systex | 8ddae1ab50e7241ebd17d078db0e4b002bc086a79a0a0e7298b6b2f99fcdbf72

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260709-tw392aet5v
SHA256 8ddae1ab50e7241ebd17d078db0e4b002bc086a79a0a0e7298b6b2f99fcdbf72
MD5 cfe0da6657964c6ab3be27da7a1fc66d
SHA1 add8c42c5d30752fe5634e844d4fd9ecee630b4c
SHA512 2e25531f386a3df097344e95c0e6716583a2f756b850acc180cb8929253b5f0207cee7f839c08850cac0567c63812cd9206cba36e7ce1052ae526dbad17e6c14
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T17A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5560	nifaysqnifcavsqk.exe
1232	nifaysqnifcavsqk.sys
3884	CreateProcess.exe
3480	xvpkifaysq.exe
5684	CreateProcess.exe
5968	CreateProcess.exe
4756	i_xvpkifaysq.exe
4272	causmkecxu.sys
928	CreateProcess.exe
2464	spkhcausmk.exe
3576	CreateProcess.exe
1224	CreateProcess.exe
4132	i_spkhcausmk.exe
5788	mhecwusmkh.sys
2432	CreateProcess.exe
3516	pmheczxrpj.exe
1896	CreateProcess.exe
3844	CreateProcess.exe
5932	i_pmheczxrpj.exe
5944	urmjhezxrp.sys
2692	CreateProcess.exe
6136	ezwuomjhez.exe
996	CreateProcess.exe
1412	CreateProcess.exe
1032	i_ezwuomjhez.exe
5588	jebwuomjhb.sys
5948	CreateProcess.exe
5464	etrljdbwto.exe
5668	CreateProcess.exe
1136	CreateProcess.exe
1052	i_etrljdbwto.exe
1584	qomjebvtqo.sys
3340	CreateProcess.exe
3200	dbztrljdbv.exe
52	CreateProcess.exe
4964	CreateProcess.exe
3552	i_dbztrljdbv.exe
788	jdbvtqliga.sys
2080	CreateProcess.exe
5064	nlgdyvtnlj.exe
1744	CreateProcess.exe
4456	CreateProcess.exe
3052	i_nlgdyvtnlj.exe
1376	ywqoigaysq.sys
2620	CreateProcess.exe
4632	qnlfdaysqn.exe
5056	CreateProcess.exe
1356	CreateProcess.exe
3424	i_qnlfdaysqn.exe
2896	qnlfdavsqn.sys
4532	CreateProcess.exe
1052	fdxvtnkfdx.exe
2976	CreateProcess.exe
4696	CreateProcess.exe
3216	i_fdxvtnkfdx.exe
4480	faxspnhfax.sys
3436	CreateProcess.exe
3208	iczxspnkfc.exe
2932	CreateProcess.exe
3716	CreateProcess.exe
752	i_iczxspnkfc.exe
1376	pmkhczurpm.sys
2916	CreateProcess.exe
5792	xusmkecaus.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_227904098\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_227904098\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_473927105\llm_user_input_extractor_config.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_518936146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_8941434\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_8941434\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_473927105\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_473927105\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3336_473927105\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjhbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvsnkiusnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvsnkiusnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwuomjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwuomjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	etrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvqnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvtnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iczxspnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rojgebztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifaysqnifcavsqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmheczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlgdyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlgdyvtnlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjhbzwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbztrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_iczxspnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljdbywqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqoigdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvtnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rojgebztrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqoigdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvqnlfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhcausmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmheczxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmheuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_etrljdbwto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbztrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpkifaysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmheuomhe.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5548	ipconfig.exe
6124	ipconfig.exe
2548	ipconfig.exe
4396	ipconfig.exe
5152	ipconfig.exe
5352	ipconfig.exe
3216	ipconfig.exe
5080	ipconfig.exe
4760	ipconfig.exe
2908	ipconfig.exe
2756	ipconfig.exe
3384	ipconfig.exe
3116	ipconfig.exe
3708	ipconfig.exe
248	ipconfig.exe
3216	ipconfig.exe
4720	ipconfig.exe
3380	ipconfig.exe
5660	ipconfig.exe
3184	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-200172840-2662118501-695741713-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280879332026017"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-200172840-2662118501-695741713-1000\{6DBE11CF-1326-4088-9C23-635899499701}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5560	nifaysqnifcavsqk.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4756	i_xvpkifaysq.exe
Token: SeDebugPrivilege	4132	i_spkhcausmk.exe
Token: SeDebugPrivilege	5932	i_pmheczxrpj.exe
Token: SeDebugPrivilege	1032	i_ezwuomjhez.exe
Token: SeDebugPrivilege	1052	i_etrljdbwto.exe
Token: SeDebugPrivilege	3552	i_dbztrljdbv.exe
Token: SeDebugPrivilege	3052	i_nlgdyvtnlj.exe
Token: SeDebugPrivilege	3424	i_qnlfdaysqn.exe
Token: SeDebugPrivilege	3216	i_fdxvtnkfdx.exe
Token: SeDebugPrivilege	752	i_iczxspnkfc.exe
Token: SeDebugPrivilege	2756	i_xusmkecaus.exe
Token: SeDebugPrivilege	5360	i_upmheuomhe.exe
Token: SeDebugPrivilege	5824	i_uomjhbzwrp.exe
Token: SeDebugPrivilege	5764	i_rojgebztrl.exe
Token: SeDebugPrivilege	5152	i_rljdbywqol.exe
Token: SeDebugPrivilege	5184	i_tqoigdyvtq.exe
Token: SeDebugPrivilege	3332	i_igayvqnlfa.exe
Token: SeDebugPrivilege	2912	i_uspnlfdxvp.exe
Token: SeDebugPrivilege	2784	i_xvsnkiusnk.exe
Token: SeDebugPrivilege	4700	i_pkhfzxrpkh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 5560	5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5320 wrote to memory of 5272	5320	2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5272 wrote to memory of 3336	5272	iexplore.exe	90
PID 3336 wrote to memory of 3504	3336	msedge.exe	91
PID 3336 wrote to memory of 5468	3336	msedge.exe	93
PID 3336 wrote to memory of 4464	3336	msedge.exe	94
PID 3336 wrote to memory of 5468	3336	msedge.exe	93
PID 3336 wrote to memory of 5468	3336	msedge.exe	93
PID 3336 wrote to memory of 6048	3336	msedge.exe	95
PID 3336 wrote to memory of 6048	3336	msedge.exe	95
PID 3336 wrote to memory of 5340	3336	msedge.exe	96
PID 3336 wrote to memory of 5340	3336	msedge.exe	96
PID 3336 wrote to memory of 5340	3336	msedge.exe	96
PID 3336 wrote to memory of 5160	3336	msedge.exe	97
PID 3336 wrote to memory of 5160	3336	msedge.exe	97
PID 3336 wrote to memory of 5160	3336	msedge.exe	97
PID 3336 wrote to memory of 2028	3336	msedge.exe	98
PID 3336 wrote to memory of 2028	3336	msedge.exe	98
PID 3336 wrote to memory of 2028	3336	msedge.exe	98
PID 3336 wrote to memory of 1908	3336	msedge.exe	99
PID 3336 wrote to memory of 1908	3336	msedge.exe	99
PID 3336 wrote to memory of 1908	3336	msedge.exe	99
PID 3336 wrote to memory of 5212	3336	msedge.exe	100
PID 3336 wrote to memory of 5212	3336	msedge.exe	100
PID 5560 wrote to memory of 3884	5560	nifaysqnifcavsqk.exe	104
PID 3480 wrote to memory of 5684	3480	xvpkifaysq.exe	107
PID 3336 wrote to memory of 940	3336	msedge.exe	110
PID 3336 wrote to memory of 940	3336	msedge.exe	110
PID 3336 wrote to memory of 2244	3336	msedge.exe	111
PID 3336 wrote to memory of 2244	3336	msedge.exe	111
PID 3336 wrote to memory of 3768	3336	msedge.exe	113
PID 3336 wrote to memory of 5732	3336	msedge.exe	116
PID 3336 wrote to memory of 5732	3336	msedge.exe	116
PID 3336 wrote to memory of 5624	3336	msedge.exe	117
PID 3336 wrote to memory of 5624	3336	msedge.exe	117
PID 5560 wrote to memory of 5968	5560	nifaysqnifcavsqk.exe	118
PID 5560 wrote to memory of 928	5560	nifaysqnifcavsqk.exe	122
PID 2464 wrote to memory of 3576	2464	spkhcausmk.exe	124
PID 5560 wrote to memory of 1224	5560	nifaysqnifcavsqk.exe	127
PID 5560 wrote to memory of 2432	5560	nifaysqnifcavsqk.exe	131
PID 3516 wrote to memory of 1896	3516	pmheczxrpj.exe	133
PID 5560 wrote to memory of 3844	5560	nifaysqnifcavsqk.exe	136
PID 5560 wrote to memory of 2692	5560	nifaysqnifcavsqk.exe	141
PID 6136 wrote to memory of 996	6136	ezwuomjhez.exe	143
PID 5560 wrote to memory of 1412	5560	nifaysqnifcavsqk.exe	146
PID 3336 wrote to memory of 988	3336	msedge.exe	148
PID 3336 wrote to memory of 5312	3336	msedge.exe	149
PID 3336 wrote to memory of 2024	3336	msedge.exe	150
PID 5560 wrote to memory of 5948	5560	nifaysqnifcavsqk.exe	153
PID 5464 wrote to memory of 5668	5464	etrljdbwto.exe	155
PID 5560 wrote to memory of 1136	5560	nifaysqnifcavsqk.exe	158
PID 5560 wrote to memory of 3340	5560	nifaysqnifcavsqk.exe	162
PID 3200 wrote to memory of 52	3200	dbztrljdbv.exe	164
PID 5560 wrote to memory of 4964	5560	nifaysqnifcavsqk.exe	167
PID 5560 wrote to memory of 2080	5560	nifaysqnifcavsqk.exe	171
PID 5064 wrote to memory of 1744	5064	nlgdyvtnlj.exe	173
PID 5560 wrote to memory of 4456	5560	nifaysqnifcavsqk.exe	176
PID 5560 wrote to memory of 2620	5560	nifaysqnifcavsqk.exe	180
PID 4632 wrote to memory of 5056	4632	qnlfdaysqn.exe	182
PID 5560 wrote to memory of 1356	5560	nifaysqnifcavsqk.exe	185
PID 3336 wrote to memory of 988	3336	msedge.exe	187
PID 3336 wrote to memory of 988	3336	msedge.exe	187
PID 5560 wrote to memory of 4532	5560	nifaysqnifcavsqk.exe	193
PID 1052 wrote to memory of 2976	1052	fdxvtnkfdx.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_cfe0da6657964c6ab3be27da7a1fc66d_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Temp\nifaysqnifcavsqk.exe
  C:\Temp\nifaysqnifcavsqk.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpkifaysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3884
  - - C:\Temp\xvpkifaysq.exe
      C:\Temp\xvpkifaysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpkifaysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5968
  - - C:\Temp\i_xvpkifaysq.exe
      C:\Temp\i_xvpkifaysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhcausmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:928
  - - C:\Temp\spkhcausmk.exe
      C:\Temp\spkhcausmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhcausmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1224
  - - C:\Temp\i_spkhcausmk.exe
      C:\Temp\i_spkhcausmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmheczxrpj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2432
  - - C:\Temp\pmheczxrpj.exe
      C:\Temp\pmheczxrpj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmheczxrpj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3844
  - - C:\Temp\i_pmheczxrpj.exe
      C:\Temp\i_pmheczxrpj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwuomjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2692
  - - C:\Temp\ezwuomjhez.exe
      C:\Temp\ezwuomjhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6136
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:996
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwuomjhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1412
  - - C:\Temp\i_ezwuomjhez.exe
      C:\Temp\i_ezwuomjhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\etrljdbwto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5948
  - - C:\Temp\etrljdbwto.exe
      C:\Temp\etrljdbwto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5464
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_etrljdbwto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1136
  - - C:\Temp\i_etrljdbwto.exe
      C:\Temp\i_etrljdbwto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbztrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3340
  - - C:\Temp\dbztrljdbv.exe
      C:\Temp\dbztrljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:52
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbztrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Temp\i_dbztrljdbv.exe
      C:\Temp\i_dbztrljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlgdyvtnlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2080
  - - C:\Temp\nlgdyvtnlj.exe
      C:\Temp\nlgdyvtnlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlgdyvtnlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Temp\i_nlgdyvtnlj.exe
      C:\Temp\i_nlgdyvtnlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2620
  - - C:\Temp\qnlfdaysqn.exe
      C:\Temp\qnlfdaysqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1356
  - - C:\Temp\i_qnlfdaysqn.exe
      C:\Temp\i_qnlfdaysqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvtnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4532
  - - C:\Temp\fdxvtnkfdx.exe
      C:\Temp\fdxvtnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1052
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2976
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvtnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4696
  - - C:\Temp\i_fdxvtnkfdx.exe
      C:\Temp\i_fdxvtnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\iczxspnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3436
  - - C:\Temp\iczxspnkfc.exe
      C:\Temp\iczxspnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_iczxspnkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3716
  - - C:\Temp\i_iczxspnkfc.exe
      C:\Temp\i_iczxspnkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmkecaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2916
  - - C:\Temp\xusmkecaus.exe
      C:\Temp\xusmkecaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmkecaus.exe ups_ins
    3⤵
    PID:6084
  - - C:\Temp\i_xusmkecaus.exe
      C:\Temp\i_xusmkecaus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmheuomhe.exe ups_run
    3⤵
    PID:2412
  - - C:\Temp\upmheuomhe.exe
      C:\Temp\upmheuomhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmheuomhe.exe ups_ins
    3⤵
    PID:124
  - - C:\Temp\i_upmheuomhe.exe
      C:\Temp\i_upmheuomhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjhbzwrp.exe ups_run
    3⤵
    PID:4620
  - - C:\Temp\uomjhbzwrp.exe
      C:\Temp\uomjhbzwrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6124
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjhbzwrp.exe ups_ins
    3⤵
    PID:3784
  - - C:\Temp\i_uomjhbzwrp.exe
      C:\Temp\i_uomjhbzwrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5824
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rojgebztrl.exe ups_run
    3⤵
    PID:2456
  - - C:\Temp\rojgebztrl.exe
      C:\Temp\rojgebztrl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5352
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4124
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rojgebztrl.exe ups_ins
    3⤵
    PID:3624
  - - C:\Temp\i_rojgebztrl.exe
      C:\Temp\i_rojgebztrl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljdbywqol.exe ups_run
    3⤵
    PID:5444
  - - C:\Temp\rljdbywqol.exe
      C:\Temp\rljdbywqol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljdbywqol.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_rljdbywqol.exe
      C:\Temp\i_rljdbywqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqoigdyvtq.exe ups_run
    3⤵
    PID:2084
  - - C:\Temp\tqoigdyvtq.exe
      C:\Temp\tqoigdyvtq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqoigdyvtq.exe ups_ins
    3⤵
    PID:5408
  - - C:\Temp\i_tqoigdyvtq.exe
      C:\Temp\i_tqoigdyvtq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvqnlfa.exe ups_run
    3⤵
    PID:5188
  - - C:\Temp\igayvqnlfa.exe
      C:\Temp\igayvqnlfa.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvqnlfa.exe ups_ins
    3⤵
    PID:2280
  - - C:\Temp\i_igayvqnlfa.exe
      C:\Temp\i_igayvqnlfa.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspnlfdxvp.exe ups_run
    3⤵
    PID:2592
  - - C:\Temp\uspnlfdxvp.exe
      C:\Temp\uspnlfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspnlfdxvp.exe ups_ins
    3⤵
    PID:2468
  - - C:\Temp\i_uspnlfdxvp.exe
      C:\Temp\i_uspnlfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvsnkiusnk.exe ups_run
    3⤵
    PID:1568
  - - C:\Temp\xvsnkiusnk.exe
      C:\Temp\xvsnkiusnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5644
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvsnkiusnk.exe ups_ins
    3⤵
    PID:5232
  - - C:\Temp\i_xvsnkiusnk.exe
      C:\Temp\i_xvsnkiusnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxrpkh.exe ups_run
    3⤵
    PID:1940
  - - C:\Temp\pkhfzxrpkh.exe
      C:\Temp\pkhfzxrpkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5748
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxrpkh.exe ups_ins
    3⤵
    PID:4920
  - - C:\Temp\i_pkhfzxrpkh.exe
      C:\Temp\i_pkhfzxrpkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7fffb2fac188,0x7fffb2fac194,0x7fffb2fac1a0
      4⤵
      PID:3504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,13181639322662559252,4687809057256049995,262144 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,17971776966417629751,4466908075554656632,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:11
      4⤵
      System Time Discovery
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,1327530586318789474,11394554833095227251,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
      4⤵
      PID:6048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3608,i,128960044148559831,12982417818430550608,2097152 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,14724992461477687314,16612558319197239067,2097152 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:5160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11814518228654955325,16349258507216438041,2097152 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,9276728065386785691,4774817207599872280,2097152 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:9
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,4557597426910446963,16523121094408192992,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:14
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,17347725591211597959,405701795979133637,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,1566207701790279550,16107111247579570824,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:2244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4690707948109709348,13392029068771322102,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4690707948109709348,13392029068771322102,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:3768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,9915429067841577130,6060729419674611667,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1275810092912229958,18044040505854822677,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
      4⤵
      PID:5624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,11189123543702388042,4333793485126115784,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,5695212160681762912,3198830729960867506,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=1456 /prefetch:14
      4⤵
      PID:5312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,1299435806985689010,14315812870648510274,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
      4⤵
      PID:2024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,9436924982843258699,8499725183747827898,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,9906164796564034926,13772972549169292022,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,11957768697961122597,16190826174138765037,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
      4⤵
      PID:2912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,13082081670298799659,6359843112002117173,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5480,i,17793488205402582982,10336229548010187554,262144 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:10
      4⤵
      PID:1780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,17220376823383799731,5787695128363850779,524288 --field-trial-handle=2524,i,17156438599785427890,17997953555200883824,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
      4⤵
      PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5224

C:\Temp\nifaysqnifcavsqk.sys
C:\Temp\nifaysqnifcavsqk.sys
1⤵
- Executes dropped EXE
PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3472

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
- Executes dropped EXE
PID:4272

C:\Temp\mhecwusmkh.sys
C:\Temp\mhecwusmkh.sys
1⤵
- Executes dropped EXE
PID:5788

C:\Temp\urmjhezxrp.sys
C:\Temp\urmjhezxrp.sys
1⤵
- Executes dropped EXE
PID:5944

C:\Temp\jebwuomjhb.sys
C:\Temp\jebwuomjhb.sys
1⤵
- Executes dropped EXE
PID:5588

C:\Temp\qomjebvtqo.sys
C:\Temp\qomjebvtqo.sys
1⤵
- Executes dropped EXE
PID:1584

C:\Temp\jdbvtqliga.sys
C:\Temp\jdbvtqliga.sys
1⤵
- Executes dropped EXE
PID:788

C:\Temp\ywqoigaysq.sys
C:\Temp\ywqoigaysq.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\qnlfdavsqn.sys
C:\Temp\qnlfdavsqn.sys
1⤵
- Executes dropped EXE
PID:2896

C:\Temp\faxspnhfax.sys
C:\Temp\faxspnhfax.sys
1⤵
- Executes dropped EXE
PID:4480

C:\Temp\pmkhczurpm.sys
C:\Temp\pmkhczurpm.sys
1⤵
- Executes dropped EXE
PID:1376

C:\Temp\mheczuspjh.sys
C:\Temp\mheczuspjh.sys
1⤵
PID:2496

C:\Temp\kecwtromge.sys
C:\Temp\kecwtromge.sys
1⤵
PID:2188

C:\Temp\ebztrljgey.sys
C:\Temp\ebztrljgey.sys
1⤵
PID:5184

C:\Temp\uoljgbywqo.sys
C:\Temp\uoljgbywqo.sys
1⤵
PID:3136

C:\Temp\olgdbytqoi.sys
C:\Temp\olgdbytqoi.sys
1⤵
PID:4720

C:\Temp\dayvqnifdb.sys
C:\Temp\dayvqnifdb.sys
1⤵
PID:1204

C:\Temp\kifayvpnki.sys
C:\Temp\kifayvpnki.sys
1⤵
PID:5740

C:\Temp\kicaxvpnkf.sys
C:\Temp\kicaxvpnkf.sys
1⤵
PID:5824

C:\Temp\hfzxupmkhc.sys
C:\Temp\hfzxupmkhc.sys
1⤵
PID:668

C:\Temp\ecwurpmhec.sys
C:\Temp\ecwurpmhec.sys
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causmkecxu.sys

Path C:\Temp\causmkecxu.sys
Size 293KB
SHA256 e6c2507b1f065782be90f94b6bfda126dd9bb64e1372c0838c3da1c3bda9d185
MD5 7b8357036a162c447f3200fdd722fe47
SHA1 654ed67c3bb7ab130a700c7f815d39ba29d67e72
SHA512 6ae112a694da107b54667319c916e42f9e26247d9170e96510d84d0ee7a17119665dc0b188eb9f6a526baa5b43b7c00b689853685d6f3302cb2ac545d06a0aba
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbztrljdbv.exe

Path C:\Temp\dbztrljdbv.exe
Size 361KB
SHA256 f66bf75e8587b4ebe46d21a8f54a37b08f8cfb99dc0a54aa1336b60bde3b0b74
MD5 a4df3d00d78c091e0553bf120d3148c8
SHA1 14e2540d4669a71e93a9f6c839364172d618b81a
SHA512 1b8662661b685e7baaa779d8ce209184494ce3400a5ed66207bedabdb2edad4af1d1269324ebb9db4c91f3971ac6e2a765f00cf8622729179995e63e9badc9b4
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T12A747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etrljdbwto.exe

Path C:\Temp\etrljdbwto.exe
Size 361KB
SHA256 51fabec914eca8eac3c22072c88e1d2afa61402b89f7e29ba70c18631a4d5b24
MD5 a6c56d2ebe73d08e1f17ca090567f046
SHA1 623912bd74868fa9787f0b3cd56321bd38d17152
SHA512 68b0dca131c64c98a9081a3e5619c42260e8b22475aa231182241cff6219b8a376ad937fbd61b3cdbac533c77d7c50b4f49af2e0ee95f115e2bd599aadf7ce68
SSDEEP 6144:BflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:BflfAsiVGjSGecvX
TLSH
T114747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwuomjhez.exe

Path C:\Temp\ezwuomjhez.exe
Size 361KB
SHA256 ef19d19206c8b41d43fe27cc3770a8a9333aacacc036baf13f0b9da4d31e2204
MD5 5286335f0357d8d041b67ea38f039185
SHA1 7d4ffdb919edc3e1a5c1d71513ab6cbea28abfef
SHA512 9ce2185117126a6aa7a922f3d0c7d447fc02d0d245acefb3ab863c8c2fe5bbcfa7a9de4307443cff71e36d0315bddb9bf7b34f10382cbf3fcc71ac990616ebb8
SSDEEP 6144:gflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:gflfAsiVGjSGecvX
TLSH
T1EE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbztrljdbv.exe

Path C:\Temp\i_dbztrljdbv.exe
Size 361KB
SHA256 147bc4d97719af86ff7f3f38e0537738a131d1d804e6c49d3b037ac190a4016a
MD5 ec7964ae8b876ba9cf581dba81f3e5c6
SHA1 810eecee3c8b637a2cc9de993e572b5a48e629c6
SHA512 8b3538dc059cb65bc31f1fb68fc5c44a023cd8ed10143ee572a7a6779dc380efde348fecae21b04c1547e9c5a01f2b8a8bdb37938e0e02ac7066e0d6a61e6d22
SSDEEP 6144:8flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:8flfAsiVGjSGecvX
TLSH
T153747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_etrljdbwto.exe

Path C:\Temp\i_etrljdbwto.exe
Size 361KB
SHA256 8f96e9af0adb13aa4535a54041912f2fd74983df3e4434f6508e115f157d5af6
MD5 2feee97ba4392e66460f92e2ca2ea998
SHA1 82d811e90c47df6839fad21daecee72b44ca3695
SHA512 93e004b642186e86da84dafd3d42e3817f0f22a20cc60e931a769d4e0afa6e479eb20655712d52975e2a0119e04034095984d998dce64fe92a15c411f9796fdf
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T129747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwuomjhez.exe

Path C:\Temp\i_ezwuomjhez.exe
Size 361KB
SHA256 d6c1b01072934c4d50167a9180645eda338210395dd0d1bd84c309f60dc1a977
MD5 26e93ba0fbe2e20361c32550603c2500
SHA1 c69b0a9b567266ddfec4b3afc5bfd77fff37f71f
SHA512 1349e2abd1109c1d591aec80da3f0cceed9c2a5ef5da6978538c960aa46d214a432a0fa2222657cea0310641d01e4b122ddef199d760ccbbc799626ea6a91711
SSDEEP 6144:6flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:6flfAsiVGjSGecvX
TLSH
T18B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_pmheczxrpj.exe

Path C:\Temp\i_pmheczxrpj.exe
Size 361KB
SHA256 1eaaf4bda34f824f23a8a64df08ac9d5daa97223b4b760877143ae6a2ccbbe0a
MD5 7fcff93e1595cc0fae5165ec2b9a2197
SHA1 2f5f8c64d026d88a5d6d40435d19b28fd3aaab00
SHA512 586e5ee9cb59a7767a3826c0d4afcef1ef9c8a0cc9fd17271dceddb8f713731a41bc54b6c232245a40d7eafd4da12627438c2f9d880c277d827a025121c6bbcf
SSDEEP 6144:QflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:QflfAsiVGjSGecvX
TLSH
T1AE747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_spkhcausmk.exe

Path C:\Temp\i_spkhcausmk.exe
Size 361KB
SHA256 80f9832f32dccc8496f9e1a69849fa298798dc9468fc21e05f86b24b4318f662
MD5 fc5d42b6c85adf0f58db839bbeb9e27a
SHA1 0d9d2a415493ddfc667e6ab473e924481e9e4a33
SHA512 aa1134181b3b1115f26910102ae45a196b9e422dd00775a4eceb49eccfb9b5cd5e6fc90879fd290d9291120d313b2be6ab3b65165bc02dbbf28ad81092a915ee
SSDEEP 6144:XflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:XflfAsiVGjSGecvX
TLSH
T13F747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpkifaysq.exe

Path C:\Temp\i_xvpkifaysq.exe
Size 361KB
SHA256 d7a6a441f4726d1f62a3499e524edc809c97b9800bf676b5a502c5a7c71f6682
MD5 6891c51f9905854071677ed16a5339f7
SHA1 88861a049af80ed60d742ac2c458578cc86284fc
SHA512 9735d9226dba709c9fbb40f77d512a121f47e78fe8ad6f7979f4448b9574dde5c74ba5cae34356e474da2f5cb24e9be0e8ac0cc8a876f3c23de29258bb0969df
SSDEEP 6144:cflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:cflfAsiVGjSGecvX
TLSH
T1EA747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomjhb.sys

Path C:\Temp\jebwuomjhb.sys
Size 293KB
SHA256 a07eebc39265fa09285ed9697b91486d5f29915e7117c2cf8ae1497420575351
MD5 ef4a2326de81660dd3513f5105d6f1c3
SHA1 eed43534c32fd9f5e2eba97979e8713a434ab570
SHA512 54c7ae23fd5cd2e0bd28fbed0f995964c4b6a1a85978cf305ab62045400b927a4a51dfa3928165327c0749e1825f28e89eb19162a8b269e3fcfbde20222ecc60
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T106545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhecwusmkh.sys

Path C:\Temp\mhecwusmkh.sys
Size 293KB
SHA256 ab0b81620c04ee388e75d08e6b527bbf81648b8f4009cf6202a16869df379507
MD5 26a0d5515834b66d3a5153b6b32f71d9
SHA1 a0cf4b5efe346aa27a81a6d2794e2e70dd453757
SHA512 4b6e2edff828d2e16c4a92deb2db1482a6d28c16fb728a9bac457b0973a9f37f3c01b56589ae574405ed32bf3fa7838cbf564544e50c8886b1608a173c7aba0b
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B5545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqnifcavsqk.exe

Path C:\Temp\nifaysqnifcavsqk.exe
Size 361KB
SHA256 b94a83942ad283d7f54bc77c214e61dd0fa6a4581ba6ad23133b62f63c81e551
MD5 b2e7ea888b821735c507ce85982cdfc0
SHA1 5c74c2401d82f335693d70fdefd259f7a5c04509
SHA512 41bb567877ff239397ae81f2f9cea90365d8ff193611824983f3995890cfe71a5c232b905a14bd1993c4e0f1fa498a4388d7742f6cdc62513c258014a3a6b3fa
SSDEEP 6144:7flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:7flfAsiVGjSGecvX
TLSH
T188747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqnifcavsqk.sys

Path C:\Temp\nifaysqnifcavsqk.sys
Size 293KB
SHA256 f727e661cea0d287cf335cc5a47ba3bd4031cf745a2c9ec291cf650a2dd3b542
MD5 a64c97421307c0755b7c504773f03299
SHA1 0273b3fac7a9782851b285398fd957684196d5e1
SHA512 c5985f76297386a1aaf0cee1ebfc05db5ce1b25defff0995ed90ee2b41b7252c78e00a5ba52b1aec6316047849478cdf85f551bee4f4a4014f10d437e62ec27f
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T14B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pmheczxrpj.exe

Path C:\Temp\pmheczxrpj.exe
Size 361KB
SHA256 0ba5b8c36ae16b6d07a0bf0f1dd7c501cbd5e533a37bb17b48a5a6e6e1ef3bca
MD5 e52c3c5b82280c46f540d851ac0208ea
SHA1 ad69be99950d5cfe0433f0f5ec5a38b8ecd0ebac
SHA512 00d927beee3675463537b678e893a0bcf010f8b98cb34e7919741fc58b11fe2de4dc885bbb6b584fcafcccb0a6b1ab2ede8541da7489fe6c65ab5486576cb363
SSDEEP 6144:3flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:3flfAsiVGjSGecvX
TLSH
T1CC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qomjebvtqo.sys

Path C:\Temp\qomjebvtqo.sys
Size 293KB
SHA256 fedd200b2e93824d547801bbd475dc47e7d756b8bdb302339fb95716668de3f1
MD5 6f4f666bbd26bb5c0c15c500e5f9f8e8
SHA1 fda3bb7ebf7d621900273173e8fff9c74b9305e1
SHA512 a875b8d89bcf4e18faf34c0c8a456be33e28742d9133472edad8e8abb013ebc72ed82747cab97dc6f2a898d67bd9fdaa52c6fb093bd80251608c597817c459b3
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T134545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcausmk.exe

Path C:\Temp\spkhcausmk.exe
Size 361KB
SHA256 857a7ed24d5a8a1a7beaadacaf440d3ee3d287908d44d62bc98c45156ac437dc
MD5 971bf9a0da6ed3bef319b2fc19516e75
SHA1 aa4117c1310be26b6db0915c8144d9b0b7f06a02
SHA512 98a9ea35858729b30ea5c43a2f3b3a81e1e6166f09d357f18af065e8929b24df9755bd26d622de709572550b7686367d6cb56e04d53829ecfc1195eedfd20b33
SSDEEP 6144:+flfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:+flfAsiVGjSGecvX
TLSH
T1D5747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjhezxrp.sys

Path C:\Temp\urmjhezxrp.sys
Size 293KB
SHA256 d544f896b3713ec4b580c7ee439d4d50e6088ea2311951f4ef58d6fb27b0d490
MD5 4b7da7de02656caebcb45d8f19b45e4f
SHA1 c07e46f5545a3225cdeabf5af2d84ae06c9cb5cb
SHA512 39cd4a4484127594351df6cebd170d2808c60ccbba8cb412ea5d9763579d44bf175f13cbbddf938396e87313daabd1e27dee311fcb64090f21df9811bcd45cd9
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T198545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpkifaysq.exe

Path C:\Temp\xvpkifaysq.exe
Size 361KB
SHA256 447e0a233d63f9598cd1a891d3b20bcd8d416c2ede027a779dff752e643dc901
MD5 4d152e2a325e027a4493519e5072f86b
SHA1 bc88291cbef977545c4c39d9e9ae0443d7bbb743
SHA512 fd3907fa18f2049ba10bb1a6f5c0629ce6b365d20e064d6396bb65cf22d12c62ca40ff59dd12ac1982c41b6d2fd7e49633d866795ba749e16f2be4e10242fb0f
SSDEEP 6144:OflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:OflfAsiVGjSGecvX
TLSH
T181747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b07729a096ac170c497385e58f78a88ff23caf7ad94413809b57f34ffb7bf35
MD5 f9a3992ec8b0935066842eac918a7413
SHA1 35cbf9098e1ea31ae3a1e8ddc31c1eecd9dc7305
SHA512 393e68b52569c7f41b2e65121bd6ff416a77a0d679af32d7514bd0c234dfb8d46c01c958feec8490e784ab30137476bf50b4cbca0c4edf9e6a69b1294b343608
TLSH
T169D092A97A554B4ACC86353A65F2B667A610C97A404A86A88141B2B9C970382239F0AB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 76a21addb9a8403585cb6d4c200097790459a657b8a098d2fe5db3b9f38c6747
MD5 e0a8585e8697d0667c7e6d397b7bdcc8
SHA1 387b005d4e984f96b7cfe7a7878862d0adf7a6d4
SHA512 0d31d12cd56eaacacb90da9ca1e76754f8893b44d135408a438d83228ae4da8da98b89abb0cba26c8ad5cbb09acc5d285a4d4190d38f239700986357b2b8dee9
TLSH
T163D092A97A454B4ACC86353665F1B667A620C97A944A86A88041B2A9C970382239F0BB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 50b3505f21a125903134badeac33f753e18d8a405a9b90e76f9ab420c7504290
MD5 0975df5e74061e4f31a59cb771b682f7
SHA1 431afa67547e4048deb018ed6063ed410392565a
SHA512 8402c9b0ca3f62d62bec88ebf2477a8937aed1b9dce5159a7228689d62c047b79303f9e7cf3986fb596afbc9926b26b19186bdbaecfe63b6a8627edff4e5b680
TLSH
T1BD612B91273A0BF7E79D4DB2B0DD20C836B2655F510B6E28909497F48B7EB805CB25F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5927b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5927b2.TMP
Size 3KB
SHA256 a52feb4c364b3f24b72fc0f7004596eacef24bede8046dd02a5b1117bc6f393f
MD5 27cf6b96d3708c23685dd8eb5a9d8b69
SHA1 93fa00bc34dd1a9be45d17158ca3002b2dad46cc
SHA512 dae4ba4f62ad03efc172a7972d19a6f9045b8d11b9a8e7c518b98303920f81344bffc603dd327079c84945d827b86ccf008917eab707f4ee1d434e3515192601
TLSH
T1C9612B91233A1BF3E79D4CB2B0DD20C837B2555F410B6A28909497F48B7EB405CB25F8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5626e98d-4b85-48df-9ff4-422658ced5bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5626e98d-4b85-48df-9ff4-422658ced5bf.tmp
Size 2KB
SHA256 651911b734ba3a3aefdbf8a73f7d1ee83a4425b46e9f4ffe74af2790f3998f15
MD5 c71c9b0c36689249c582537c66533180
SHA1 e2767de9a62a94a9af0d45642e9c122680635131
SHA512 cb869254448e35a8830995f8de738027883fa747677990f1e5dcf09d46d7b011abced8534a009885ecd7b00dafa9166bf2a4cb68d6d646ac7120565b31b43ab4
TLSH
T1C4519CF3C3E8856ECA0156F4AA187E2BCE2D0915432C3D5AC9E4EF1B97E2471E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 511eda046042be59c8e44b8f5c5a3f9935e38d90cfc29f5004479ba97baf7c0e
MD5 cafcb78deb9d52469318dc932d8e42ab
SHA1 0322b44198baa7d843f3c142c126457eaa76983d
SHA512 68e33b48757e39865be9a4cb85fee91d56965e59ba744454a74d4351b5f8988582a8dd7d154c181cf5a7cbecd9e9bbb56ee09385bb09013eeec45e4b70c1749b
SSDEEP 192:sxRJR1yM/jK1Ml8wCs/f6JsO8p7QOZm8VtzoA8pi/g6+WNIYBdRG8GwIgtJ:sxRJN8s/fSsO8pMombi/5IeGk3
TLSH
T12552E9166A349937CCCBD209FA557F53D6F81573A2901E44AAFCCA0C05E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d22b65277e3f302da44f19cb1ef44e24ed73e21ff527fb963bbbab5228d804d8
MD5 fd6da2b7f014f777370af171c503cb0a
SHA1 6649aba0cb30509c0061fd4fc87a1e0d2780046e
SHA512 c9513085eeed6dba1353090821e3da324bf88ec8d2a17e11029f0549c10679a713f889231a47d9136aaeaac3b7909a57d430ad06f940c6e38260434b6d9ac7d0
SSDEEP 192:sxRqR1yM/jK1Ml8wCs/f6JsE8p7QOZm8VFzoA8p9j/g6+WNCOr/YBARG8GwIgD5J:sxRqv8s/fSsE8pMomHx/5j/DGkf
TLSH
T17162EA16AA349D378CDBD209FA557F53D6F90572A2901E44AAFCCB0C05E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b9b4dcc93a875fe38f05317fb81126808a732745f94475f770fec00a37ac45b3
MD5 22d6dbe1dcece366dee82290daca0220
SHA1 34eaf51c8f8fad59a90f83fd876d229759a93064
SHA512 497369bbe596e7cbb79b9ccbb027602b5059c427a7c13cd7003e3054d88250441295ff8ca5067910596276de314bf35ab9275ef27ea640253f856417d2655ea4
SSDEEP 192:sxRqR1yM/jK1Ml8UQBCs/f6JsE8p71OZm8VFzoA8prj/g6+WNCOr/YBFRG8GwIgp:sxRqvqYs/fSsE8p5omHX/5j/cGkp
TLSH
T1A462EA16AA349D778CDBD209FA557F93D6F80472A2941E44AAFCCB0C05E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 5f0a3976937ec0ba4d3dcf54192b78b0f98977180947e0e7cbb8b43648e16060
MD5 5a8b9a3af5ae0e823bf50a99e138ed17
SHA1 a3d2840cf5fe0e8191314c0780b4370870126e1e
SHA512 820a26738d9dc1b2863a56c1ced42ab6b2f1cb8579b0ae5ae0530805aad04547b13ac7361640b01c4bf6cdc4ba6f57c72c1d00c1a6906e398104f136b28a5f05
SSDEEP 768:Mi/qXD7pLuL7XmWgfDfOT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqFWyJjYro+qEiF:Mi/qX1E7XmWgfDfOTu1ja1FWgjj+Y
TLSH
T1ACE2EC7B680CCB7E4F804A9CEC397D9A6DA802CB56D8CD9447FA884C03C67EB55164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 09cbee056a083d8cba177679b7f8db792c2dbbdc0185de50fef6428fc2151214
MD5 97fa3325a669fab2ea2417a4992317b6
SHA1 f726981a87d121f4ccb2146de5dd8927243530fe
SHA512 90dffe395c0f4288e251315d6996de198c70d7f5125a777d35f92c2886ad4ec7e9ca88fa2ae7fa00ec45db64752e36bc41a518e310f4f1ca683bc01686ef0670
SSDEEP 96:KRJGXThDXzWnUCgbzK4qgVzcZRsPXQH2r6WwYY+Wo9lg2+K4Lgk+ce2VUGAxEwCt:CJGXThDXinUDbpqgVgZRsPXQH2r6WwYY
TLSH
T1E291B004747F168038FE5A8881AC8C59D1C6B0A53529E83B779915F61F27D02AFFF8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c3c3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c3c3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 59df60ca521c9eda9860ba447b59efceaff4acca3e64af0c2dfa9125d3a31529
MD5 027ebe399fecea2e2a35fbd6417540fb
SHA1 9d5cd8c3b091e3b7294284b26cc2d24cb760a9e3
SHA512 5cd7f12f8ad26f389eb5359b23c3dc5c8c81c25086d09a64a4510d3fd1b49a1bd7127023e568bccfed3c683e27dcd2074ba94cdc5ae4b750898713761f81ef54
SSDEEP 768:1CF1j+9a3xwgR/t3JNAgyHtFv3QKfQHPWoeT0dU1TLxb9MZ:Z9a3Bxn43Q6Qeow0Gtlb+Z
TLSH
T1301339F299D78936D89E8787637E2E869EFCD163B1841984FBD85D0CCC821BFC606811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6370580f719df9e49a79f96fe9f5715c3eecb63b543b5f09c83f182ab34aa1e7
MD5 6c9d53a80845168f7d7e7095dc05e954
SHA1 3a7a3f35a2b7b73128522912d7e29da3d3875493
SHA512 f6319336a3a30eb100100d250a9b39a6b15cb80fe9bbc1acb3108661056b008d205fe85b00ab72cb51e1a3f8534fb4c1b72d907d96a530f927dd5947c942401d
SSDEEP 768:Xrv+4UNbdM3qZVl9ZsyHtFS3QKfQHPWoeT0dU1TrpUiQH:XbsbG3q7e3Q6Qeow0GtFUJ
TLSH
T11603C032AA988537DCE3D18573477683BFB4215382C01B84D8FD6B0D42C74AD230B9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a96319538f30b3c0bad7df86ee7b33474b90c3b3fd78f65625378caa9452229d
MD5 e48577c4162f6dbf3ae1e76eaed53e20
SHA1 eb3fc5c3fff33687db8624db3fcfc9c8cbcc4c32
SHA512 7d2654e14e161421dca44a8d1f08037bf7bf9c4ef25280351b5bfbf2e27c3ef451c7489e01961d32f67e6631a4e907e7080e0bf1483ffe01aa33ae0658115334
SSDEEP 768:hrv+4UNbd33n/t3KNl9ZsyHtFU3QKfQHPWoeT0dU1TLxm6:hbsbh3nxmg3Q6Qeow0Gtlm6
TLSH
T1FE03BF71B9A8D9339CE7D184B2477683BFB4216382C41E98D9E96F0D45C75EE270B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a6104e373b447cf8460e57313ec6e09bd61249de812a8d48ff5bb9eabaf27ec4
MD5 057c52006081ec8cb19afc3243dca40d
SHA1 41667e0a788142ec06764973b0f1fd65c855b17f
SHA512 29d50303e0bd6b8f43e9a19dbe9972c54a67d5463cf4e30b410843d71e64d128ece7a7eb666d1222e1e47f3008b9876552c5ab24bd3832f76dbd3f722fb840f5
SSDEEP 768:/j+9d3n/t3kNl9ZsyHtFK3QKfQHPWoeT0dU1TLxb9MZ:y9d3nxw23Q6Qeow0Gtlb+Z
TLSH
T126F2AF71A9A58D238CD7D18573473B87EFF0217386C41E88D9E9AF0D05C36AD1747826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d8e9650290c5fb93f569fa78c43f84331209240efd945df23b71f4306e75343
MD5 218e7d7c9724ae3360d9018e83a6be4c
SHA1 2cb04728fd6d7a59fe7db029f508d2ceb72a5db7
SHA512 d992098d6699e4a2022579292251ea78cca23dcca946799d3729646808785734b9f1355104868012a5d1ea93e1387059282fbf646f8c469ba34f5847229ce8a2
SSDEEP 768:ej+9d3S/t3kNl9ZsyHtFK3QKfQHPWoeT0dU1TLxb9MZ:d9d3Sxw23Q6Qeow0Gtlb+Z
TLSH
T118F2AF71A9A58D338CD7D18573473B87AFF021B386C41E88D9E9AF0D05C36AD170B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

5bc5e6eb-f0b8-4c18-8c72-cc4c7b7b2dfe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bc5e6eb-f0b8-4c18-8c72-cc4c7b7b2dfe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3336_140366877\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 926ba8b98032f7028c0742c7ee193b1d1338189c63120653746d358987722235
MD5 1c61277b362d8f16c99214d080b5863d
SHA1 1af55f97869241a8192051fa677ccb3d9590b1d6
SHA512 0431e9c70c7525f4ad8ea9524359430a5b406646a32df2cf54ce07f4239ac79b77ea89583ff7cadfcf0a58dec818a6ca241f5201eb0315bb030916d07201c8c8
TLSH
T1CE71239357B9C6B3C2DA5BF502835244F5FB23784723702447565587BB30B7A58B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/668-508-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/788-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1204-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1232-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1376-379-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1584-299-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1920-512-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2188-403-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2496-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-334-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2896-367-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3136-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4272-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4480-349-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5184-423-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5588-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5588-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5740-479-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5788-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5824-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5944-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download