systex | ba7f9b0307121e2095f38ade83a02f218adfd8de13fcdc54470f77804fa77f68

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 361KB
Sample260710-slwlrsd13t
SHA256 ba7f9b0307121e2095f38ade83a02f218adfd8de13fcdc54470f77804fa77f68
MD5 8fa891cb624709629e20631839857b19
SHA1 bf423923ce4e8f287629db67c80bb0c68ae21b6a
SHA512 83c6914081f75fbd81dfb6118ee6c3e64e557ec5778b14b9b45be7523a86d9a81610d8dc6e8aaa32482cd595ea5bd6bf1de7c9fc7d223566ed61ec996a0f642e
SSDEEP 6144:nflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:nflfAsiVGjSGecvX
TLSH
T168747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4828	mgeywromjeuoljdb.exe
4196	mgeywromjeuoljdb.sys
2004	CreateProcess.exe
4668	jgbywqomge.exe
2280	CreateProcess.exe
3672	CreateProcess.exe
1500	i_jgbywqomge.exe
1028	ztrljdbvtr.sys
1084	CreateProcess.exe
624	tolgdbwtgd.exe
3164	CreateProcess.exe
3548	CreateProcess.exe
2096	i_tolgdbwtgd.exe
3572	ytqolgdyvq.sys
5960	CreateProcess.exe
5952	vtnlfdyvqo.exe
3804	CreateProcess.exe
4852	CreateProcess.exe
5948	i_vtnlfdyvqo.exe
3120	dxvsnlidav.sys
1384	CreateProcess.exe
4768	sqnifaysqn.exe
3960	CreateProcess.exe
2344	CreateProcess.exe
2112	i_sqnifaysqn.exe
5596	faysqkicau.sys
1552	CreateProcess.exe
3144	xspkicausp.exe
1624	CreateProcess.exe
1468	CreateProcess.exe
1608	i_xspkicausp.exe
3436	qkicausmki.sys
2732	CreateProcess.exe
4160	xusmhfcxrp.exe
2064	CreateProcess.exe
5208	CreateProcess.exe
2324	i_xusmhfcxrp.exe
2244	xupmhfcxup.sys
1416	CreateProcess.exe
1800	pmhfzxupnh.exe
4756	CreateProcess.exe
2756	CreateProcess.exe
5572	i_pmhfzxupnh.exe
4964	cwuomgezwr.sys
2112	CreateProcess.exe
2152	omjecwuomg.exe
1368	CreateProcess.exe
4796	CreateProcess.exe
5180	i_omjecwuomg.exe
1856	hbzwrljhbz.sys
4716	CreateProcess.exe
4860	ywqojgeywr.exe
2880	CreateProcess.exe
4100	CreateProcess.exe
252	i_ywqojgeywr.exe
5940	eywrojhbyw.sys
4260	CreateProcess.exe
4172	trljdbywto.exe
5024	CreateProcess.exe
3392	CreateProcess.exe
1948	i_trljdbywto.exe
4196	vtnligaytq.sys
3540	CreateProcess.exe
6100	wqoigaytqo.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1650054869\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1138954704\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1138954704\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1138954704\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1650054869\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1836156600\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1836156600\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1138954704\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2492_1431866087\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trlgdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgdbwtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqnifaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhfzxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgbywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgbywqomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgdbwtgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusmhfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wqoigaytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wurmkecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wurmkecwur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjebzwrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trlgdbvtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqlfdavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfzxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqnifaysqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfzxrpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjebzwrmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhfzxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trljdbywto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxvsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeywqolj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgeywromjeuoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusmhfcxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omjecwuomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wqoigaytqo.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
544	ipconfig.exe
4984	ipconfig.exe
4472	ipconfig.exe
3704	ipconfig.exe
572	ipconfig.exe
3268	ipconfig.exe
928	ipconfig.exe
2836	ipconfig.exe
5448	ipconfig.exe
3888	ipconfig.exe
5884	ipconfig.exe
756	ipconfig.exe
3968	ipconfig.exe
4356	ipconfig.exe
1416	ipconfig.exe
4260	ipconfig.exe
5884	ipconfig.exe
704	ipconfig.exe
2448	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281700113495559"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{E2E49343-5930-4F16-AA40-449E58FEF12C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe
4828	mgeywromjeuoljdb.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe
2492	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	i_jgbywqomge.exe
Token: SeDebugPrivilege	2096	i_tolgdbwtgd.exe
Token: SeDebugPrivilege	5948	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	2112	i_sqnifaysqn.exe
Token: SeDebugPrivilege	1608	i_xspkicausp.exe
Token: SeDebugPrivilege	2324	i_xusmhfcxrp.exe
Token: SeDebugPrivilege	5572	i_pmhfzxupnh.exe
Token: SeDebugPrivilege	5180	i_omjecwuomg.exe
Token: SeDebugPrivilege	252	i_ywqojgeywr.exe
Token: SeDebugPrivilege	1948	i_trljdbywto.exe
Token: SeDebugPrivilege	3176	i_wqoigaytqo.exe
Token: SeDebugPrivilege	3356	i_ysqlfdavtn.exe
Token: SeDebugPrivilege	2764	i_vpnhfaxvsq.exe
Token: SeDebugPrivilege	796	i_vpnhfzxrpn.exe
Token: SeDebugPrivilege	6016	i_xupnhfzxrp.exe
Token: SeDebugPrivilege	4652	i_wurmkecwur.exe
Token: SeDebugPrivilege	1288	i_mjebzwrmjh.exe
Token: SeDebugPrivilege	1844	i_ojgeywqolj.exe
Token: SeDebugPrivilege	1080	i_trlgdbvtol.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 4828	4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 4400 wrote to memory of 5108	4400	2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 5108 wrote to memory of 2492	5108	iexplore.exe	91
PID 2492 wrote to memory of 2932	2492	msedge.exe	92
PID 2492 wrote to memory of 2604	2492	msedge.exe	93
PID 2492 wrote to memory of 3832	2492	msedge.exe	94
PID 2492 wrote to memory of 3832	2492	msedge.exe	94
PID 2492 wrote to memory of 4448	2492	msedge.exe	95
PID 2492 wrote to memory of 4448	2492	msedge.exe	95
PID 2492 wrote to memory of 4448	2492	msedge.exe	95
PID 2492 wrote to memory of 4800	2492	msedge.exe	98
PID 2492 wrote to memory of 3860	2492	msedge.exe	97
PID 2492 wrote to memory of 4800	2492	msedge.exe	98
PID 2492 wrote to memory of 4800	2492	msedge.exe	98
PID 2492 wrote to memory of 3860	2492	msedge.exe	97
PID 2492 wrote to memory of 3860	2492	msedge.exe	97
PID 2492 wrote to memory of 1236	2492	msedge.exe	99
PID 2492 wrote to memory of 3576	2492	msedge.exe	100
PID 2492 wrote to memory of 1236	2492	msedge.exe	99
PID 2492 wrote to memory of 1236	2492	msedge.exe	99
PID 2492 wrote to memory of 3576	2492	msedge.exe	100
PID 2492 wrote to memory of 3576	2492	msedge.exe	100
PID 2492 wrote to memory of 2548	2492	msedge.exe	101
PID 2492 wrote to memory of 2548	2492	msedge.exe	101
PID 4828 wrote to memory of 2004	4828	mgeywromjeuoljdb.exe	105
PID 4668 wrote to memory of 2280	4668	jgbywqomge.exe	108
PID 2492 wrote to memory of 2488	2492	msedge.exe	111
PID 2492 wrote to memory of 2148	2492	msedge.exe	112
PID 2492 wrote to memory of 2488	2492	msedge.exe	111
PID 2492 wrote to memory of 2148	2492	msedge.exe	112
PID 2492 wrote to memory of 3840	2492	msedge.exe	114
PID 2492 wrote to memory of 4356	2492	msedge.exe	115
PID 2492 wrote to memory of 4356	2492	msedge.exe	115
PID 2492 wrote to memory of 2308	2492	msedge.exe	118
PID 2492 wrote to memory of 2308	2492	msedge.exe	118
PID 4828 wrote to memory of 3672	4828	mgeywromjeuoljdb.exe	119
PID 4828 wrote to memory of 1084	4828	mgeywromjeuoljdb.exe	123
PID 624 wrote to memory of 3164	624	tolgdbwtgd.exe	125
PID 4828 wrote to memory of 3548	4828	mgeywromjeuoljdb.exe	128
PID 4828 wrote to memory of 5960	4828	mgeywromjeuoljdb.exe	132
PID 5952 wrote to memory of 3804	5952	vtnlfdyvqo.exe	134
PID 4828 wrote to memory of 4852	4828	mgeywromjeuoljdb.exe	137
PID 2492 wrote to memory of 3860	2492	msedge.exe	139
PID 2492 wrote to memory of 3860	2492	msedge.exe	139
PID 2492 wrote to memory of 3860	2492	msedge.exe	139
PID 2492 wrote to memory of 6100	2492	msedge.exe	140
PID 2492 wrote to memory of 6100	2492	msedge.exe	140
PID 2492 wrote to memory of 6100	2492	msedge.exe	140
PID 4828 wrote to memory of 1384	4828	mgeywromjeuoljdb.exe	144
PID 4768 wrote to memory of 3960	4768	sqnifaysqn.exe	146
PID 4828 wrote to memory of 2344	4828	mgeywromjeuoljdb.exe	149
PID 2492 wrote to memory of 5216	2492	msedge.exe	151
PID 2492 wrote to memory of 2776	2492	msedge.exe	152
PID 2492 wrote to memory of 3456	2492	msedge.exe	153
PID 4828 wrote to memory of 1552	4828	mgeywromjeuoljdb.exe	156
PID 3144 wrote to memory of 1624	3144	xspkicausp.exe	158
PID 4828 wrote to memory of 1468	4828	mgeywromjeuoljdb.exe	161
PID 2492 wrote to memory of 1588	2492	msedge.exe	163
PID 2492 wrote to memory of 1588	2492	msedge.exe	163
PID 2492 wrote to memory of 1588	2492	msedge.exe	163
PID 4828 wrote to memory of 2732	4828	mgeywromjeuoljdb.exe	166
PID 4160 wrote to memory of 2064	4160	xusmhfcxrp.exe	168
PID 4828 wrote to memory of 5208	4828	mgeywromjeuoljdb.exe	171
PID 4828 wrote to memory of 1416	4828	mgeywromjeuoljdb.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_8fa891cb624709629e20631839857b19_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Temp\mgeywromjeuoljdb.exe
  C:\Temp\mgeywromjeuoljdb.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgbywqomge.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2004
  - - C:\Temp\jgbywqomge.exe
      C:\Temp\jgbywqomge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2280
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgbywqomge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3672
  - - C:\Temp\i_jgbywqomge.exe
      C:\Temp\i_jgbywqomge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgdbwtgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1084
  - - C:\Temp\tolgdbwtgd.exe
      C:\Temp\tolgdbwtgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4472
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgdbwtgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3548
  - - C:\Temp\i_tolgdbwtgd.exe
      C:\Temp\i_tolgdbwtgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5960
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5952
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4852
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqnifaysqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1384
  - - C:\Temp\sqnifaysqn.exe
      C:\Temp\sqnifaysqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3960
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqnifaysqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2344
  - - C:\Temp\i_sqnifaysqn.exe
      C:\Temp\i_sqnifaysqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkicausp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1552
  - - C:\Temp\xspkicausp.exe
      C:\Temp\xspkicausp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkicausp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1468
  - - C:\Temp\i_xspkicausp.exe
      C:\Temp\i_xspkicausp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusmhfcxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2732
  - - C:\Temp\xusmhfcxrp.exe
      C:\Temp\xusmhfcxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusmhfcxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5208
  - - C:\Temp\i_xusmhfcxrp.exe
      C:\Temp\i_xusmhfcxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhfzxupnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1416
  - - C:\Temp\pmhfzxupnh.exe
      C:\Temp\pmhfzxupnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4756
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhfzxupnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2756
  - - C:\Temp\i_pmhfzxupnh.exe
      C:\Temp\i_pmhfzxupnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omjecwuomg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2112
  - - C:\Temp\omjecwuomg.exe
      C:\Temp\omjecwuomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omjecwuomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4796
  - - C:\Temp\i_omjecwuomg.exe
      C:\Temp\i_omjecwuomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4716
  - - C:\Temp\ywqojgeywr.exe
      C:\Temp\ywqojgeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4860
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2880
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\i_ywqojgeywr.exe
      C:\Temp\i_ywqojgeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trljdbywto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\trljdbywto.exe
      C:\Temp\trljdbywto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trljdbywto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3392
  - - C:\Temp\i_trljdbywto.exe
      C:\Temp\i_trljdbywto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wqoigaytqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3540
  - - C:\Temp\wqoigaytqo.exe
      C:\Temp\wqoigaytqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6100
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2640
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wqoigaytqo.exe ups_ins
    3⤵
    PID:2960
  - - C:\Temp\i_wqoigaytqo.exe
      C:\Temp\i_wqoigaytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3176
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqlfdavtn.exe ups_run
    3⤵
    PID:1072
  - - C:\Temp\ysqlfdavtn.exe
      C:\Temp\ysqlfdavtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3296
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqlfdavtn.exe ups_ins
    3⤵
    PID:4772
  - - C:\Temp\i_ysqlfdavtn.exe
      C:\Temp\i_ysqlfdavtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxvsq.exe ups_run
    3⤵
    PID:4460
  - - C:\Temp\vpnhfaxvsq.exe
      C:\Temp\vpnhfaxvsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5448
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxvsq.exe ups_ins
    3⤵
    PID:4472
  - - C:\Temp\i_vpnhfaxvsq.exe
      C:\Temp\i_vpnhfaxvsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfzxrpn.exe ups_run
    3⤵
    PID:2464
  - - C:\Temp\vpnhfzxrpn.exe
      C:\Temp\vpnhfzxrpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfzxrpn.exe ups_ins
    3⤵
    PID:6048
  - - C:\Temp\i_vpnhfzxrpn.exe
      C:\Temp\i_vpnhfzxrpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxrp.exe ups_run
    3⤵
    PID:416
  - - C:\Temp\xupnhfzxrp.exe
      C:\Temp\xupnhfzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxrp.exe ups_ins
    3⤵
    PID:1856
  - - C:\Temp\i_xupnhfzxrp.exe
      C:\Temp\i_xupnhfzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wurmkecwur.exe ups_run
    3⤵
    PID:1536
  - - C:\Temp\wurmkecwur.exe
      C:\Temp\wurmkecwur.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wurmkecwur.exe ups_ins
    3⤵
    PID:2972
  - - C:\Temp\i_wurmkecwur.exe
      C:\Temp\i_wurmkecwur.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjebzwrmjh.exe ups_run
    3⤵
    PID:4328
  - - C:\Temp\mjebzwrmjh.exe
      C:\Temp\mjebzwrmjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjebzwrmjh.exe ups_ins
    3⤵
    PID:672
  - - C:\Temp\i_mjebzwrmjh.exe
      C:\Temp\i_mjebzwrmjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeywqolj.exe ups_run
    3⤵
    PID:1176
  - - C:\Temp\ojgeywqolj.exe
      C:\Temp\ojgeywqolj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeywqolj.exe ups_ins
    3⤵
    PID:3888
  - - C:\Temp\i_ojgeywqolj.exe
      C:\Temp\i_ojgeywqolj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trlgdbvtol.exe ups_run
    3⤵
    PID:2768
  - - C:\Temp\trlgdbvtol.exe
      C:\Temp\trlgdbvtol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2584
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trlgdbvtol.exe ups_ins
    3⤵
    PID:4144
  - - C:\Temp\i_trlgdbvtol.exe
      C:\Temp\i_trlgdbvtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1080
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffee37ac188,0x7ffee37ac194,0x7ffee37ac1a0
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,13875186875006635841,6265977820780935427,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
      4⤵
      System Time Discovery
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,2247657431971104862,16784023413257300817,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
      4⤵
      PID:3832
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,13710559977277936379,1301536594774304558,262144 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
      4⤵
      PID:4448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,12484766541540558736,264376934157234240,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,10225601393401307470,15853754062063171760,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,12576702874498878821,12805389153562911787,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,12365637718776473879,9098505797443397898,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
      4⤵
      PID:3576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17726500684395822553,11040679222159994191,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3800410379800352588,2704277314896244433,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7136937363515351287,16952574578954257856,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2378645375761657382,14791142228188400553,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2378645375761657382,14791142228188400553,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,17015762133268575178,5971808981626344414,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,9589840777223336802,2267524878623758132,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4936,i,7854331556853776409,6145048739961699402,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
      4⤵
      PID:3860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3676,i,2156406032834491209,3560737363106578886,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14205322420668300499,8979218688243343288,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:14
      4⤵
      PID:5216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,5729514964766877689,15022883326955123556,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,3313540248984852056,17200449629732826388,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5192,i,9996455427537911955,6219924806337289001,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
      4⤵
      PID:1588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,18412909911910398615,7636791801478311861,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6576,i,3669907544981624431,8473263074935169999,2097152 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,3373117341194568227,15577960810844898559,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:3456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=920,i,547933294040852511,8374086668410107618,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:14
      4⤵
      PID:1028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,4079614273812367774,11225333769498460978,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
      4⤵
      PID:2768
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2332,i,16170034313675036990,14441267607048530613,262144 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:10
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,17812400722627723012,2434688290973532884,524288 --field-trial-handle=2848,i,16990841155848306722,8264427303264610931,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:2704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5820

C:\Temp\mgeywromjeuoljdb.sys
C:\Temp\mgeywromjeuoljdb.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3296

C:\Temp\ztrljdbvtr.sys
C:\Temp\ztrljdbvtr.sys
1⤵
- Executes dropped EXE
PID:1028

C:\Temp\ytqolgdyvq.sys
C:\Temp\ytqolgdyvq.sys
1⤵
- Executes dropped EXE
PID:3572

C:\Temp\dxvsnlidav.sys
C:\Temp\dxvsnlidav.sys
1⤵
- Executes dropped EXE
PID:3120

C:\Temp\faysqkicau.sys
C:\Temp\faysqkicau.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\qkicausmki.sys
C:\Temp\qkicausmki.sys
1⤵
- Executes dropped EXE
PID:3436

C:\Temp\xupmhfcxup.sys
C:\Temp\xupmhfcxup.sys
1⤵
- Executes dropped EXE
PID:2244

C:\Temp\cwuomgezwr.sys
C:\Temp\cwuomgezwr.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\hbzwrljhbz.sys
C:\Temp\hbzwrljhbz.sys
1⤵
- Executes dropped EXE
PID:1856

C:\Temp\eywrojhbyw.sys
C:\Temp\eywrojhbyw.sys
1⤵
- Executes dropped EXE
PID:5940

C:\Temp\vtnligaytq.sys
C:\Temp\vtnligaytq.sys
1⤵
- Executes dropped EXE
PID:4196

C:\Temp\xvtnlfdxvt.sys
C:\Temp\xvtnlfdxvt.sys
1⤵
PID:2768

C:\Temp\vsnkicaysq.sys
C:\Temp\vsnkicaysq.sys
1⤵
PID:2336

C:\Temp\axvpnifaxs.sys
C:\Temp\axvpnifaxs.sys
1⤵
PID:4724

C:\Temp\causmkecxu.sys
C:\Temp\causmkecxu.sys
1⤵
PID:4296

C:\Temp\xupmhezwuo.sys
C:\Temp\xupmhezwuo.sys
1⤵
PID:5616

C:\Temp\omgebwuomj.sys
C:\Temp\omgebwuomj.sys
1⤵
PID:4996

C:\Temp\wuomgebzwr.sys
C:\Temp\wuomgebzwr.sys
1⤵
PID:5152

C:\Temp\bwtomgeywq.sys
C:\Temp\bwtomgeywq.sys
1⤵
PID:2716

C:\Temp\qnlgdywqol.sys
C:\Temp\qnlgdywqol.sys
1⤵
PID:960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dxvsnlidav.sys

Path C:\Temp\dxvsnlidav.sys
Size 293KB
SHA256 986e893312bf31a27234d843b8d5418e9dd6f23811e538a54592e1c4b1b7f900
MD5 c230ed51515b2c62572340ebc1191343
SHA1 7e55df53f45fc1b32636a110bee464727b46a921
SHA512 73e48f565da07aaf77304f1707bfea6817511ecf3be0877f1ceff6c437606ad97b0a7afe5fd5ece17405c1a2c2394cbd0e76eb174874a26b5f8efe2acbf1727c
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T179545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faysqkicau.sys

Path C:\Temp\faysqkicau.sys
Size 293KB
SHA256 6de39854d771f4dd53cc10a2e45033d3473d94d6752a8a1fd1dfaefbda74f33d
MD5 5ba04e69693a63152eab5b551b32b37e
SHA1 9c53f2d7d891c4b93dfeb1865011f775380c7a5a
SHA512 14ab954cfac7c1d1a1d69e920287c9b45a0dcf9cd52d695f4df424b21f6ba643ddd827b9e9458e37dcdbbfaf5314a35f4c0f80fc76f8a0914e1497d8b0832995
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgbywqomge.exe

Path C:\Temp\i_jgbywqomge.exe
Size 361KB
SHA256 239cb2661fb6ebf182c577198f4d931c1c7f89bf3b362c306480087c6ec5cb37
MD5 1be02aa200f04a5191fec20159ee1e2b
SHA1 cfa736bbc96ae244c41c7966b67aa522e1dc14e6
SHA512 5faf9f6e800c93c1dbc4ca4941dcdf75b3ec31fa44932d9165a6bae58c7ea331b2b5d37f2db02031628728b2198d43944608eefbe5abc1a4c46c809a5e1b821c
SSDEEP 6144:hflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:hflfAsiVGjSGecvX
TLSH
T1C7747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqnifaysqn.exe

Path C:\Temp\i_sqnifaysqn.exe
Size 361KB
SHA256 bd144838a785b0301574b933d052b2cea963698eab84b594d16efdf3db01242c
MD5 2413e2e47a6a4bcb1083cdcc86203d7c
SHA1 202606057316d503e2bd02d615c19fec14328d72
SHA512 bba06468c2da1e0b0956c2c9c2306be1775e98678bb5f6cfa2e3930e53dc2c01529e094b069465f1031f5b70fa54a8b9952240fc0215d2db210abf72d5ae825f
SSDEEP 6144:TflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:TflfAsiVGjSGecvX
TLSH
T1D0747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tolgdbwtgd.exe

Path C:\Temp\i_tolgdbwtgd.exe
Size 361KB
SHA256 b58c0a229af9d51190b6899c25396a301bbbd86f01e0e49ccefbbf56ab6fcbf8
MD5 79b34cb38e30245f761964f29711e0da
SHA1 0e445f1761fa3512304d00d922a14a4e371c643c
SHA512 824c8d9eba574282700ec19d9eca297ec023ec50c728058aab04d29cc8719069f2b3bcc6a1b88c7674ef2cd6ae9686bb012d9b3308dab5dfa3fb549ed23c9173
SSDEEP 6144:rflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:rflfAsiVGjSGecvX
TLSH
T19B747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqo.exe

Path C:\Temp\i_vtnlfdyvqo.exe
Size 361KB
SHA256 ab75d3f9a8072ca69fc353a16f74ccee380711922ff47a4f3954970e7c78486b
MD5 832856f4781a50e3273858a1093108b8
SHA1 dac745796a619f0101b82f8cc9486cdeb798e242
SHA512 ecc96c200ce33fbc3bf18892f03a6f627181c4b8678025e7492075ef25e4889fe21f8daad9fa2991b027161e9a9ed5760954fab952c7b4847c2c98bfd3640aa7
SSDEEP 6144:jflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:jflfAsiVGjSGecvX
TLSH
T190747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicausp.exe

Path C:\Temp\i_xspkicausp.exe
Size 361KB
SHA256 11e512c6744414bb372146530f6f07930560566ede3e06e7bcefc0ef1f41ca22
MD5 3be850291562c6b2ae0b9e488f50d743
SHA1 958b3386c43ff10b23b02b47664d00d40ba40ebc
SHA512 9b8ba8e5fb594a4b54c8f70dbdaeaec5c2131ed80aa816eb6d4266842b95a5f375f34df865c1818dd9d32ce49a379ebedcf8ece2ae049227b8f84219b04e5b6f
SSDEEP 6144:AflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:AflfAsiVGjSGecvX
TLSH
T18D747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgbywqomge.exe

Path C:\Temp\jgbywqomge.exe
Size 361KB
SHA256 f9e905b444672467619be28d2cc6c13aa09520091839b06ce322d5ddb3c6e5e7
MD5 16096500c666a59bd8fc8b033a45960a
SHA1 bd1284b1b0ed65bc9fc0c1ab07f0f8728e4c8a40
SHA512 9144e8a969d602b5692880782c1ccecee4d3383a34f80d9010e8f8e0e359eb15c0883f9ff419af187130d0139d51d01547d7e7d302630adcdb2d788fc0a82680
SSDEEP 6144:yflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:yflfAsiVGjSGecvX
TLSH
T1EC747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywromjeuoljdb.exe

Path C:\Temp\mgeywromjeuoljdb.exe
Size 361KB
SHA256 d35432f57f2392e152bc4f656d2a26adefc2b7443b96ba02bb3252e41a64aea0
MD5 73a9c5c89365f4344acfe18132bcc2a2
SHA1 08819e4d0aec54ac174670cba5c52a6287d4e59c
SHA512 2c99ebf495a379fe1a56015c0d274057d5b728754da0fd89247a989db1723b94ce68ce73c233c6f56b390fdc0b69700d74b3df00e25e274fd86dc613426caf7d
SSDEEP 6144:fflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:fflfAsiVGjSGecvX
TLSH
T12E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgeywromjeuoljdb.sys

Path C:\Temp\mgeywromjeuoljdb.sys
Size 293KB
SHA256 988681d5ed70e4e877d6bbc0edaa62645210eabf6ed752adcf9caaca00a94c52
MD5 3e641316d8952e452088fccc1fe6ecc4
SHA1 e0fd19efc0d07d47e9c7edc5e6007c669a25f4ec
SHA512 69a274689bfe74adc2007333987963349e865d672808d4caf8e80b5ba6759090d32df50b2cd76b5858fb4c6e8c8a69c34f67f67acd72efc194d4f741df8050f7
SSDEEP 3072:etKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:eIJjiJcbI03GBc3ucY5DCSj
TLSH
T135545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qkicausmki.sys

Path C:\Temp\qkicausmki.sys
Size 293KB
SHA256 928c39125902b06ef5ac8f60103b3188e2d6c83ec040385e6d972f422100a26f
MD5 a0a49f4dd6643d1af97a7c28df4291f2
SHA1 37b0f4e602ed926dc48e5b7330cf448a7c3ac97e
SHA512 ef4478c84594a4dc190b81b7258388ee83d2ad9c98c7905081b0f2f8faa60f8380918ed0f604a50342d2531ddfd6b45140aa12ceb429d2fc49ec77d8810681db
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T116545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnifaysqn.exe

Path C:\Temp\sqnifaysqn.exe
Size 361KB
SHA256 2dccf202a0a0831ad17e9fcadd08d75f4e735a383ada3f39d610c5d66850a77a
MD5 6c87625fd9e2529d5547e705e585647f
SHA1 2b71d7516709cc2c0279ea4544b265119649ec3e
SHA512 1af96a31c5d136f4b305062604f8485285826a83b052ac2942256101e9a038cbae25486e795cb5f34c1b2cd3b18b86c729e6e42baf991ae53b8321a35db5c36f
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T105747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tolgdbwtgd.exe

Path C:\Temp\tolgdbwtgd.exe
Size 361KB
SHA256 499b5e6577f6d7c127cb9b421231655595f676e77a2c9cacacd0e095d423e2da
MD5 8044cb0a428dfe4c0dee27d4120c635e
SHA1 c892854e713db4b0d0258bc5f615c003c0141ea3
SHA512 eb99340ec7579aba1ef6af1e8a124db61ae83c2f9c5eb8dc0d9ecc2901c2265cd80eea41511345cf87d852cc92a62ce5f987cf0eec91379de3e1d4887aee4e44
SSDEEP 6144:JflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:JflfAsiVGjSGecvX
TLSH
T16E747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqo.exe

Path C:\Temp\vtnlfdyvqo.exe
Size 361KB
SHA256 7c58c2390b2954756051fd3e81bc55f9fe4970e300213fadd4fffe0b4e51f2e6
MD5 b3374ed1dba450151d247b6d89caa8b1
SHA1 c6b4bd47442d41fe631fa6a3624c062a2cc3dc62
SHA512 3b6f48076a0567535e945459df3fd98e2ad6d79a6a5c96deb70acba7570de4d3b0fafc56f644e49ba307aff261606678e81486dcf2bfc30690a011d2d3f8f151
SSDEEP 6144:uflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:uflfAsiVGjSGecvX
TLSH
T1F8747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausp.exe

Path C:\Temp\xspkicausp.exe
Size 361KB
SHA256 baa7ac7453e66f44b648eec1167d9e7b20e2ae25230af0b74aa13de8b9cb578c
MD5 d617e1c61b2f8e9449d30c92c7784d73
SHA1 f69a7806d301dac40d4c58e97b288d95a42daf41
SHA512 88d1c6d6a6f9a2d608842a9c3fd2a4ebb8510265881854f49609f84a986ca29545b1da3eb44178167defff388d0dcfd5162079facd70061ff6409f251de7847f
SSDEEP 6144:DflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:DflfAsiVGjSGecvX
TLSH
T15C747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xusmhfcxrp.exe

Path C:\Temp\xusmhfcxrp.exe
Size 361KB
SHA256 0e8c4d1dfff626308e293f43aa2f4bfa36556a999b7cc9916d0e282a718a8476
MD5 b25a8b70884bf21b9cd607787963f1cc
SHA1 8188717d49e80ea89b29a1c7e5126559e1ef5d6c
SHA512 4385f26c7959d66b4cf290e350f5c03ba0f7f32cf2d472b916c64f35caa0b8dd4817243abea59c8a514deca8ce528f31124dafc15ee2b7cb79ebef0cf2cad013
SSDEEP 6144:KflfAsiL4lIJjiJcbI03GBc3ucY5DCSjX:KflfAsiVGjSGecvX
TLSH
T145747C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqolgdyvq.sys

Path C:\Temp\ytqolgdyvq.sys
Size 293KB
SHA256 b08344822fe0deb764481d076d54119d68af1c4d2231d4f56832abdd33ac8d82
MD5 694572e136e00cfeff082ed326cd2228
SHA1 ef4660c2ade44d326407081f7fe6273ed2bfe421
SHA512 769555e9fcc74b2211c01bb802032663af69f6efc4bd84e191a7b7a3ff8182687e1f35e373af56f0a25aa326a6447bfa79a6a689813511e9f05ac42d64430dee
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljdbvtr.sys

Path C:\Temp\ztrljdbvtr.sys
Size 293KB
SHA256 8a8843957581ab3d3902ba919dc0a06eb05309b0687f98b05bc8993228e795c6
MD5 db93611567aafe900e8da32854add03d
SHA1 64b1ef29f45d83ed966062429ec2b01b174cbe89
SHA512 9722eadc00206cb221ee4172792ffd727e45c706fa1fce6278d9a4aae96b84438295054490192b3e8c2542c1e1a9ee4a2c6e42e0b3def652b11103c369ea3c48
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T151545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80fb8443-0299-4bb6-a4ea-e1bb772ac59e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\80fb8443-0299-4bb6-a4ea-e1bb772ac59e.tmp
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

41c11726-a5b3-49f1-a33f-ed24c2c5e209.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41c11726-a5b3-49f1-a33f-ed24c2c5e209.tmp
Size 14KB
SHA256 5201e21d763eb3e5483092633030bd4c476fd3f28743076d0570ff60af73989d
MD5 5861d3ed401020cb22f36b1de456e362
SHA1 62f69262153e4157d361d84f76ba2f68eec7df84
SHA512 4794a72e0b8cda43f474679e26f8e4becbca5a9f68eda94f3203945dd2d4ef6dfdd30bfb31f7683d99a4aba42edc1a4a189c727c477120debd8d47312f91d308
SSDEEP 192:sxRjRLyM/jK1Ml8wCE/fysXJvvZNjICzoA8prk/g6+WNCW8/YD9O6SVGRpIgDfJ:sxRjF8E/fysZvxsg/5Q/USol
TLSH
T12762C916A9245D7B9CDBD219FA557F93D6F81463A2901E08AAFCDA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f91f41f8cca7e1950f8f472437b29b542fd912ffb807b4905c5a772a9261fcc5
MD5 3b5d09c401c5bd75f3d4435befc9cc62
SHA1 6b548bc6ed554f0dd1bbb11765297af4c7760502
SHA512 af223112e8f6bcb5b375f4d20318ac089be442b7e828c7e05815d64c3aa3af638b2bf35489e07e2db8c9d087aef0e8daea0069cfcc6243e14e347eb1dcd92a3a
TLSH
T16F512DD8437D09E2C7375ABE42E24B8932F5492555732EA213C06E7C1847F35E0C076B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bc1e18aeee8f524d3baab542bb30737fef5fe958e3772be82ae864e73bab6821
MD5 79e7387c3fde6c0dfbf0a6234a285ef9
SHA1 7652ab5276f48da1814cff0abc7a2d8cc956c094
SHA512 dadb2b7be619403f856b0548e545842b3d25874182fdae9508aa49936228a46355bb5feb68052b3f1a8081ae3a968dfdea6dcae476a0804f5fdcb7ecc1055168
TLSH
T16241CDF3C3E9822EC90156F0AA187E2BDE1C0915832C3D5AC9E4EF5B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d04fc3b80d4b9c5a1024bdb7609f10be6fb4cebca126a6ba57dba10422a1f98b
MD5 beb1138d4395ccab9dfa01f640350c2b
SHA1 2bc837af98cafafcdef6ba638422e627e9f210fe
SHA512 59040bc9ed763c624a87d9e47155da79f85f3284acd15b29df8fdaf8364f79472f841e561c1891cc060ffca17448c8e96f2785d7d4c935154ebe5a661d684980
SSDEEP 192:sxRkRLyM/jK1Ml8wCE/fyssJQvZNjIqzoA8pi/g6+WNIYD9a6SVGRpIgtJ:sxRkL8E/fys0QxYi/5I2So3
TLSH
T1B952DA156A285D7BCCDBD319FA557F93D6F81523A2901E44AAFCDA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1961ca3cdba8849b56867748c2f7d30a1fb796a9f32e3c956d512dbe4c785766
MD5 dbfecf823f2c2993a3d4863129eab8dd
SHA1 80eaaa620f15a0a58a12d2f3c329b2a4e4a960c6
SHA512 0c57700d554461e7f6c89637ff2456893ebb0b667fffcc4cfd47c3dc0a490ff068c4994edbdb6446f46ae735218110d3607b9acac54ec3ca3d634fbb7af72985
SSDEEP 192:sxRjRLyM/jK1Ml8wCE/fysXJQvZNjIqzoA8pi/g6+WNIYD9a6SVGRpIgD9J:sxRjL8E/fysZQxYi/5I2SoL
TLSH
T1DC52DA15AA345D7B8CDBD219FA557F93D6F81463A2901E44AAFCDA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1a8a76627583ce02905dab66eb6f3dd874942c5ab2edb98ed72d5b81ff7ef8ab
MD5 5985aa678f378b6cf18a22469ca7fbce
SHA1 e02d6d8fed99d5ed51a65862978a321db8b61b0d
SHA512 e55ebc48606fe5e7dd4afc38265023eafe0d868c8bc587dd3e53f922d121b9951f365b0cc3ae5735b0c0f53577d6e7e30d8e851d434ce3c713415e505971455b
SSDEEP 192:sxRjRLyM/jK1Ml8UQTCE/fysXJvvZNjICzoA8prk/g6+WNCW8/YD9O6SVGRpIgDh:sxRjFq2E/fysZvxsg/5Q/USol
TLSH
T18562DA16A9285D77DCDBD219FA557F93D6F81473A2901E08AAFCDA0C00E7ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 6e6971d2d5620015598513763de9598129ca6aff527b8539019968bea528305a
MD5 66cc6a2255701d6018f376bd3909b6e1
SHA1 493af6ee0c29ad817a1a6c4380aa90b54800bec2
SHA512 b49459ea8b107d0ecb513d1771bbcb6086fa3cb4830b88403cc6a879d426991abc8446e0fbcaa9146171478e08422b119ab61359adc58a4fc2f32c6246768ad9
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVO+Hc1sEro/loDX:aW5WFdE710Wg/XfCfu1jaN+HysP/lu
TLSH
T14CE2FB3B280CCB7E4F444A9CED297D9BADA801CF969CCD5447EA840C03C6BEB56164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d5dbde7d1edf4aa1d0d1bc0edf431ee1c82c69eae2f914e68e85eec20a0947b8
MD5 e910f262eb685b12639f0baf4fa66a29
SHA1 e67a2e5c26667d6844f310653b0ab10c603b0769
SHA512 cb863461576f21cdbb181c78d15987663a073cdd3cfaa3f3478aa21f4b91f9c85dea753b038007da39f874a238d37b5958e1d411834f60ef2bd7ba66b92b5c8e
SSDEEP 96:KRLURlTp5FWtC4gNFK40gjFcrzKtZ+H8B8+8P8r8Z878/8LW8P8M86g8T8LK48yz:CLURlTp5wtCZNv0gjarzKtZ+HYp8Iamq
TLSH
T11791B121313A4241787E6A0891E5D92B92C279F2705DE92F3BED41A61B77F138DFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

641d9a5e-b885-4f6c-a446-f27023019361.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\641d9a5e-b885-4f6c-a446-f27023019361.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 075857ba125f9eacce982418089d44a080ca4c00b0fe2113db15fac02e25c20a
MD5 ace39f2e946da29ca46ee61c60f545cc
SHA1 610f57430713286275726d8bd203ae5b9690bb9f
SHA512 2da32f9078f98104e60426b102cc45de74743a8c63839a52f3c27da361bee0772ae0da96c69c077c2171c459b96fb1047a815ba6ed909bca906d1dc7c78006ee
SSDEEP 384:nvtNn/s3n9Se38NmmQVrFKlDEC2WZlf8hyEGUi7FrAny2rEoajo4cdR8eHhVODjz:vj+9B3fVrFIHi0irEnjN3Gac1FKb9My
TLSH
T1D2F2B0346866CEB38CDAD38571473B93AFE016A785D50E98DACDAB0D05C36EC570B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dde2b89b5862aeebc15c12bee99f78c2222ed5fbdfc6e77952fdbee052ebed5c
MD5 56e878795012c8f9a1bf9021c8ffb72c
SHA1 c25930dea66ac8517b7d25b9015ec57fd9352bd5
SHA512 2406cd1a50bf11fc1524bfc4604a48635fedf880aff8c928b6f72edf104bc02140a8c31e4888f9d90083c32ab8ada7cf5b5b254fa89994946dbc3d5af8927445
SSDEEP 768:Srv+4UNbdb3tVrFsHi0irEnjN3Gac1FKow:Sbsb93tVJuiQnjMaRn
TLSH
T1F703BF3175B99EB38CEAE285B1477643BFF416A385C50AA4DAC96B0C05875E9230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b1b686da3bba594e5d5301c6d6490329e8e96f5ed5e1b0b81ff116a2d02d72a8
MD5 5408b2f3c2a05a7dce1dfae6c3e8eefb
SHA1 6bcc4e6f52e3ceba44be8e2cba0166ced80456dd
SHA512 347973f8b29452ab46a1beb3ee5c84181af5b657b4687e77925728596501c2f6dcd487d1196e5422cdb9f074a651e2b4b94b1c6f1c2e7c411e3a08c71040c3b8
SSDEEP 768:rrv+4UNbdS3rmi0TrEnjN3Gac1Z7eVH1SCz:rbsbg3wTQnjMa8EH1V
TLSH
T1A503BF3669B88AB38CEBA385718776037EF4525385940BE4C9CD6B0D06975EC130BD67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 a5ba9dccd7ead69409a9f040b15e85316b3db7bbe951f1440dea0cae9fd6dda0
MD5 da8b94b87b009ec07a6bf9e3ac8e7b28
SHA1 90451b7aa58bdae57b9e240ebcf29af24910d6c3
SHA512 45a954000e1d7c231527d83af2bdfbd27667f54180154cd4de0ebe4104fcd9815c916f83a122d261f522501f919ea61a85394ba87c006f341ae7c2de4cd1faa0
SSDEEP 768:mF1j+9j3BwgZVrFO8sdrEnjN3Gac1FKb9My:T9j3ZVJedQnjMaRb+y
TLSH
T1F31306F598D78A77D89E8787677E2E429ABCC263B5844994BBC45D0CCC831BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

7ffb7cd7-bb0c-4b3d-8a70-32db76e314b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7ffb7cd7-bb0c-4b3d-8a70-32db76e314b4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2492_1640774156\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0ad64b16ebe78419b9414fd069d1e20904a1712738defb01a58de196fbfaafa6
MD5 2239644f8e30095ccd91d63e2025d938
SHA1 4087de07c8429e51e44f7e6a2b3cd94105d981ee
SHA512 95d89a451d9f64a275bbb4e9db67171d661341538af0cca506ef88bd51111497c635c2f4ff9bdd8971b95d9b97d393f4c378498ef08c97c2c687e505adfda69b
TLSH
T14A71E38397F9C9B2C5DA5FF10283D644F6FB62384B6370244F955586AB30A7A64B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/960-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1028-195-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1028-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1856-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2244-319-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2336-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2716-496-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2768-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3120-270-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3436-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3572-242-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4196-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4296-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-415-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4996-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5152-471-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5616-446-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5940-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download