systex | 222e7df08abb75d5a89a4ba320f7cf36054abcef43b8d7c47cc866417a058341

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260703-3p2bjadv5m
SHA256 222e7df08abb75d5a89a4ba320f7cf36054abcef43b8d7c47cc866417a058341
MD5 e479b54df2fdf7cb2ea31161476fd780
SHA1 e55b03a60febdf4244240648d4e4141614776566
SHA512 00d623f48cdb6fd769849722666bc1828d6615b7112e172d711f4147d3f6f3f6c13430fdfb58fb84fe5292c27c7bc85c20c3b6ee72f2322196cca4dbf5409ca5
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1BD747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3176	pkicausmkifzxvpn.exe
1068	pkicausmkifzxvpn.sys
2996	CreateProcess.exe
5440	rpnhfzxvpk.exe
6088	CreateProcess.exe
4984	CreateProcess.exe
4776	i_rpnhfzxvpk.exe
4852	upmkecwusp.sys
6044	CreateProcess.exe
1696	pjhfzxrpjh.exe
4996	CreateProcess.exe
4740	CreateProcess.exe
5040	i_pjhfzxrpjh.exe
5656	ecwurpjhcz.sys
5764	CreateProcess.exe
2960	uomheztrpj.exe
2876	CreateProcess.exe
2228	CreateProcess.exe
2964	i_uomheztrpj.exe
2844	pmgezwrojh.sys
5996	CreateProcess.exe
2936	omgebwurmj.exe
1028	CreateProcess.exe
256	CreateProcess.exe
5544	i_omgebwurmj.exe
4612	jdbywrojgb.sys
920	CreateProcess.exe
5844	bvtrljdbwt.exe
4412	CreateProcess.exe
4584	CreateProcess.exe
2208	i_bvtrljdbwt.exe
4092	qnlgdbvtqo.sys
120	CreateProcess.exe
6036	nljgbytnlj.exe
3384	CreateProcess.exe
5584	CreateProcess.exe
4956	i_nljgbytnlj.exe
5388	yvqnigdyvt.sys
4324	CreateProcess.exe
2964	nigaysqlid.exe
5220	CreateProcess.exe
1908	CreateProcess.exe
2252	i_nigaysqlid.exe
5340	pnifaysqki.sys
1236	CreateProcess.exe
3860	nifdaysqki.exe
2440	CreateProcess.exe
2776	CreateProcess.exe
6076	i_nifdaysqki.exe
5232	sqkicausnk.sys
1860	CreateProcess.exe
2580	faxsqkicau.exe
3052	CreateProcess.exe
5024	CreateProcess.exe
5632	i_faxsqkicau.exe
4756	cxusmkhcau.sys
5160	CreateProcess.exe
2540	xusmkhczur.exe
4076	CreateProcess.exe
2240	CreateProcess.exe
3856	i_xusmkhczur.exe
5892	khczusmkec.sys
5308	CreateProcess.exe
3056	zwrpjhbztr.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_1828434126\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_1828434126\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_1828434126\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_1058229045\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_1828434126\office_endpoints_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_804693500\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_804693500\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_539658576\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3876_539658576\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomheztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpnhfzxvpk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdywqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nljgbytnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	usmkfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomheztrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgebwurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkhczur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqoigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhfzxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqoigayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nljgbytnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdaysqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_usmkfzxspk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrpjhbztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfcxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkicausmkifzxvpn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5840	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5736	ipconfig.exe
1968	ipconfig.exe
5504	ipconfig.exe
3368	ipconfig.exe
800	ipconfig.exe
992	ipconfig.exe
5576	ipconfig.exe
5660	ipconfig.exe
5732	ipconfig.exe
4508	ipconfig.exe
3392	ipconfig.exe
2384	ipconfig.exe
5688	ipconfig.exe
5436	ipconfig.exe
4808	ipconfig.exe
5436	ipconfig.exe
5224	ipconfig.exe
464	ipconfig.exe
6032	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275957399792726"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{5905BBE0-9E31-4305-9B5A-C112BBFA1B9B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe
3176	pkicausmkifzxvpn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe
3876	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	i_rpnhfzxvpk.exe
Token: SeDebugPrivilege	5040	i_pjhfzxrpjh.exe
Token: SeDebugPrivilege	2964	i_uomheztrpj.exe
Token: SeDebugPrivilege	5544	i_omgebwurmj.exe
Token: SeDebugPrivilege	2208	i_bvtrljdbwt.exe
Token: SeDebugPrivilege	4956	i_nljgbytnlj.exe
Token: SeDebugPrivilege	2252	i_nigaysqlid.exe
Token: SeDebugPrivilege	6076	i_nifdaysqki.exe
Token: SeDebugPrivilege	5632	i_faxsqkicau.exe
Token: SeDebugPrivilege	3856	i_xusmkhczur.exe
Token: SeDebugPrivilege	5408	i_zwrpjhbztr.exe
Token: SeDebugPrivilege	1856	i_omhezxrpjh.exe
Token: SeDebugPrivilege	5880	i_ojgbztrljh.exe
Token: SeDebugPrivilege	3828	i_vtnlgdywqo.exe
Token: SeDebugPrivilege	5228	i_avsqoigayv.exe
Token: SeDebugPrivilege	5432	i_avsnlfdxvt.exe
Token: SeDebugPrivilege	3724	i_avsnkfcxvp.exe
Token: SeDebugPrivilege	1788	i_usmkfzxspk.exe
Token: SeDebugPrivilege	5640	i_mkeczurpjh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 3176	5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5284 wrote to memory of 1152	5284	2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 1152 wrote to memory of 3876	1152	iexplore.exe	90
PID 3876 wrote to memory of 6060	3876	msedge.exe	91
PID 3876 wrote to memory of 5840	3876	msedge.exe	92
PID 3876 wrote to memory of 5084	3876	msedge.exe	94
PID 3876 wrote to memory of 5084	3876	msedge.exe	94
PID 3876 wrote to memory of 5076	3876	msedge.exe	93
PID 3876 wrote to memory of 5076	3876	msedge.exe	93
PID 3876 wrote to memory of 5076	3876	msedge.exe	93
PID 3876 wrote to memory of 2012	3876	msedge.exe	95
PID 3876 wrote to memory of 2012	3876	msedge.exe	95
PID 3876 wrote to memory of 2012	3876	msedge.exe	95
PID 3876 wrote to memory of 2732	3876	msedge.exe	96
PID 3876 wrote to memory of 2732	3876	msedge.exe	96
PID 3876 wrote to memory of 2732	3876	msedge.exe	96
PID 3876 wrote to memory of 5696	3876	msedge.exe	98
PID 3876 wrote to memory of 3384	3876	msedge.exe	99
PID 3876 wrote to memory of 5696	3876	msedge.exe	98
PID 3876 wrote to memory of 5696	3876	msedge.exe	98
PID 3876 wrote to memory of 3384	3876	msedge.exe	99
PID 3876 wrote to memory of 3384	3876	msedge.exe	99
PID 3876 wrote to memory of 1504	3876	msedge.exe	100
PID 3876 wrote to memory of 1504	3876	msedge.exe	100
PID 3876 wrote to memory of 3408	3876	msedge.exe	101
PID 3876 wrote to memory of 3408	3876	msedge.exe	101
PID 3876 wrote to memory of 3408	3876	msedge.exe	101
PID 3876 wrote to memory of 4252	3876	msedge.exe	103
PID 3876 wrote to memory of 4252	3876	msedge.exe	103
PID 3876 wrote to memory of 4252	3876	msedge.exe	103
PID 3876 wrote to memory of 2488	3876	msedge.exe	107
PID 3176 wrote to memory of 2996	3176	pkicausmkifzxvpn.exe	108
PID 5440 wrote to memory of 6088	5440	rpnhfzxvpk.exe	113
PID 3876 wrote to memory of 5712	3876	msedge.exe	116
PID 3876 wrote to memory of 5712	3876	msedge.exe	116
PID 3876 wrote to memory of 5528	3876	msedge.exe	117
PID 3876 wrote to memory of 6084	3876	msedge.exe	118
PID 3876 wrote to memory of 5528	3876	msedge.exe	117
PID 3876 wrote to memory of 6084	3876	msedge.exe	118
PID 3876 wrote to memory of 696	3876	msedge.exe	119
PID 3876 wrote to memory of 696	3876	msedge.exe	119
PID 3176 wrote to memory of 4984	3176	pkicausmkifzxvpn.exe	120
PID 3876 wrote to memory of 6104	3876	msedge.exe	122
PID 3876 wrote to memory of 6104	3876	msedge.exe	122
PID 3876 wrote to memory of 6104	3876	msedge.exe	122
PID 3176 wrote to memory of 6044	3176	pkicausmkifzxvpn.exe	125
PID 1696 wrote to memory of 4996	1696	pjhfzxrpjh.exe	127
PID 3176 wrote to memory of 4740	3176	pkicausmkifzxvpn.exe	130
PID 3176 wrote to memory of 5764	3176	pkicausmkifzxvpn.exe	134
PID 2960 wrote to memory of 2876	2960	uomheztrpj.exe	136
PID 3176 wrote to memory of 2228	3176	pkicausmkifzxvpn.exe	139
PID 3176 wrote to memory of 5996	3176	pkicausmkifzxvpn.exe	144
PID 2936 wrote to memory of 1028	2936	omgebwurmj.exe	146
PID 3176 wrote to memory of 256	3176	pkicausmkifzxvpn.exe	149
PID 3876 wrote to memory of 1708	3876	msedge.exe	151
PID 3876 wrote to memory of 1088	3876	msedge.exe	152
PID 3876 wrote to memory of 6132	3876	msedge.exe	153
PID 3176 wrote to memory of 920	3176	pkicausmkifzxvpn.exe	156
PID 5844 wrote to memory of 4412	5844	bvtrljdbwt.exe	158
PID 3176 wrote to memory of 4584	3176	pkicausmkifzxvpn.exe	161
PID 3876 wrote to memory of 1828	3876	msedge.exe	163
PID 3876 wrote to memory of 1828	3876	msedge.exe	163
PID 3876 wrote to memory of 1828	3876	msedge.exe	163
PID 3176 wrote to memory of 120	3176	pkicausmkifzxvpn.exe	166

C:\Users\Admin\AppData\Local\Temp\2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_e479b54df2fdf7cb2ea31161476fd780_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5284
- C:\Temp\pkicausmkifzxvpn.exe
  C:\Temp\pkicausmkifzxvpn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpnhfzxvpk.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2996
  - - C:\Temp\rpnhfzxvpk.exe
      C:\Temp\rpnhfzxvpk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5440
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpnhfzxvpk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4984
  - - C:\Temp\i_rpnhfzxvpk.exe
      C:\Temp\i_rpnhfzxvpk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhfzxrpjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6044
  - - C:\Temp\pjhfzxrpjh.exe
      C:\Temp\pjhfzxrpjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1696
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhfzxrpjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4740
  - - C:\Temp\i_pjhfzxrpjh.exe
      C:\Temp\i_pjhfzxrpjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomheztrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\uomheztrpj.exe
      C:\Temp\uomheztrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomheztrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2228
  - - C:\Temp\i_uomheztrpj.exe
      C:\Temp\i_uomheztrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgebwurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\omgebwurmj.exe
      C:\Temp\omgebwurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3392
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgebwurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:256
  - - C:\Temp\i_omgebwurmj.exe
      C:\Temp\i_omgebwurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtrljdbwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:920
  - - C:\Temp\bvtrljdbwt.exe
      C:\Temp\bvtrljdbwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtrljdbwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4584
  - - C:\Temp\i_bvtrljdbwt.exe
      C:\Temp\i_bvtrljdbwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nljgbytnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:120
  - - C:\Temp\nljgbytnlj.exe
      C:\Temp\nljgbytnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6036
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nljgbytnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\i_nljgbytnlj.exe
      C:\Temp\i_nljgbytnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4324
  - - C:\Temp\nigaysqlid.exe
      C:\Temp\nigaysqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1908
  - - C:\Temp\i_nigaysqlid.exe
      C:\Temp\i_nigaysqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdaysqki.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1236
  - - C:\Temp\nifdaysqki.exe
      C:\Temp\nifdaysqki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdaysqki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2776
  - - C:\Temp\i_nifdaysqki.exe
      C:\Temp\i_nifdaysqki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1860
  - - C:\Temp\faxsqkicau.exe
      C:\Temp\faxsqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5024
  - - C:\Temp\i_faxsqkicau.exe
      C:\Temp\i_faxsqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkhczur.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5160
  - - C:\Temp\xusmkhczur.exe
      C:\Temp\xusmkhczur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkhczur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2240
  - - C:\Temp\i_xusmkhczur.exe
      C:\Temp\i_xusmkhczur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrpjhbztr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5308
  - - C:\Temp\zwrpjhbztr.exe
      C:\Temp\zwrpjhbztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3056
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrpjhbztr.exe ups_ins
    3⤵
    PID:1504
  - - C:\Temp\i_zwrpjhbztr.exe
      C:\Temp\i_zwrpjhbztr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omhezxrpjh.exe ups_run
    3⤵
    PID:3400
  - - C:\Temp\omhezxrpjh.exe
      C:\Temp\omhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omhezxrpjh.exe ups_ins
    3⤵
    PID:1332
  - - C:\Temp\i_omhezxrpjh.exe
      C:\Temp\i_omhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrljh.exe ups_run
    3⤵
    PID:1384
  - - C:\Temp\ojgbztrljh.exe
      C:\Temp\ojgbztrljh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrljh.exe ups_ins
    3⤵
    PID:6120
  - - C:\Temp\i_ojgbztrljh.exe
      C:\Temp\i_ojgbztrljh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5880
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdywqo.exe ups_run
    3⤵
    PID:1944
  - - C:\Temp\vtnlgdywqo.exe
      C:\Temp\vtnlgdywqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5436
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdywqo.exe ups_ins
    3⤵
    PID:1244
  - - C:\Temp\i_vtnlgdywqo.exe
      C:\Temp\i_vtnlgdywqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqoigayv.exe ups_run
    3⤵
    PID:2208
  - - C:\Temp\avsqoigayv.exe
      C:\Temp\avsqoigayv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5224
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqoigayv.exe ups_ins
    3⤵
    PID:5652
  - - C:\Temp\i_avsqoigayv.exe
      C:\Temp\i_avsqoigayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdxvt.exe ups_run
    3⤵
    PID:3680
  - - C:\Temp\avsnlfdxvt.exe
      C:\Temp\avsnlfdxvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvt.exe ups_ins
    3⤵
    PID:856
  - - C:\Temp\i_avsnlfdxvt.exe
      C:\Temp\i_avsnlfdxvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnkfcxvp.exe ups_run
    3⤵
    PID:4780
  - - C:\Temp\avsnkfcxvp.exe
      C:\Temp\avsnkfcxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnkfcxvp.exe ups_ins
    3⤵
    PID:5408
  - - C:\Temp\i_avsnkfcxvp.exe
      C:\Temp\i_avsnkfcxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\usmkfzxspk.exe ups_run
    3⤵
    PID:1932
  - - C:\Temp\usmkfzxspk.exe
      C:\Temp\usmkfzxspk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2944
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_usmkfzxspk.exe ups_ins
    3⤵
    PID:2420
  - - C:\Temp\i_usmkfzxspk.exe
      C:\Temp\i_usmkfzxspk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurpjh.exe ups_run
    3⤵
    PID:4732
  - - C:\Temp\mkeczurpjh.exe
      C:\Temp\mkeczurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3260
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurpjh.exe ups_ins
    3⤵
    PID:2688
  - - C:\Temp\i_mkeczurpjh.exe
      C:\Temp\i_mkeczurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5640
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff87161c188,0x7ff87161c194,0x7ff87161c1a0
      4⤵
      PID:6060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12315639914035799706,15689890205892577342,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:11
      4⤵
      System Time Discovery
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,7753274941105346068,12338214795081848063,262144 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,9400482786730593047,15709382278854750828,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
      4⤵
      PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,17463903393268480442,9622358466898801337,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:2012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,9334367492535367946,15134763302088800955,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,16041883247789593740,5970191999629935881,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:5696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,707232345649662105,5911252317900190236,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:9
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,14451796059222935439,9029496971982141170,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
      4⤵
      PID:1504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5376,i,3653237322289982507,5490016510412780659,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3632,i,12110808809896957703,4046683912974337579,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:4252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,3362777129293720468,17681863496768155600,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,3362777129293720468,17681863496768155600,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,6573276506045128111,1220836108238096180,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:14
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,5042752227358806221,15566395986625040639,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,5375708317384516723,2258165350225472343,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
      4⤵
      PID:6084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13391277023291332453,10164244488305299071,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6580,i,1504325636613376529,8774965574681404724,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
      4⤵
      PID:6104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,5979162836998739314,2355048484793977986,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
      4⤵
      PID:1708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,6811559010794376086,8834004121063293069,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,6175365785227250063,5030268098663898838,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3704,i,16291212995596158564,11199564658122326122,2097152 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      PID:1828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,17946103565949526476,5023857093444587478,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,6220087618799079101,15754134908488164880,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6803436955467776416,13222599872133688765,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,1984839862033253051,6750909048309496572,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,8994561564555596579,8809159573113786135,262144 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:10
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1561377842445430625,15960437710638268202,524288 --field-trial-handle=2580,i,14473070849552357102,14330946630067042347,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:14
      4⤵
      PID:4276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5308

C:\Temp\pkicausmkifzxvpn.sys
C:\Temp\pkicausmkifzxvpn.sys
1⤵
- Executes dropped EXE
PID:1068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5472

C:\Temp\upmkecwusp.sys
C:\Temp\upmkecwusp.sys
1⤵
- Executes dropped EXE
PID:4852

C:\Temp\ecwurpjhcz.sys
C:\Temp\ecwurpjhcz.sys
1⤵
- Executes dropped EXE
PID:5656

C:\Temp\pmgezwrojh.sys
C:\Temp\pmgezwrojh.sys
1⤵
- Executes dropped EXE
PID:2844

C:\Temp\jdbywrojgb.sys
C:\Temp\jdbywrojgb.sys
1⤵
- Executes dropped EXE
PID:4612

C:\Temp\qnlgdbvtqo.sys
C:\Temp\qnlgdbvtqo.sys
1⤵
- Executes dropped EXE
PID:4092

C:\Temp\yvqnigdyvt.sys
C:\Temp\yvqnigdyvt.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\pnifaysqki.sys
C:\Temp\pnifaysqki.sys
1⤵
- Executes dropped EXE
PID:5340

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:5232

C:\Temp\cxusmkhcau.sys
C:\Temp\cxusmkhcau.sys
1⤵
- Executes dropped EXE
PID:4756

C:\Temp\khczusmkec.sys
C:\Temp\khczusmkec.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\omgezwromj.sys
C:\Temp\omgezwromj.sys
1⤵
PID:1148

C:\Temp\omjhbywqol.sys
C:\Temp\omjhbywqol.sys
1⤵
PID:2432

C:\Temp\wtoljdywqo.sys
C:\Temp\wtoljdywqo.sys
1⤵
PID:5472

C:\Temp\lidbvtnljd.sys
C:\Temp\lidbvtnljd.sys
1⤵
PID:2016

C:\Temp\davsqnigdy.sys
C:\Temp\davsqnigdy.sys
1⤵
PID:2488

C:\Temp\auspnlfdxv.sys
C:\Temp\auspnlfdxv.sys
1⤵
PID:556

C:\Temp\vsmkfcxusp.sys
C:\Temp\vsmkfcxusp.sys
1⤵
PID:4328

C:\Temp\auspkhfzxr.sys
C:\Temp\auspkhfzxr.sys
1⤵
PID:5824

C:\Temp\usmkecwuom.sys
C:\Temp\usmkecwuom.sys
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtrljdbwt.exe

Path C:\Temp\bvtrljdbwt.exe
Size 361KB
SHA256 d393b3ed33e0c09e8c2b0f73c57aae32eb32d8a2a2c7f3d747f268a0f6e433a7
MD5 76b067e340653e23ff36a0581bc8b1d7
SHA1 2983a2343f1070782b5e8215b92bbaff966a0666
SHA512 6fae5a393cfe1425745d37fbf5e05917c318c9b501581e8db4625e6f901748412d557e149d3514fb072986ec6c982edf453e0a2514f8951c934433c9d72a116b
SSDEEP 6144:iflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:iflfAsiVGjSGecvX
TLSH
T1CE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurpjhcz.sys

Path C:\Temp\ecwurpjhcz.sys
Size 293KB
SHA256 a0c63468ca270adb85dc2061e0f2b789ecd65f80dd4ca85a2820eb2c3b731e88
MD5 b6fe7b525ccd51c05e4db7311b89e271
SHA1 2379f6efeda0e78c01d1d9c3c8371da3949d287b
SHA512 1ff531b4ecfadf03d9b152e95760aaa8017c3ef198a546789c5b934edb08d0b488b4a6e24b4d14f8a657f2247d4f925336402388e590ce258110d8e703683abd
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FF545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtrljdbwt.exe

Path C:\Temp\i_bvtrljdbwt.exe
Size 361KB
SHA256 ef81736f74aad6c637b888654c191425f7917dfa8855d94f5406506b2c316bc3
MD5 cf65bbe775169206827481c255e5a3e1
SHA1 dfae4cf2efb2b295da92ec4da92acb47779d3816
SHA512 00a55f789e7ccef078ce6816a808a6995f86986a5872726aef688159dde7d0fe30c1132bf0b334e0cd7fe4669c1e571ca25a296358b9bc2629a8ccc470465343
SSDEEP 6144:PflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:PflfAsiVGjSGecvX
TLSH
T16B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_omgebwurmj.exe

Path C:\Temp\i_omgebwurmj.exe
Size 361KB
SHA256 3ae51262a023d3e05653d5f80c4b437bf8cc3799cc63291a26530ca2932a8691
MD5 8b69a3cbcd10bef3c08da003734dc033
SHA1 c679202dff637b3c0f864e9d062706b022e1f217
SHA512 6b1806fc6bda987d5dd647d1d8064e7497a72a95ce3d3528ccfcb889610318ae6da66bbe4acd282c2e15fe77d881461bccaae52ab6ba2ad474e77a4b183afc4c
SSDEEP 6144:UflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:UflfAsiVGjSGecvX
TLSH
T122747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pjhfzxrpjh.exe

Path C:\Temp\i_pjhfzxrpjh.exe
Size 361KB
SHA256 53663837e6b0bd870097308f79f585e8cfd617437a9b2159df92b245a831f774
MD5 5a6911a6bcabf6316e7bdc5165b70501
SHA1 076fc3ea71e23de6c13e4db7409b8c177455e6c0
SHA512 19afc6bc5f369653d6c5f9bf969a374663f4ac795ca525df0e67f9d88def0a9567314daf3b69e81c9e27df6c94d05c4e3c039684bac06d98e09d7b9b71e4fbff
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T12D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rpnhfzxvpk.exe

Path C:\Temp\i_rpnhfzxvpk.exe
Size 361KB
SHA256 804475d25e84b526a5280e85c88484803f50659bcbbe32c4c13b6a53f1f58637
MD5 802619bc07131833faaf5ffc38e946ba
SHA1 966def7c17455eed369c4f819df2a3d85efbeb86
SHA512 519bba65530d81d7f3a8b52b2ea6cce1e01be13c899931645cf2d659f4c1cd2c575c2091bce07ea8ab5cb03dc3000a8a8e846d9567fb34440eb8cc8814f691c5
SSDEEP 6144:ZflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:ZflfAsiVGjSGecvX
TLSH
T164747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomheztrpj.exe

Path C:\Temp\i_uomheztrpj.exe
Size 361KB
SHA256 ed13c567a7c723ead69d66eae500f7ee222a3bd152497981f7a04bdf3e3c9bab
MD5 04e8d2da8ce90b1dd4aedf61ea446331
SHA1 f7cc6e5b6e0e5ed4086ea48aa479022bb60cd427
SHA512 9bd92ee7b618ad5e9bf63fe43fd023e0537f28c83f3ee957d7ccabf70bcb37a9129b63edaf4d6d4005ed80d3d462c8788389e49ad57d02e171d601b918fc573b
SSDEEP 6144:0flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:0flfAsiVGjSGecvX
TLSH
T14D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbywrojgb.sys

Path C:\Temp\jdbywrojgb.sys
Size 293KB
SHA256 f33b5397f17d65132432bcce621a6587bead46484a9e74212ca51183eb44f878
MD5 618190950aba48fe7879a4f5bdd37a92
SHA1 207d9ab3b1639d1cf77f0c6ebd09e2dcd7864145
SHA512 dd65a6c3248e0ed986420b9afbb4d0a65d6a6a2c7d854e33a95dd2503b6e5487d8dcd151d90d46c6dc89e13e1f3d165fbd03e66cd3b3b1ffa155957b47984fa0
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T149545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgebwurmj.exe

Path C:\Temp\omgebwurmj.exe
Size 361KB
SHA256 97205af4d646b13551a9d2afa4da587bca88f8f5f5f0dbca70e236f871a31b43
MD5 2193fedb57f75bacea0796ad40cad706
SHA1 55d230b112dabb1bae7e76ababa79419e0acf451
SHA512 cbe297421f800f8bf60076d6d758ddd0621f296d1f76775cbad47f6a4cee3cd73d78042eee432b890ecf237090af2c7a7cc9df15dc885bc2b8d6f9612ecbc6b4
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T159747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pjhfzxrpjh.exe

Path C:\Temp\pjhfzxrpjh.exe
Size 361KB
SHA256 25f74d9294ec1d443981354ed5dcf3a87365f70bc64148d5f8dfb4b7142be834
MD5 fa36c5b58a46ec4f9a6c2734074d415f
SHA1 12e254f61f3e22c0a3b8de4f08a5be213c863556
SHA512 986cff1b082142703eb4a0635a1a7567b4c319dda3537897cec9be759e0dc25f21819c4ddc31c01bc3f9481858f1790722f679c545074950fc43c8aa68edbe40
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T132747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkifzxvpn.exe

Path C:\Temp\pkicausmkifzxvpn.exe
Size 361KB
SHA256 c2ed05572a5c2e47e9de0de222ff55e9065c25c00993f226659f3800f184eab7
MD5 61a8a05fcc5cd36898035cc49142fb9b
SHA1 ad8c3962dac1f7f949bee76d8daf84badc1ad6a5
SHA512 e768c661db916cd959fd984e5b989dbd46ba4bb789265778ff853183dde940269647cff6558a0e3440397dd2459dc4c235cef621a45d559a4e1ed929f8491c4e
SSDEEP 6144:MflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:MflfAsiVGjSGecvX
TLSH
T17D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pkicausmkifzxvpn.sys

Path C:\Temp\pkicausmkifzxvpn.sys
Size 293KB
SHA256 f3e7bdee1da1f28e940f59ae58d95ae93c08198878ffb8b27b443f6b75716e12
MD5 c77a8bc6ebcfd240a9ee237a13fd1e1a
SHA1 cb7d29c85665c3dc226763b8fabc6ac07b2e8a81
SHA512 60c1c79e45c31fdabe6a3a5f4ea12753dbc9aff0c5a53ec72b37d98237438f3d79c0c7bdcf0c360a5425c1370d59f9f616a5150f30214b308912db8791113012
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmgezwrojh.sys

Path C:\Temp\pmgezwrojh.sys
Size 293KB
SHA256 257170d99095521877cb64c5adc9fb20888b7fc01a4f67ef69de9ae78334094e
MD5 ce6598741195e6a4c47d55fcd6c5d765
SHA1 86c3606b893054080349fb9d391ecf9ce61e962d
SHA512 2c78d50717b28ec511ffd8f88ba6a29f9fd4ff34b37e8dbe8b05f4b61e81a1dd186cdf0548b490491c1282d04c278f84e93e73e7872f977f5a468ffe6394c0c3
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlgdbvtqo.sys

Path C:\Temp\qnlgdbvtqo.sys
Size 293KB
SHA256 b99e5e0b796ddad19b7bceee762231604a0dacd2b317bb8f8c495205f9072848
MD5 45d209e961207b4f4f696f9a196a11cf
SHA1 060880dbb876746d356c948938d9804dc6eb9d4d
SHA512 e4cc378e6bdb9b58b306cd03b2953323522ce92668c19e55a3b2d205d34742e20e1c6ce0b47cf5f43d9b7db2feed6bbe66b1ba844534ee123f1c745999eb759c
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T160545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpnhfzxvpk.exe

Path C:\Temp\rpnhfzxvpk.exe
Size 361KB
SHA256 f2a9c3d77201ad195312745c7aa016fe806a4c75f746843e8de027a58ee2e418
MD5 ff1267170791dcb9ba6cdf7e968c8f65
SHA1 e2e286635636c07ce7662116c84c4184dcf0e2ea
SHA512 c210b92610f1fc7b87856d3e7cd4264d4fab817fba5dd37a71a8e8aca05bf01c1e066041fd61f6c8bef40d4c7c9d03ccf0fd3075ed794bfa2100be3e8865e856
SSDEEP 6144:9flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:9flfAsiVGjSGecvX
TLSH
T154747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomheztrpj.exe

Path C:\Temp\uomheztrpj.exe
Size 361KB
SHA256 7bdbdcc79ebe8905c2baedbc919b374cd451ad318602ae779a556b885bc2a1a9
MD5 96bfc53c068beb73950dd8b16feeaac7
SHA1 a225089f1022d24150b162f7bee1ecb910383831
SHA512 f4b2b8f56b0fa6fbc4b0f31518d3f88699dd19aed80b96b19254a85782ccae67e6e2bb834b48cf5e9aec467fddd800149a616837cbb1399af594d9999b89db8c
SSDEEP 6144:5flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:5flfAsiVGjSGecvX
TLSH
T119747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upmkecwusp.sys

Path C:\Temp\upmkecwusp.sys
Size 293KB
SHA256 9b53158c6c1b90e7ece4d4594207d1a1c1891d2802cd3794538cee1687c2b8eb
MD5 f440916ce680ab9f16160b8a703b74ae
SHA1 8d7f3f79b6c4d9f6a2d4f7b6b459684a61ad77d4
SHA512 7aad7632fc4c234ca426352be856c3ad6cacc1950c45dd4e11cc3cfba60d62c72f0f6dd5c442a71f476052dbdbac292ac836d38dbcdf063ecfadb44fe1962527
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T16F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

69595b37-7ef6-436b-8f4b-adb278522e5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69595b37-7ef6-436b-8f4b-adb278522e5a.tmp
Size 14KB
SHA256 ccfc15de89d70d2e245bc52004c3476587ee1fed65d4f9dbd57ff7d4d06ce2df
MD5 836ba0cf93136a5b16d985beb65e8a88
SHA1 802dcf7ad62242fc7902e32279a49a2082b347c0
SHA512 3d3405c6031c96ffe7fdecf12c1df557518db618d9027288556ce95ff8d124dfe0c28fb4449b6e1b3f354f4ae7587907d7d20e83f44cbe35e5903247c9eb1895
SSDEEP 192:sxRKRiyM/jK1Ml8wcd/fxspC0pIZ8qbZzoA8p9Q/g6+WNIYTKVAGqIgtJ:sxRKQCd/fxspC62PQy/5IJG3
TLSH
T13252D8056A38697BCCDBD209FA557F53D6F81573A2901E44AAFCCA0C05E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e29a60ec73d8fbfc47ed97d5547cf8d586f31e52f6d48b455d39a1ec0a48339
MD5 bf564186b736762e6cc34500ba31085e
SHA1 3e495ded23f330af53f37f0084957a61c6dda0a2
SHA512 8102538aad8e2e5224704baa8139109a0a561e6f1884027bb73896e58a168043ad68487301a84c7dbf638009b306a0e433568fe3be502e2e69978fc5f588d7bd
TLSH
T15D61D5563F1A2FD3C76700B49DF246897BF8CEA2418F6E33218990376E06B24E479231
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59404b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59404b.TMP
Size 3KB
SHA256 d1408adec45f7ae6449e628202566c143aab9a955846e223ffa41d8ebdc76a28
MD5 3147f260c34b06ba05131fb3fffc93d1
SHA1 7119d247f26e556dc42862622958548f1145781c
SHA512 76a818db8ddb6995c620753faab0ffe7d3e3c7c324e1437406f87db4f88be44d4fc74d65ffee68e1e8970463a55c2a4aa48b118a65fde17c1df7d7369b90b156
TLSH
T15861D5563F162FD3C76700B49DF246897BF8CEA6418F6E23118990376E06B24E479231
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8a415e06f9d4a02f9a8aedec9b0c9359e24cbeb3a3ac3c2e5fc88011348d714
MD5 59184ec7e26ed2680949ee72f1072a68
SHA1 1bc7686a7fce8c5d304feead9e95887a50563a4d
SHA512 f4eee520e9177443c248b4cd51c37aebed7a491465a916918239c6750cfbc1d762a1ee095c9b21c0d2f581039022437f398e3dce6a1e6f853b991a9072c35ee3
TLSH
T10C51CFF7C3E8856DC90145F0BA187E2BCE1D0914832C7D5A88E4AF1B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8fba2a4f9fde06276962428f234dfbfb618f87f3d46adcbad07c11ebb40409ce
MD5 4134b5037358ba4d0cab1bb88333e8fa
SHA1 f08311b0260c407eaad4c8137a3781514bb02e04
SHA512 5a3ae6f269ba08bd0866b64720bb8cd75c46b7d717ff1e60d1f6ff10df5ee6ec753e5b5636a5a4ede06369ddebcd436e9aa89833c8eec0891d4a4cf70d2dd119
SSDEEP 192:sxRhRiyM/jK1Ml8wcd/fxs0C0NIZ8qbZzoA8p9N/g6+WNCXb/YT8VAGqIgDfJ:sxRhgCd/fxs0CS2PQ3/5+//Gt
TLSH
T1EA62D815AA34597BCCDBD209FA55BB53D6F91172E2900E44AAFCCA0C05E76ED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 943a432f3e25aab9e9691d2ac76408affb6afcdf663ea856ddcc5ddc06dd0567
MD5 5b9ef3c11103d4032537c51463d00ece
SHA1 f34b1341154f90295886cce4426d4501b33d3959
SHA512 174f80446ce51dbbd1bf99e02654ea8300c6987c464e1844806ab1518456758aeeea286fbc6fdd60385ea78417244e1049388d9d82649408eb4115b525e75993
SSDEEP 192:sxRhRiyM/jK1Ml8UQEcd/fxs0C0NIZ8qbZzoA8prN/g6+WNCXb/YT8VAGqIgDfJ:sxRhgqDd/fxs0CS2PQB/5+//Gt
TLSH
T19762D915AA34597BCCDBD209FA51BB53D2F91572E2900E44AAFCCA0C05E76ED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 03385b7b9ee834c27a89ba7949d3539b0a3e82edbcd4d3320de0d7c3c9011a4b
MD5 563f31e36b869a71b8d404105f0230bd
SHA1 d2678dd61b82d23c30e284df07b78aa14f67adeb
SHA512 0207a9b2364f1329869cedb9168cad2d3ca602e46f7f4f12dbc617b44ea20fa6db69f74c5c1672e086ea3451ec48f0ab4e64c60d79618b632cabdc4cbd3a4f34
SSDEEP 192:sxRhRiyM/jK1Ml8wcd/fxs0C0pIZ8qbZzoA8p9Q/g6+WNIYTKVAGqIgD9J:sxRhQCd/fxs0C62PQy/5IJGD
TLSH
T18E62D815AA34597BCCDBD209FA557F53D6F81572E2900E44AAFC8A0C05E76ED321382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6209455108264ff9622ce70192aeef676d9cf5d7f01fa45cf3103bcebe87c054
MD5 aa7393bcd0fa6d0e8f147d86e9bbc82e
SHA1 faad0bd2bdde232ac12aa35f3ae7144b7ad9ba53
SHA512 3d7147542aaf3e14deafb73324576efa1768ab5b6682c7350228d41c1662ec6748df843216d9a6901388cade4ccee1c2e7e0280b1eebb30362ce659bc3dbbe59
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqyDzFYJroCj80:RGqOBfE7CrWgTvfiXu1jalyDRYiCjf
TLSH
T199E2EC7F680CCB7E4F8049ACEC29BD8E6DE801CB56988D5447FA894C03C67EB55164EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 caa0b51e1008bf22a4a3c34f3b418d314963e4af4320ab1932a8350d880058e0
MD5 48f1fd530266ac57f96971692222b244
SHA1 5c32c75dd9621e833a9ac26ac3167864fc3c10d1
SHA512 745b3574bc53ad816f4ffd4e2e7d89740905032916a16ba82ca17a7fac37307db10bb2a7d97aeb6a6803e0646ca3379608e0c38ef32c174b6d67fd53bb42bef1
SSDEEP 96:K0CcKnKOqmYK/qJS3eyEkUyW8pBgiyK43gYyciKxQy0Hm7KmgIZ:SLHUS3eyEkUN8piiK3gY5iKxQy0Hm7KU
TLSH
T1E2916310737E32D1387D74159560851F968231637A1DF82FBB7960A21B67E42CEFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59dc1e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59dc1e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6a2110e91950276ca50e61f6f9276a8681b09acecfc7c2bfd378dad9701b763b
MD5 f8a9814838f5c2e70be9e7065d1497b8
SHA1 a1edb0530d0d947b1144f2c895087e909f79bd4f
SHA512 d11edafe73c7090cb29eae3a4eef6a6ff32eab3fb9ae1d814226e8f09ed826016ec8e676d910532017999e323d394b90d5eb2f9b1cef9eca2b2580dd2e3b22b9
SSDEEP 768:kj+9o3B6+fzDXodOiIyN8Y1M1fmBnZ2b9Md:z9o3BHDXodI11Vb+d
TLSH
T1D2F2C031DC61DD778CE39289B65727866EF411B7DAC91F08D9EC6B0E06437AD630B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 80237d5a6fc46eef5ffc91d6128214815ebcaa05aa3a5294b1239e952d16275e
MD5 bcd450b7e7ff619d9bf077ba9346c20d
SHA1 b8ab10f9d0d2dd3a32d2a068008edeb1cdab6d30
SHA512 43b17478e812e1e59dba2f00f2438fe581edf336774385eaac410499a6986b67729b01374ec5bf66edc1009d46a3e1b0839f579ed08812a70eb5617c08ebace3
SSDEEP 768:Yrv+4UNbdj3P6yjtXodOiIyN8Y1M1fmBnlUv0B:Ybsbl3PHXodI11X8
TLSH
T1BE03CF32E864A5778CF38289B54762433FF451A78BC90B44C9DC2B0E4247AFE634BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b7a8524342b2fed278976028852ccffa721fa8ec7f881770d9663e590595c809
MD5 bebe8ffda7e55e2a0dcb106470d9a451
SHA1 078eb91d23ba0dcbd88ee793fe808f7d89fc7f39
SHA512 7693d70e082b193bc29808630dacd8b1c72f0257fb767b1fee2e63cd59bdad5304864c26fb20d1c8c8453c816d90d66a28c2a115d9cf4d25ee1bc2330448bd8a
SSDEEP 768:1j+9o3i6+fzDXodOiIyN8Y1M1fmBnZ2b9Md:A9o3iHDXodI11Vb+d
TLSH
T15CF2C031DC61DD778CE39289B65727866EF411B7DAC91F08D9EC6B0E06437AD630B80A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e6673a988c2542e0d7cb9ded24be7ae365e4d39c0736220adf6d7e5e58d47737
MD5 d2271c0646295cf1c7d39db068dcc4e4
SHA1 c4e5a76f43ab991a25a37b59f86f280a1d77b675
SHA512 ef1ed0c5d5c8e0206fdfe9e6e4fcb08c59031b7ad2b9d7a5bd4722dfd580fa55d8d97de52104bc80ab2dd7880b155964fa7116dde8bfa925458f06ca775db1c3
SSDEEP 768:3rv+4UNbd23t6sfzxXodOiIyN8Y1M1fmBnZ2i:3bsbk3tfxXodI11Vi
TLSH
T17C03BE31E864D9778CF79289F15762833EF421A79A891F08D9E92B0E05476EE330BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 1065a3fa9367b33cc9d3d5f2ea21ce6108de6a14edf1cba10d144e27380cc7dd
MD5 151eb86472dee6e45869c09f878e7e8f
SHA1 f8cfcac219c8c3f90e59f1a915c4172e4c04c8d0
SHA512 992abfc053686e6d6aa53371178610fa1759cc0e886bc8460a174b35daddc6fa7ecd6527495c9b6dbd2ba0faf3146c46fd7e2452cac21c147f3aed9e83f58a2e
SSDEEP 768:DF1j+9D3awgx6pTlJXodOiIyN8Y1M1fmBnZ2b9Md:S9D3weJXodI11Vb+d
TLSH
T1AD1317F188D38976D8AE4787A77D2E459EFCC1A7B5885984B7D81D0DCC822BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3876_496290776\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0203c45e34ba3b49e2dc27a146246a5f5a4d8bad5d413b653ff9c5e3d724fe3f
MD5 fd466f6d7cfc2e6601ff339722f30528
SHA1 1d59132d8c02b695c211539fdb14f3ca3ed36b93
SHA512 4c3ab523fd0c1dfe2d4f693eb51e6754833a5d7712bba4db51646913e236970a2b3669f0e126842e9118ee7728e541b775a8c144cf911ad43d752b8fbd21228a
TLSH
T16271239367ADD5B3C2DA5FF003C35244F2FB22780B6370244B515586AB30A3A58B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1068-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1148-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2016-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2432-417-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2488-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2844-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4092-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-511-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4328-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4400-515-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4612-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4756-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4852-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5232-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5340-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5472-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5656-269-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-510-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download