      4⤵
      PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3484

C:\Temp\ausmkfcxvpnhfzxs.sys
C:\Temp\ausmkfcxvpnhfzxs.sys
1⤵
- Executes dropped EXE
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5300

C:\Temp\kecwurmkec.sys
C:\Temp\kecwurmkec.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\omjecwuomg.sys
C:\Temp\omjecwuomg.sys
1⤵
- Executes dropped EXE
PID:1952

C:\Temp\wtoljhbytr.sys
C:\Temp\wtoljhbytr.sys
1⤵
- Executes dropped EXE
PID:4744

C:\Temp\ywqoigbytr.sys
C:\Temp\ywqoigbytr.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\oigaysqolj.sys
C:\Temp\oigaysqolj.sys
1⤵
- Executes dropped EXE
PID:5228

C:\Temp\kigaytnlid.sys
C:\Temp\kigaytnlid.sys
1⤵
- Executes dropped EXE
PID:3468

C:\Temp\axspnkicau.sys
C:\Temp\axspnkicau.sys
1⤵
- Executes dropped EXE
PID:2888

C:\Temp\spnhfaxsqk.sys
C:\Temp\spnhfaxsqk.sys
1⤵
- Executes dropped EXE
PID:2916

C:\Temp\hbzxrpmhez.sys
C:\Temp\hbzxrpmhez.sys
1⤵
- Executes dropped EXE
PID:2824

C:\Temp\mgecwjgbyw.sys
C:\Temp\mgecwjgbyw.sys
1⤵
PID:5548

C:\Temp\gdbzwqomjh.sys
C:\Temp\gdbzwqomjh.sys
1⤵
PID:1388

C:\Temp\igdywqoigb.sys
C:\Temp\igdywqoigb.sys
1⤵
PID:1284

C:\Temp\avsqoigays.sys
C:\Temp\avsqoigays.sys
1⤵
PID:1896

C:\Temp\daysqkidav.sys
C:\Temp\daysqkidav.sys
1⤵
PID:1284

C:\Temp\nkfdauspki.sys
C:\Temp\nkfdauspki.sys
1⤵
PID:4748

C:\Temp\pkhfzxuspk.sys
C:\Temp\pkhfzxuspk.sys
1⤵
PID:3960

C:\Temp\omkezwrpmh.sys
C:\Temp\omkezwrpmh.sys
1⤵
PID:2472

C:\Temp\wurpjhezwu.sys
C:\Temp\wurpjhezwu.sys
1⤵
PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkfcxvpnhfzxs.exe

Path C:\Temp\ausmkfcxvpnhfzxs.exe
Size 361KB
SHA256 37670b4fb0b422b6b52adc0101f01358690ad0aa0a110812bf9232f6e08ab86a
MD5 281c578f92fed5b2cdfa3874cb523b00
SHA1 1c649bebbf6edc10316b9429d247d5fbe40dbb6c
SHA512 a1058e4fe31ff780e4232149a0205fbc66d46a0d2c0458d36f7c46d8f1d44f751dc5b54b3f546829debea635f13efa1068774479f2932554984fcba005f82d84
SSDEEP 6144:IflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:IflfAsiVGjSGecvX
TLSH
T197747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ausmkfcxvpnhfzxs.sys

Path C:\Temp\ausmkfcxvpnhfzxs.sys
Size 293KB
SHA256 60f9f90dcc22c12db320f9163389cff4c6bcc3c82a979111d4cdc87e02c5e7f1
MD5 d5aadd642fdc2e9ef24f247ed4a4ff63
SHA1 b2d520f1277235a8394ea08e97667c35bd78e13b
SHA512 82cb464f010270caeec4e03202c982c475fe589b3576844ff7cefb3e32a581a1abf24b88a6e50bc5b88055cbd9e8c0f8f85ee6882cf1e02a5cf78636e03a378c
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caurpnhcax.exe

Path C:\Temp\caurpnhcax.exe
Size 361KB
SHA256 c5f2b7f11b7f537f2e630e095d63f60a76b6799e2083650a46281cd281b259e9
MD5 25931581a50e0821b2b702bfa7fde006
SHA1 735c0e78595ab714baed488516afd9de8c2f8f64
SHA512 6345cfdf419477c7759d8ac733acf8e5a477689a980db49fa299d08b559ee8de8f1a55b6cc02b920d4f4c40a692f5b740a6bbfdccb7b598e0e5e2a9b650b7aaa
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T14D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmhecz.exe

Path C:\Temp\ecwurmhecz.exe
Size 361KB
SHA256 50871f3f1479af2cf6e80d497a322031e7fcee2f326c8df99522c78d8d4b5138
MD5 7327b978c6c63d4892ba14bc41b0b820
SHA1 435ee99d613f2e5b085e3f1dd955d15f036b902f
SHA512 8238de9688a0fe6ad825ceeb8bb537fcc92656f18e7c2e3a8071d70f678dc6bd239ec5946fe5edc7bdc3c071e6a020657d2622f6cb2727ee0ddb55a6a7a6b665
SSDEEP 6144:GflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:GflfAsiVGjSGecvX
TLSH
T131747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojhbz.exe

Path C:\Temp\geywrojhbz.exe
Size 361KB
SHA256 a301a2686d435b8c0d422c6a23f0c99d94cc0eacc7c4aceb9df7365ba3fc40c4
MD5 3cb21fda81974c68060073f5529af295
SHA1 8372c88bc924c4416b83b6bffc6386c33ef22837
SHA512 8734b91245967807bc1d008aa073cc60438834a5e7479de5016d5ad98d1bd1cb96f69c715305dcb8dd911a8f48b5b3190b8cedc2d799cb42cc04885ef97bd3d0
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_caurpnhcax.exe

Path C:\Temp\i_caurpnhcax.exe
Size 361KB
SHA256 7216205526891bb671c158b5f041d6b8defa0f76c7a0317510c99468f6857c7d
MD5 ab4318bbe7a8c4f6308604604dd193e2
SHA1 ce0693e640fb451b0d4e0734897c722222b83677
SHA512 610b288d7b0c9216eb988d75d317c13e04f6daea93da0957a3a95aa66100531733fed53f4a8be5fdd61c882c1308f07af3e5bec1a0e4327c41d43d3da8ae2ac1
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1DD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwurmhecz.exe

Path C:\Temp\i_ecwurmhecz.exe
Size 361KB
SHA256 5c3641f8e6805ac27afc1eff5e4710e7ae22401c98860975b731ec7d078617cc
MD5 4b78c47467434b848830124ad03d9183
SHA1 478ff3c82750d0242fa99a00a41621afc1e2e293
SHA512 10e91f5a912d2f13eb49f32b0b566e0e7913ad6c3c2d1fdea8016145c1828c1de89954d460679879f45cfa2a48ba7b85bd053a6cd2f84b1dc30239872ca26b56
SSDEEP 6144:kflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:kflfAsiVGjSGecvX
TLSH
T1E3747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojhbz.exe

Path C:\Temp\i_geywrojhbz.exe
Size 361KB
SHA256 beb040993cac4cc416010ff5078791e55bd7b32190cf3dca475da668c5bccc8e
MD5 c0d5bf115fa21288c7464615385852d1
SHA1 72b4fc82b3dc25fe37ee624543afa73e82c1a5bc
SHA512 6c338599804b12a1747a7f1c3d45175faeb673fb2d6e6e432d6961adad17c5a1eff6bf79273a789b7013fcfce092482b06ece466acce99fdf0c266639ca45c84
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbvtnlgd.exe

Path C:\Temp\i_ljdbvtnlgd.exe
Size 361KB
SHA256 4239a82eecc023c28609394b8324c2ec8c1036b408004f260f860acde4476007
MD5 2737f10edc735d38e37b35bb0536776e
SHA1 1dda2c512f2421b392cfd75e51f592d377285ac1
SHA512 1712da231f290ead69a94f3b4117b902722c8e820246a22827923fead27ee3bb6bea4d3c7ac874a88f1f523c4ef62b52b9ebce28464c494282f38d89061c12d2
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T1D6747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wtrljdbztr.exe

Path C:\Temp\i_wtrljdbztr.exe
Size 361KB
SHA256 e63c8182f9a1e242a4152ece251d3f0c88201b831a48046e1b41c65c9136036a
MD5 2f251d4de19f31b5ec58b79f32bdb86f
SHA1 a3f69dece1130bd47e67fec858bfe35e46266bea
SHA512 34fab4d531f7a1198f4cbd07635c031df4ec62674513b0529cdece9897f4fba7fe77fcccb299aef93cf9084e7be614c7b44750002abe563aeb4cf21d4eab147d
SSDEEP 6144:xflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:xflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kecwurmkec.sys

Path C:\Temp\kecwurmkec.sys
Size 293KB
SHA256 744a7c2884cd5516f4bbdb1747f5d9cc4adb519fb3bf6d4190664d104fb7bccf
MD5 e86bb8cd96bfb5506fa4bc345f25f2c1
SHA1 1e5c646617fddd19067fb8d25eb538e94b05292b
SHA512 9d101dd9dfe04e07a767150791600d4f49c125ca30088be56747d7fbc6711f30f9e2aa48f00cb9bfd238e615ce5f76aa97736b13175e3b427f3a1b317155e5cd
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbvtnlgd.exe

Path C:\Temp\ljdbvtnlgd.exe
Size 361KB
SHA256 3a98dea0804c2adeede98ebe37922877c9f8a1b08df5a144b72527101937c5ae
MD5 61443fea841affc29300c115abfed3e1
SHA1 25c2e80ea5f0d5909262f6f35eef68d8a61742d5
SHA512 21ed07040b889344fe9454e91f7bbe27ea7110f2106c9b73058b9d03d936cb609b595f83bc9f1706f27cebbf047ff129b2160ebb0b2e2830e08cd8fcb6692aff
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T18A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oifdbytqlj.exe

Path C:\Temp\oifdbytqlj.exe
Size 361KB
SHA256 56aaca23c3ec2ea2339083d932465e61d447d2423de88af6420082b3d7d2b3e4
MD5 aba69c3c5d76ebfacdf4646299d37b1c
SHA1 51b67c9594681cf85189c189ea1a34d62ffe3495
SHA512 4e6a2da2e8b7ffbb9fdac49f9ea306da3e38a4aaa8033fddb002860741dcf5cbdeed8f8faa0d4bfadfd098092d64227dd3a452acdd29beef05776d01d44c0a44
SSDEEP 6144:tflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:tflfAsiVGjSGecvX
TLSH
T19C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oigaysqolj.sys

Path C:\Temp\oigaysqolj.sys
Size 293KB
SHA256 d1998746ae1b8aee01e8e72b978c604e343084e9cf3e2ebd0011ec86710db327
MD5 716951a55fa03e6e19ba783c5f807118
SHA1 6c5ccdcb9c4c55f04276cee7f5a33c9dcd970a3b
SHA512 86c6022783dd81675eb549ae4a12e4b67f530cca89b682e717a6e000e5e042d72d9dc4648274cc932311f05ddb4cb24ffcda0daf93c96fecbd2a499043f9416d
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T10D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjecwuomg.sys

Path C:\Temp\omjecwuomg.sys
Size 293KB
SHA256 94bd57833325e362f69ad58e1c35de14a28308dd08314f4e406e84def244766a
MD5 f2c100e1ed7f38ecc0a09a8ff08f3808
SHA1 3573b3cf7c230d285b8eec670b8758fab081b152
SHA512 ac44c4885dabe71000b7594dc6338e20ef1d8097da69fd1888dfffd5d2ee95888275d81441d314cf6cf152e7f7172cc72caf48d7c8524b2cd9256af89ffc6fa2
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T15D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtoljhbytr.sys

Path C:\Temp\wtoljhbytr.sys
Size 293KB
SHA256 9b3e970fc6251eb9be7fd6a27a70babf7ff46f33c776d4b39196dcd3235cd955
MD5 038a014df35941879a32715694cf2ca1
SHA1 726449b141bb38e5573b0dbe67a3fdb4d727cb9a
SHA512 59940f3b4ecf82cb2c9852be0e8053824f387a0173a7160e7b666c53b696326ca2b2878a16460035e4ebb0f129e181faec06177015e6adb37aa919fddb0e69dc
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbztr.exe

Path C:\Temp\wtrljdbztr.exe
Size 361KB
SHA256 57d595110876592dbcc28d96b8f4caac216d9b2c6ca2a7e1cd2391740f098ce7
MD5 368c69337956897eb93834b59b8c671f
SHA1 dffafad2cebace0577bc2b2a897d2f94bfbeef35
SHA512 852e19303ff5cc4cfb6256f36b6399cc7edec67c0bd4b9ad54702e345c780b0ca64516daa177cfdc669c0748de637ecbcb36fea479bb4a200f25a3c7fe377a12
SSDEEP 6144:WflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:WflfAsiVGjSGecvX
TLSH
T1F5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywqoigbytr.sys

Path C:\Temp\ywqoigbytr.sys
Size 293KB
SHA256 50435fd816c772dbd975023fdcc2e1a3707c2d1cde79df84b67f3910a2e59684
MD5 71c7e4a9053eec0037eb0f7e0bdbb4c1
SHA1 4058bf0dc1e4a3104608c9b41264dd3d0fa1411b
SHA512 6a7ba3a4f8f53b798da9513d6b5dbfbcec25efe19d50ce90dba9451346e573deb5d1b3ee18116640f7867618291e5b4358e4e02222bd1ee94f5e86f38d094a77
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

345a8268-9fcf-4337-ab69-9b3bc3a3657d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\345a8268-9fcf-4337-ab69-9b3bc3a3657d.tmp
Size 14KB
SHA256 e6fa5927cb9231a06a29cdc31362966bf1e2e4a677f8cb53042436c9a290eb4f
MD5 006328a72630422169c99429e1dcb6ee
SHA1 63171e4ee0f6b7e5d0ae826444c326bc59146a08
SHA512 cec02a1b8c63abe3193566af00d11d185fece183f836143585e8760b814f4d42557426442d89e329507176ea55dc3318ef73a1dd27cc284f89162f954e503b7e
SSDEEP 192:sxRPRRyM/jK1Ml8wcU/fEsnefXeZ1mMzoA8p9T/g6+WNCGb/YyhJ4GgIgDiJ:sxRPjCU/fEsnefY1m9x/5T/xgi
TLSH
T1AE62E915AA345D77CCDBD209FA457F53D6F91463A2901E48A9FC8B0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6beb11c3cac76475a51aa9756ad6e16345de427551f396a7c537ac3919c0a71
MD5 76120ac501789741b74994968b7109b8
SHA1 bf313474c40e148188ca24b634ca202f4c9e5e6e
SHA512 44658c501890bb46bc5f2fd8a178f3f46cb7e3b19e40bdb2e0207875fca9e207929f83403c1524c681ae2f73ddf7359b458c0057f8aa1d229dd76506e6a3522e
TLSH
T1117192DA38E70A21E3D700B760F6678A33F08CBD60872E245389AF37A40E704E0C211D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595097.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595097.TMP
Size 3KB
SHA256 3d358925ec092e9e2773eaf781d4031ed6c9c2052a8372b0b214b40efb5529e7
MD5 e6e1c5d80f278659639ec65c038d267e
SHA1 701b1ecc637a508f68eb9380420bbb07df8bad1c
SHA512 d5efd77ddefcefc84e35e236602213052d92d33a9a9af10405541937d6c779d146d64d543af6baf0ace8560bbab5afe2ca6f953e358bfefd7e9048d6b3df28b4
TLSH
T1567172D938D70A21E7D740B760F6678A33F09CBD61872E255789AF37A40E704E0D215D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 157214e5fa5e712c06678cf15eada34d243de23c0d3cc814eadc98569f2acc24
MD5 8c532f5bbdefc40dbca2cdfc29ce6cac
SHA1 fdb99326c8bdd4785b74a8a0cc44e28a9d254238
SHA512 babf32bea24527be489948c41706c3997a97a4b1e8f195e907265e5de7547fe9f0b40eff39c78a24a15c047da37a4bc80e3116cebc1c49c091a1e16b53f08bd4
TLSH
T16D51ADF7C3E8852D891196F0BA146E2BCE2D0914832C7D5AC9E4AF1B93E3472E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fe08e5c97c4ba3a677b8e03c1bc67671c91cf0e288b21abb6a5bcb0064734ada
MD5 6a09dbbe9cf564bbab2671b875d4278e
SHA1 10faeb93d592f5e3788114ea34381f4def246a72
SHA512 f2ae9bb6db382be2fe49a4283f5ceba1f816add6c9139c5490a4a8b2d15d79b72a6d2b314f7bd0ba1ce79c816fb4ef982c9757116d1af41796ec15be4ff4fce4
SSDEEP 192:sxRYRRyM/jK1Ml8wcU/fEsCefXeZ1mMzoA8p9T/g6+WNCGb/YyhJ4GgIgtJ:sxRYjCU/fEsCefY1m9x/5T/xg3
TLSH
T1FD62E815AA249D77CCDBD209FA557F53D6F91463A2901E08AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 872d57e5188b78f0c61da07d9054314da918cbe828c36f12e7cb6b2bccc8caad
MD5 6b3c465bf05de1ac4a5b624467ad0c96
SHA1 c64272d8f29ff59c8321a9f1addea22e8bd52c30
SHA512 bed7d60b70f59fcec455a43c37f912df21213e7ef43346590c67374ddc620179b379f01bb9360954923b18c96e4d0870ef0cc90833776a4ff96c421f62a49b85
SSDEEP 192:sxRPRRyM/jK1Ml8UQUcU/fEsnefFeZ1mMzoA8prT/g6+WNCGb/Yy1J4GgIgDUJ:sxRPjqzU/fEsneNY1m9n/5T/Vg8
TLSH
T1A562D916AA245D77CCDBD209FA517F53D6F91463A2901E08AAFC8B0C01E7ADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 f535a64fe318be2928637aaa9b2aa0b851d5aea08d640f5f0505213000d8fd48
MD5 6ee121c071eaa715daf92ece06ec2c7b
SHA1 38c98482e1105765f8a7d64fe2d6febc626f05d4
SHA512 62c6da9a173939a9cde414f4be142b1c117f0b4a658fdee8eceebda5a161747ec425cdbe66d437d0bdca4c5fbfc184deb1f61e39d63891db5b43f7f06a9c3db0
SSDEEP 768:AIox/O7pLuL7p0WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OViZgcciqro5sl6C:AIox/OE7p0WguMfnAu1jadZgXiB5sR
TLSH
T172E2EB3B680CCB7E4F80499CEC29BE9A6DA801CF96D8CD5447FA841C03C66EF56165DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5742a56292bc5720921263519f29162e7430715475b3d3fd77c7f7e028d74862
MD5 c1869016d24b8a2b6e009733f0e1cce5
SHA1 b27e089e7c2fd88172372c31e9ebd3a00c0110d5
SHA512 ca8f3cb834e0964bba4f5a567c1186e88c2fece21a186af254a621fd2e106bf14617450f547b25be177366d4082008af9469acaac28a8f89ddc9cc093e6036ed
SSDEEP 96:KAleKuoCCQgKt279KD3tHHDW3EygrDK4aglDcJh8fnAHLURlTe:8Rzu9KD3tHHS3EzrZaglwJh8fnAHLURI
TLSH
T1D9914B0672BA1BC0397D254D92B8887F52C230E230A7F52B3B6851E15F26E525FFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ebfc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ebfc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e2d08c952a17734eecee32e80fdccb56cc8fec6ca0f6ddd7c44c5bed0f13abfe
MD5 1e1340d1c8338069dbbc92585abb78f3
SHA1 7a8aa3379145f05e4963fd0f83a9cc762461dd39
SHA512 bd92602e9e3ac58d839028ae81ae80ff203182ba8d4767a56f1c280bbcea02f8965945e7351bcfb7b689390f535a2d5c431de8f0097bfcc4022be53bece395a1
SSDEEP 768:9rv+4UNbdF3ha4QOJIm0l/hUAFjQIMyOV3N5E9MF4+8r0mL:9bsbf3ChNFUIpONNmPDrv
TLSH
T1B003BF32E8A4DAB39CFBD6C5760672437FF401A395C50A84C9DE6B0C824B5DD231BC62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 de8130688191d849b2b48c17cbea7355d869daf7e37730bd4c4bdc9e073e8c7a
MD5 9f093f7bfa949e1b84175e12c430d9bb
SHA1 d39a1de5241ed493c12e51e934436e17d6de5eed
SHA512 13025811dc4b5d11cd8ee046e6c0e0e12498300b8bc9dec7da27c38469c6ff19f5251d0e528164045150c6a05836b83424fa421a9d417b224b457e3a52c9e959
SSDEEP 768:7j+9f3s+xWQOJIm0Qr/hUAFjQIMyOV3N5E9EOYDl8BvTPaL:u9f3uhNFUIpONNm5YDl0WL
TLSH
T1A0F29D71B891CEA34CFAD3C9B6166687AFF401B798852D84CADD6B0C458339D134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 67a0ac5dbee244460cc26f89692133ed8cff25fd99d839f6fd23fa24caf9ea49
MD5 335f3df9b8eb4ad26f34a7d93c3c8507
SHA1 7319adc6284da6340ad43838884d27c187a3c328
SHA512 72caf0ab0fdc145981b91ae023329c1733d04334c5fa3b4e273346f7b86e917039ce324ea052bf80e9f127e60866c9d7d06ff7286fd433c5aa8707f603ba699b
SSDEEP 768:aj+9f3/+xWQOJIm0Qr/hUAFjQIMyOV3N5E9EOYDl8BvTPaL:Z9f3XhNFUIpONNm5YDl0WL
TLSH
T162F2AE71B891CEA34DFBD3C9B6166687AFF401B798852D84CADD6B0C458339D134BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 f10c9ab6ecabe85ead8f510fe8d1250d82a3f7c9a543bda04e05457edf3d54dd
MD5 fda21f3e8ad3cfb6763dcf9887ec7cd9
SHA1 e188dadd21c4f10b017e6d83ccf198321616c1d5
SHA512 86b2ef8bc69374033d1e0a0a6350a159c0e158d3a0adefdc2aa4430796c461121178124f4701bcf0548d327205230bfdb7fad0614a0fa979a26413fba1b61026
SSDEEP 768:hrv+4UNbdt3E+DWQOJIm0QV/hUAFjQIMyOV3N5E9EOY6:hbsbz3khNFUIpONNm5Y6
TLSH
T1B203BF31B894DEB38DFBD285B616B6837FB411A748C10A88C9DE6B4D46472DD234FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 097f9fa9f31237d846cc7f15ac7fbf03519536e62ea396835eba4855737ebb57
MD5 bb632bb5631f6967bbb1f822f2774470
SHA1 810f146056e4026454dd49e84d0d874ba722146b
SHA512 c4807cd2c69359b41a7658ee82b1e70098af3306124a1538c70b9c410c6c1525b8259c1fa3b8a4267afaca3cd553d016b4ce29f0342e8ce8f3a7392155c5c08e
SSDEEP 768:SXF1j+9530wgJ+KKrOJIm0QI/hUAFjQIMyOV3N5E9EOYDl8BvTPaL:x953lhNFUIpONNm5YDl0WL
TLSH
T12F1328F198D3CA76D8AE9787A73D6E469ABCC16374845884B7C95E0CCC822BFC346C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

a49b1ff9-50b4-4c3b-ba57-7414615fade2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a49b1ff9-50b4-4c3b-ba57-7414615fade2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3380_239821564\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 5aac3bf027a2241ba84f542ca2c07e37a84c8a0d2c713d1073fac73d95d23ade
MD5 4a4fa5b5526ba928357ef59481ed85da
SHA1 c662097fc3c65c1d9cb012f441b71c0a3b69a914
SHA512 dbf145b9bf5eff4e28577ed2b019722bdd4cdd5d4597720d643d05ea57db821060a351d0bbb5a5a857426a2fca19b6d5bbf129743e3a951e8b9792edfdd59bf3
TLSH
T19071008356A9CAB2C19A5FF002835248F6FB2278076320204B52568AAA34B7A54B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1284-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1284-455-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1388-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1820-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1896-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1952-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2472-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2824-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2888-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2916-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3468-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3960-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4192-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4744-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4748-473-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5228-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5548-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download