b2669e0af3246ece75892ad1aa575296d9cb23297c6a6c59a41cae1f7d02ce34

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Size 722KB
Sample260712-pmeg4aby2s
SHA256 b2669e0af3246ece75892ad1aa575296d9cb23297c6a6c59a41cae1f7d02ce34
MD5 8902d745f0beed8535ee0fe385a4ae80
SHA1 2b2fec578f57abe31a68f0d1df706dcfbd37c998
SHA512 266643490634a750d3301a28dadd76c97ac0847eafe006f8204b619480c37803c64d67f45c208c31b255ed71e0cf013f1d36e5effb82fe3cc67d37d22cf58dc8
SSDEEP 12288:hflfAsiVGjSGecvXAflfAsiVGjSGecvX:JMcfcMcf
TLSH
T1B7F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery spyware

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3204	mgecztrmjhbzwuom.exe
760	mgecztrmjhbzwuom.sys
4284	CreateProcess.exe
5588	wuomjebzur.exe
3836	CreateProcess.exe
1528	CreateProcess.exe
2288	i_wuomjebzur.exe
2164	zwrojgbztr.sys
1120	CreateProcess.exe
2264	geywtrljeb.exe
5028	CreateProcess.exe
4824	CreateProcess.exe
3528	i_geywtrljeb.exe
2328	mjdbwtomge.sys
4168	CreateProcess.exe
4204	dbwlgdyvtq.exe
720	CreateProcess.exe
4772	CreateProcess.exe
4708	i_dbwlgdyvtq.exe
5388	dbytqljdbv.sys
4732	CreateProcess.exe
4408	vtnlidbvtq.exe
3984	CreateProcess.exe
5840	CreateProcess.exe
5920	i_vtnlidbvtq.exe
2900	ysqlidavsn.sys
4404	CreateProcess.exe
3620	qlfdxvnlfd.exe
3248	CreateProcess.exe
2888	CreateProcess.exe
2940	i_qlfdxvnlfd.exe
5692	sqkicausnk.sys
3772	CreateProcess.exe
5436	hfaxspnhca.exe
2972	CreateProcess.exe
1348	CreateProcess.exe
5380	i_hfaxspnhca.exe
5968	mkifaxsqki.sys
6112	CreateProcess.exe
2768	xrpjhczusm.exe
1036	CreateProcess.exe
4216	CreateProcess.exe
792	i_xrpjhczusm.exe
632	pjhczxrpjh.sys
1216	CreateProcess.exe
5244	hczurpkhcz.exe
4220	CreateProcess.exe
940	CreateProcess.exe
4968	i_hczurpkhcz.exe
4128	rmkecwuomg.sys
5692	CreateProcess.exe
3552	hezwuomgez.exe
1908	CreateProcess.exe
1896	CreateProcess.exe
5484	i_hezwuomgez.exe
2412	ljhbwtrlje.sys
5312	CreateProcess.exe
5044	hbywrojhbz.exe
6132	CreateProcess.exe
632	CreateProcess.exe
4888	i_hbywrojhbz.exe
4456	ywtomywqoi.sys
2624	CreateProcess.exe
1612	lgdywqoigb.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1986987148\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1171219828\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1171219828\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_128463716\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_128463716\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1593726984\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1593726984\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1593726984\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1060_1593726984\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomjebzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywtrljeb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwlgdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwlgdyvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfaxspnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnkfdxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mgecztrmjhbzwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomjebzur.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qlfdxvnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczurpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxspkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjhbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbywrojhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpjhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfaxspnhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkigdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pkhfzxrpkh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkigdxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxspkhcauk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpjhezxrpj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtrligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtrligby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlidbvtq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qlfdxvnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczurpkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjhbztrlje.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2876	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5396	ipconfig.exe
3668	ipconfig.exe
4456	ipconfig.exe
3496	ipconfig.exe
2164	ipconfig.exe
1416	ipconfig.exe
2832	ipconfig.exe
3496	ipconfig.exe
992	ipconfig.exe
4560	ipconfig.exe
4380	ipconfig.exe
4704	ipconfig.exe
4624	ipconfig.exe
5928	ipconfig.exe
4412	ipconfig.exe
2276	ipconfig.exe
2328	ipconfig.exe
2328	ipconfig.exe
2200	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283328012687012"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{9EA6DF8E-D56A-4C43-8248-DD2373718CCF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe
3204	mgecztrmjhbzwuom.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe
1060	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2288	i_wuomjebzur.exe
Token: SeDebugPrivilege	3528	i_geywtrljeb.exe
Token: SeDebugPrivilege	4708	i_dbwlgdyvtq.exe
Token: SeDebugPrivilege	5920	i_vtnlidbvtq.exe
Token: SeDebugPrivilege	2940	i_qlfdxvnlfd.exe
Token: SeDebugPrivilege	5380	i_hfaxspnhca.exe
Token: SeDebugPrivilege	792	i_xrpjhczusm.exe
Token: SeDebugPrivilege	4968	i_hczurpkhcz.exe
Token: SeDebugPrivilege	5484	i_hezwuomgez.exe
Token: SeDebugPrivilege	4888	i_hbywrojhbz.exe
Token: SeDebugPrivilege	2588	i_lgdywqoigb.exe
Token: SeDebugPrivilege	4240	i_jdbnlfdyvq.exe
Token: SeDebugPrivilege	4456	i_aysqkigdxv.exe
Token: SeDebugPrivilege	2248	i_vsnkfdxvpn.exe
Token: SeDebugPrivilege	3604	i_pkhfzxrpkh.exe
Token: SeDebugPrivilege	5480	i_zxspkhcauk.exe
Token: SeDebugPrivilege	4416	i_rpjhezxrpj.exe
Token: SeDebugPrivilege	2844	i_mjhbztrlje.exe
Token: SeDebugPrivilege	5524	i_dbwtrligby.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 3204	1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 1128 wrote to memory of 1356	1128	2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 1356 wrote to memory of 1060	1356	iexplore.exe	89
PID 1060 wrote to memory of 1432	1060	msedge.exe	90
PID 1060 wrote to memory of 2876	1060	msedge.exe	91
PID 1060 wrote to memory of 4696	1060	msedge.exe	92
PID 1060 wrote to memory of 4696	1060	msedge.exe	92
PID 1060 wrote to memory of 4696	1060	msedge.exe	92
PID 1060 wrote to memory of 5580	1060	msedge.exe	93
PID 1060 wrote to memory of 5580	1060	msedge.exe	93
PID 1060 wrote to memory of 5936	1060	msedge.exe	95
PID 1060 wrote to memory of 4236	1060	msedge.exe	96
PID 1060 wrote to memory of 5936	1060	msedge.exe	95
PID 1060 wrote to memory of 5936	1060	msedge.exe	95
PID 1060 wrote to memory of 4236	1060	msedge.exe	96
PID 1060 wrote to memory of 4236	1060	msedge.exe	96
PID 1060 wrote to memory of 4208	1060	msedge.exe	97
PID 1060 wrote to memory of 3532	1060	msedge.exe	98
PID 1060 wrote to memory of 4208	1060	msedge.exe	97
PID 1060 wrote to memory of 4208	1060	msedge.exe	97
PID 1060 wrote to memory of 3532	1060	msedge.exe	98
PID 1060 wrote to memory of 3532	1060	msedge.exe	98
PID 1060 wrote to memory of 5448	1060	msedge.exe	99
PID 1060 wrote to memory of 5448	1060	msedge.exe	99
PID 3204 wrote to memory of 4284	3204	mgecztrmjhbzwuom.exe	103
PID 5588 wrote to memory of 3836	5588	wuomjebzur.exe	106
PID 1060 wrote to memory of 2424	1060	msedge.exe	110
PID 1060 wrote to memory of 1148	1060	msedge.exe	109
PID 1060 wrote to memory of 2424	1060	msedge.exe	110
PID 1060 wrote to memory of 1148	1060	msedge.exe	109
PID 1060 wrote to memory of 2524	1060	msedge.exe	112
PID 1060 wrote to memory of 4244	1060	msedge.exe	113
PID 1060 wrote to memory of 4244	1060	msedge.exe	113
PID 1060 wrote to memory of 3304	1060	msedge.exe	116
PID 1060 wrote to memory of 3304	1060	msedge.exe	116
PID 3204 wrote to memory of 1528	3204	mgecztrmjhbzwuom.exe	117
PID 3204 wrote to memory of 1120	3204	mgecztrmjhbzwuom.exe	121
PID 2264 wrote to memory of 5028	2264	geywtrljeb.exe	123
PID 3204 wrote to memory of 4824	3204	mgecztrmjhbzwuom.exe	126
PID 3204 wrote to memory of 4168	3204	mgecztrmjhbzwuom.exe	130
PID 4204 wrote to memory of 720	4204	dbwlgdyvtq.exe	132
PID 3204 wrote to memory of 4772	3204	mgecztrmjhbzwuom.exe	135
PID 3204 wrote to memory of 4732	3204	mgecztrmjhbzwuom.exe	140
PID 4408 wrote to memory of 3984	4408	vtnlidbvtq.exe	142
PID 3204 wrote to memory of 5840	3204	mgecztrmjhbzwuom.exe	145
PID 1060 wrote to memory of 5972	1060	msedge.exe	147
PID 1060 wrote to memory of 4952	1060	msedge.exe	148
PID 1060 wrote to memory of 6100	1060	msedge.exe	149
PID 3204 wrote to memory of 4404	3204	mgecztrmjhbzwuom.exe	152
PID 3620 wrote to memory of 3248	3620	qlfdxvnlfd.exe	154
PID 3204 wrote to memory of 2888	3204	mgecztrmjhbzwuom.exe	157
PID 3204 wrote to memory of 3772	3204	mgecztrmjhbzwuom.exe	161
PID 5436 wrote to memory of 2972	5436	hfaxspnhca.exe	163
PID 3204 wrote to memory of 1348	3204	mgecztrmjhbzwuom.exe	166
PID 3204 wrote to memory of 6112	3204	mgecztrmjhbzwuom.exe	170
PID 2768 wrote to memory of 1036	2768	xrpjhczusm.exe	172
PID 3204 wrote to memory of 4216	3204	mgecztrmjhbzwuom.exe	175
PID 3204 wrote to memory of 1216	3204	mgecztrmjhbzwuom.exe	179
PID 5244 wrote to memory of 4220	5244	hczurpkhcz.exe	181
PID 1060 wrote to memory of 5132	1060	msedge.exe	184
PID 1060 wrote to memory of 5132	1060	msedge.exe	184
PID 3204 wrote to memory of 940	3204	mgecztrmjhbzwuom.exe	188
PID 1060 wrote to memory of 4612	1060	msedge.exe	192
PID 1060 wrote to memory of 4612	1060	msedge.exe	192

C:\Users\Admin\AppData\Local\Temp\2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_8902d745f0beed8535ee0fe385a4ae80_amadey_darkgate_elex_redline-stealer_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Temp\mgecztrmjhbzwuom.exe
  C:\Temp\mgecztrmjhbzwuom.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomjebzur.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4284
  - - C:\Temp\wuomjebzur.exe
      C:\Temp\wuomjebzur.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5588
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomjebzur.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1528
  - - C:\Temp\i_wuomjebzur.exe
      C:\Temp\i_wuomjebzur.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywtrljeb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1120
  - - C:\Temp\geywtrljeb.exe
      C:\Temp\geywtrljeb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywtrljeb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4824
  - - C:\Temp\i_geywtrljeb.exe
      C:\Temp\i_geywtrljeb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwlgdyvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4168
  - - C:\Temp\dbwlgdyvtq.exe
      C:\Temp\dbwlgdyvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwlgdyvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4772
  - - C:\Temp\i_dbwlgdyvtq.exe
      C:\Temp\i_dbwlgdyvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlidbvtq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4732
  - - C:\Temp\vtnlidbvtq.exe
      C:\Temp\vtnlidbvtq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlidbvtq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5840
  - - C:\Temp\i_vtnlidbvtq.exe
      C:\Temp\i_vtnlidbvtq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qlfdxvnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4404
  - - C:\Temp\qlfdxvnlfd.exe
      C:\Temp\qlfdxvnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qlfdxvnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2888
  - - C:\Temp\i_qlfdxvnlfd.exe
      C:\Temp\i_qlfdxvnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfaxspnhca.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3772
  - - C:\Temp\hfaxspnhca.exe
      C:\Temp\hfaxspnhca.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5436
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2972
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfaxspnhca.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1348
  - - C:\Temp\i_hfaxspnhca.exe
      C:\Temp\i_hfaxspnhca.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhczusm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6112
  - - C:\Temp\xrpjhczusm.exe
      C:\Temp\xrpjhczusm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1036
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhczusm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4216
  - - C:\Temp\i_xrpjhczusm.exe
      C:\Temp\i_xrpjhczusm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczurpkhcz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\hczurpkhcz.exe
      C:\Temp\hczurpkhcz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczurpkhcz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:940
  - - C:\Temp\i_hczurpkhcz.exe
      C:\Temp\i_hczurpkhcz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezwuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5692
  - - C:\Temp\hezwuomgez.exe
      C:\Temp\hezwuomgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3552
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezwuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1896
  - - C:\Temp\i_hezwuomgez.exe
      C:\Temp\i_hezwuomgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbywrojhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5312
  - - C:\Temp\hbywrojhbz.exe
      C:\Temp\hbywrojhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5044
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbywrojhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:632
  - - C:\Temp\i_hbywrojhbz.exe
      C:\Temp\i_hbywrojhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoigb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2624
  - - C:\Temp\lgdywqoigb.exe
      C:\Temp\lgdywqoigb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoigb.exe ups_ins
    3⤵
    PID:4968
  - - C:\Temp\i_lgdywqoigb.exe
      C:\Temp\i_lgdywqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbnlfdyvq.exe ups_run
    3⤵
    PID:4632
  - - C:\Temp\jdbnlfdyvq.exe
      C:\Temp\jdbnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbnlfdyvq.exe ups_ins
    3⤵
    PID:4708
  - - C:\Temp\i_jdbnlfdyvq.exe
      C:\Temp\i_jdbnlfdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkigdxv.exe ups_run
    3⤵
    PID:3732
  - - C:\Temp\aysqkigdxv.exe
      C:\Temp\aysqkigdxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkigdxv.exe ups_ins
    3⤵
    PID:5536
  - - C:\Temp\i_aysqkigdxv.exe
      C:\Temp\i_aysqkigdxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnkfdxvpn.exe ups_run
    3⤵
    PID:5448
  - - C:\Temp\vsnkfdxvpn.exe
      C:\Temp\vsnkfdxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2164
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnkfdxvpn.exe ups_ins
    3⤵
    PID:2344
  - - C:\Temp\i_vsnkfdxvpn.exe
      C:\Temp\i_vsnkfdxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pkhfzxrpkh.exe ups_run
    3⤵
    PID:2104
  - - C:\Temp\pkhfzxrpkh.exe
      C:\Temp\pkhfzxrpkh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pkhfzxrpkh.exe ups_ins
    3⤵
    PID:5936
  - - C:\Temp\i_pkhfzxrpkh.exe
      C:\Temp\i_pkhfzxrpkh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxspkhcauk.exe ups_run
    3⤵
    PID:2180
  - - C:\Temp\zxspkhcauk.exe
      C:\Temp\zxspkhcauk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxspkhcauk.exe ups_ins
    3⤵
    PID:3404
  - - C:\Temp\i_zxspkhcauk.exe
      C:\Temp\i_zxspkhcauk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpjhezxrpj.exe ups_run
    3⤵
    PID:1936
  - - C:\Temp\rpjhezxrpj.exe
      C:\Temp\rpjhezxrpj.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpjhezxrpj.exe ups_ins
    3⤵
    PID:2704
  - - C:\Temp\i_rpjhezxrpj.exe
      C:\Temp\i_rpjhezxrpj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjhbztrlje.exe ups_run
    3⤵
    PID:4504
  - - C:\Temp\mjhbztrlje.exe
      C:\Temp\mjhbztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2012
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjhbztrlje.exe ups_ins
    3⤵
    PID:800
  - - C:\Temp\i_mjhbztrlje.exe
      C:\Temp\i_mjhbztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtrligby.exe ups_run
    3⤵
    PID:3108
  - - C:\Temp\dbwtrligby.exe
      C:\Temp\dbwtrligby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3532
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtrligby.exe ups_ins
    3⤵
    PID:5968
  - - C:\Temp\i_dbwtrligby.exe
      C:\Temp\i_dbwtrligby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5524
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x50,0x304,0x7ffec25dc188,0x7ffec25dc194,0x7ffec25dc1a0
      4⤵
      PID:1432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,671219946744399166,18185735074785292422,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:11
      4⤵
      System Time Discovery
      PID:2876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,4734630122762555460,6919451139601487237,262144 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:2
      4⤵
      PID:4696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,1701287095822416467,11565643096358905096,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
      4⤵
      PID:5580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,13116326086117596019,12240966208323059018,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,3688977373514956622,8975858486678548991,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:4236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,17571199503474696446,17799537443122955380,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,7246578843575281214,14686517554062409416,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:9
      4⤵
      PID:3532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,12634233356926211802,14730609171203276855,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,12030779026359945908,7234362098318799189,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:1148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,5589030701752917667,5305829445904283565,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
      4⤵
      PID:2424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14995690725217189705,17807134589094198250,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,14995690725217189705,17807134589094198250,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,9786019905515048401,11294111084673748869,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:4244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,9043988418714507660,15428129146202280933,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,12162803167581730152,14207430511739792418,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9878754024482430586,1126423691239816773,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,3439182533525758076,312221352474179930,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,17759072035202281120,11922180945168300735,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:5132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3344,i,12442608422146186219,16740571140822221720,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3756,i,15422104335300565886,5711089001582945214,2097152 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
      4⤵
      PID:3896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,11078352886253667626,15349227282682832251,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,6501613416165275648,4117839105976681819,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10837345439848912105,8486274139715589762,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
      4⤵
      PID:828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3340,i,5773685263887336312,13562413722971060742,262144 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:10
      4⤵
      PID:3328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,11935942273678761236,5061756142670203963,524288 --field-trial-handle=2684,i,12120990407954257850,16484536091207877969,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:14
      4⤵
      PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5244

C:\Temp\mgecztrmjhbzwuom.sys
C:\Temp\mgecztrmjhbzwuom.sys
1⤵
- Executes dropped EXE
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5596

C:\Temp\zwrojgbztr.sys
C:\Temp\zwrojgbztr.sys
1⤵
- Executes dropped EXE
PID:2164

C:\Temp\mjdbwtomge.sys
C:\Temp\mjdbwtomge.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\dbytqljdbv.sys
C:\Temp\dbytqljdbv.sys
1⤵
- Executes dropped EXE
PID:5388

C:\Temp\ysqlidavsn.sys
C:\Temp\ysqlidavsn.sys
1⤵
- Executes dropped EXE
PID:2900

C:\Temp\sqkicausnk.sys
C:\Temp\sqkicausnk.sys
1⤵
- Executes dropped EXE
PID:5692

C:\Temp\mkifaxsqki.sys
C:\Temp\mkifaxsqki.sys
1⤵
- Executes dropped EXE
PID:5968

C:\Temp\pjhczxrpjh.sys
C:\Temp\pjhczxrpjh.sys
1⤵
- Executes dropped EXE
PID:632

C:\Temp\rmkecwuomg.sys
C:\Temp\rmkecwuomg.sys
1⤵
- Executes dropped EXE
PID:4128

C:\Temp\ljhbwtrlje.sys
C:\Temp\ljhbwtrlje.sys
1⤵
- Executes dropped EXE
PID:2412

C:\Temp\ywtomywqoi.sys
C:\Temp\ywtomywqoi.sys
1⤵
- Executes dropped EXE
PID:4456

C:\Temp\igaytqoiga.sys
C:\Temp\igaytqoiga.sys
1⤵
PID:2404

C:\Temp\ayvtnlidav.sys
C:\Temp\ayvtnlidav.sys
1⤵
PID:5880

C:\Temp\avsqkicavs.sys
C:\Temp\avsqkicavs.sys
1⤵
PID:5608

C:\Temp\xspnkiusmk.sys
C:\Temp\xspnkiusmk.sys
1⤵
PID:3308

C:\Temp\caxspkhcau.sys
C:\Temp\caxspkhcau.sys
1⤵
PID:4676

C:\Temp\omjhczusmj.sys
C:\Temp\omjhczusmj.sys
1⤵
PID:4164

C:\Temp\mgecztrojh.sys
C:\Temp\mgecztrojh.sys
1⤵
PID:4152

C:\Temp\omgeywromg.sys
C:\Temp\omgeywromg.sys
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbwlgdyvtq.exe

Path C:\Temp\dbwlgdyvtq.exe
Size 722KB
SHA256 04fe455b234ca0255e2e085f80644c5f7bc335c7e2a13f6b42be72bc346a10aa
MD5 d48f262c76672934075cf9c39ce75191
SHA1 16374931f6b6bdff8ddf2a3bbdffc3b1ec79616c
SHA512 76e149098d12f2e405da7fb43c516d14acefe1735ee862dcb52b595a9e605b3387b1a87a32ddbc551a237776817b9f3616c4fca35d8c9ed624c3be96f1d7f477
SSDEEP 12288:kflfAsiVGjSGecvXAflfAsiVGjSGecvX:AMcfcMcf
TLSH
T15DF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqljdbv.sys

Path C:\Temp\dbytqljdbv.sys
Size 293KB
SHA256 c8f2c5f0b75468c15339e8de88259b5300e68ee28fddc8efd7e388cde0789181
MD5 57ece387a5aa0415604e6c2a833217d0
SHA1 ba3df93c3ff3ea84dc2a1fe52d4ab2cfa922fb66
SHA512 a38450545956ba8ee741ec703260f54170b5888a8c4a3cc2573ce96f04688f0a8627730d3d61e71a7144ae0bd6aedca411d0e1a5705f133fc786ddff640cb573
SSDEEP 3072:ZtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:ZIJjiJcbI03GBc3ucY5DCSj
TLSH
T181545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywtrljeb.exe

Path C:\Temp\geywtrljeb.exe
Size 722KB
SHA256 2efbc6b3df5121f3559cbd3c93fa234069261c365859088e3fd35c7d8c036577
MD5 b35768a64583b1c8c9a50119df6cbdfa
SHA1 86859521d7a9cb1f346f48014afc2ed41ae5d02e
SHA512 b6cfaa70b8f927fc39c86182585b80bd13c1284b58d959ba40c19d0d1be4ace7548027a245d7201910cd15abf9c02d32d0e355c358f99094c65b59e5b00f3e83
SSDEEP 12288:4flfAsiVGjSGecvXAflfAsiVGjSGecvX:kMcfcMcf
TLSH
T11EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfaxspnhca.exe

Path C:\Temp\hfaxspnhca.exe
Size 722KB
SHA256 1209d95401bea4e42bcc2943ea51641de6da91604a3775c23c51bc3a96acae22
MD5 82d40f418af5ff6ee6101a66829feb5a
SHA1 2e99eae428f04bb61f8739e2526f07243d64d021
SHA512 fc986e05790fa4f2cdb450c289feebe99d713bf8e7e2a844417c42b1383ff4a66c8b96662091c90a68a1e3493c1f9bb90644b4a0446c32200f76ff7d845e1cb1
SSDEEP 12288:FflfAsiVGjSGecvXAflfAsiVGjSGecvX:NMcfcMcf
TLSH
T15CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwlgdyvtq.exe

Path C:\Temp\i_dbwlgdyvtq.exe
Size 722KB
SHA256 cdc9600b49e2f484fcf2f655b1a0279558b1a45f2d2d12bbbe22b85c35cbc1a9
MD5 3ad387ee9145e1a6d119edb8f6c9560c
SHA1 f60d1cec0945d0b5527e6a397051400eda930fed
SHA512 31efdb4743c0a053c9373dbb9665b06e73c19062415b5d6d5f60450860075d49b4bc46b818ce2c88d4bcb90f5a9cd611b5dd5c0d1c1f1165637b891c05308482
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T16AF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywtrljeb.exe

Path C:\Temp\i_geywtrljeb.exe
Size 722KB
SHA256 947840ead142b37a13a5fe616add2c667dcf118d6e7fa811038894d1ccf041b7
MD5 a76a973d73dd3072c02b493fe546fb48
SHA1 e0e0bd151835eec875ac0614c877173eaad7cd44
SHA512 f7721c7e93d30cf692f8cf0224604675f9f87a5ed7a4d93bea78e1619c4653dd4b2abbf1bdbc044e2ec9d539623a10dc64c4d29677459448c90b13a0d3295b9e
SSDEEP 12288:iflfAsiVGjSGecvXAflfAsiVGjSGecvX:OMcfcMcf
TLSH
T17CF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qlfdxvnlfd.exe

Path C:\Temp\i_qlfdxvnlfd.exe
Size 722KB
SHA256 342971934d0d92f0ff86686bd5b45bec1ac9dd056577967a8fd407b9d7486228
MD5 6b77de2fae3334e314fb89fdd9639350
SHA1 45cf780216898a01a6e8e36ce3eecb6d91dd31b7
SHA512 28e27b845e341192890042583256d8b3d75739cb7d2e8e3fcef2e17a2f7a8bec047a97749aee4f0ebf18ad70a02b4c66081368cca006e70ad87155c8b929b604
SSDEEP 12288:lflfAsiVGjSGecvXAflfAsiVGjSGecvX:tMcfcMcf
TLSH
T1A9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlidbvtq.exe

Path C:\Temp\i_vtnlidbvtq.exe
Size 722KB
SHA256 0dff7c6478338ac094ec9f119b4abb2377b357f108fb67e8d29013a291bbf1b0
MD5 376e2b5f13a5e3acdad1748938eac006
SHA1 326567449dd514afd8bd9acda69078f01065cf65
SHA512 1120f0836b4b54d60198d97d7fe516beb84fe1ff6bf552a69a8ca3bfcda3ff1593eefd2449c843d8fb8d23c449bd6fe0baa5daae6c3bcbcc80d9d8f696a4db08
SSDEEP 12288:GflfAsiVGjSGecvXAflfAsiVGjSGecvX:SMcfcMcf
TLSH
T1D9F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_wuomjebzur.exe

Path C:\Temp\i_wuomjebzur.exe
Size 722KB
SHA256 134bde5e14757e80c0d41601617e3dda4538a7ed7571e3b32da7f13ba8d9b474
MD5 aca3db5d07d3c5440ca862a0c2cf71b8
SHA1 529b4a824905b216528150c0f791602ed2d40601
SHA512 80b6218e7a63a1e6e4895809bc68e8fb06f86cd0662b6fa7fadd2c0b9923f55b67a18c578c3b50f38cc65ff6d6cf4a1e134af1ad66f10514bdbfa49ca4d3faf3
SSDEEP 12288:zflfAsiVGjSGecvXAflfAsiVGjSGecvX:bMcfcMcf
TLSH
T110F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgecztrmjhbzwuom.exe

Path C:\Temp\mgecztrmjhbzwuom.exe
Size 722KB
SHA256 180126f62c119432466800ada8588511dfa90f97be473b7a4c6c73001c871fcb
MD5 37370255523c76fd828ec93603947506
SHA1 6cfce6689deebe851421046def5f71fd6e4e27fd
SHA512 97099a59008acadd8f84c6e206d53b8ed1cdce5a180e544ac4566119d8531c1de6d77780cbb15ee210a64d3e8e539a7326440715e554f255321ca1f764562cdf
SSDEEP 12288:/flfAsiVGjSGecvXAflfAsiVGjSGecvX:nMcfcMcf
TLSH
T18EF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mgecztrmjhbzwuom.sys

Path C:\Temp\mgecztrmjhbzwuom.sys
Size 293KB
SHA256 fa23364f2232b39502e8cf5e844f1a1082e409161b9d8575d4d3f95c7735c0f5
MD5 2ceb2eddf49842c9b11e302b8599d902
SHA1 f54c13476941f5d5d240b7913d7bb1d44d9de0c4
SHA512 d15bb699d8a5bd6eebbbe6d48e3d23479384ed2e95e4c2cdb9795364ee1fc2e8d5b3da1051cc137289d067c00ad2dc3b8973232ae760fbaedc9cbb4f767a742f
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T129545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjdbwtomge.sys

Path C:\Temp\mjdbwtomge.sys
Size 293KB
SHA256 b7833d3a19fdd59e9aff0185c5e4debc1c771423504ac4b91785f4ec8eca830c
MD5 052f35db7c7e229baed4064b67d5293a
SHA1 f25173fb4601eccf7dee899d9f607cd85357617e
SHA512 77970cdb1848289fd306f0f33c9827ba27117a334565ee9bda1498ea5dea995d27dadf36767130164eb39a8df43d9ca04eca60153759c0e06d507fd3328e5c84
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T189545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qlfdxvnlfd.exe

Path C:\Temp\qlfdxvnlfd.exe
Size 722KB
SHA256 fd9c70234a48dc4ca3a3e3d7eb4acd3e09d5baba4b9d8aab07f78e8450c8ba01
MD5 5c6209499fcf059fffafe8441847fd69
SHA1 6176a92fdb0a412dac1aae9537e0e1284565a783
SHA512 6a5e1e9def084c26343bab7801a153f4e332bcfbc5fad3e37a8d5d56e05e3b5621413b1878a3f79c107f88c154e1eaa3aca6f38e0b63a27ea6fbe0d347d21535
SSDEEP 12288:tflfAsiVGjSGecvXAflfAsiVGjSGecvX:FMcfcMcf
TLSH
T197F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkicausnk.sys

Path C:\Temp\sqkicausnk.sys
Size 293KB
SHA256 c32ec3448b2467de42bab785e79f1747756823ea9e80aa37aec2ff3af789d021
MD5 1a01f2dfbcf749e59b08ecda9d5f82a1
SHA1 4f14c43b015283db44f26cdc1d1074db9435c5bb
SHA512 cd8c7c4f619fba78569c8401041a1844ed65c7e60420ee9c4c2ba8644484bbf7af62c7423b5aeb678c5004999419014d5704e60a7795248c54898111f683b581
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T170545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlidbvtq.exe

Path C:\Temp\vtnlidbvtq.exe
Size 722KB
SHA256 b8f01fe4e466d478286004cd747400f0f486d4064b284c11c108cf48218c8f9e
MD5 f3e6954dc41e33a1581eca6efa588c3c
SHA1 9801522e176bbf4661c79977c9d524ba4641771c
SHA512 38be5266beccbb5e6334cde8df8bf35efed647e7a45a57ddb3d0ccc4e471f29e647b0f30a3e6be2e7049908c227545c7ad324f830b0f942c129cb8168b5a957f
SSDEEP 12288:mflfAsiVGjSGecvXAflfAsiVGjSGecvX:yMcfcMcf
TLSH
T194F47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomjebzur.exe

Path C:\Temp\wuomjebzur.exe
Size 722KB
SHA256 c3787b7dc4386347e15aa147c6454b9d3658e11fbe1f83fbc596ec3f9df30dd7
MD5 f304384e9e05c4fca22e4e1400161b29
SHA1 067d30ddaad49fa905d524cbe1263482fd82e9ce
SHA512 9b2b3b2a98598b90ded7d206a3f914004b2156a48c6982a3fa02b412d2e1e45dbb30f910d1bb6417f4c6f5f66400bd579846dfcb7fb14ba6cd6d859bb8081eb8
SSDEEP 12288:qflfAsiVGjSGecvXAflfAsiVGjSGecvX:mMcfcMcf
TLSH
T1ADF47C04BAA4F0F6DD95047800EBAF36967EB4281726CBC7E354CE5D99113C3A9346AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqlidavsn.sys

Path C:\Temp\ysqlidavsn.sys
Size 293KB
SHA256 31617fae9e6f785e794e180407c5d3aad9307635f27d9e2ca58de570a351cfe5
MD5 ef4324f6469b3db7678dfb58584f5a1b
SHA1 4a327755bc7db8dae952029209e837409d175c3d
SHA512 6f5384702b3680bf403a0083f54cafbd7f09ed21927f01b2df8d4d77e5ad11b24460012f8aeb6a4ae2a8eabe52541caacc309c9f73cce5df19c2f2c8817dcf35
SSDEEP 3072:StKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:SIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwrojgbztr.sys

Path C:\Temp\zwrojgbztr.sys
Size 293KB
SHA256 82a98a3492d22ea41a591f665bd729cdd95ae63e7ac3daa305e997b3f74eeb29
MD5 44b7de4ff35bc54196b8c801a39baba1
SHA1 4b0d47036ac742ae9ef028d5830aaf74cd441861
SHA512 1d5b9151849b2479b25b09f221aad22076e80c3696049bd18354320344c47f094534e53f7b52800f7f083640fdf41a343e52020656dc77b646732ddf6dcc6a3d
SSDEEP 3072:stKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:sIJjiJcbI03GBc3ucY5DCSj
TLSH
T115545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1340e80386e1cadbb3ec7af859b790e9504e0ca34d010537c9fd802dd088ba6b
MD5 a3eaf65085c259891f6c50d86db612d4
SHA1 b835518524af1cd4c6b0047d2159d6dfdd729fe9
SHA512 a54e816aa4a2255f5527db383edfabbe61b6f3410ab3965dcc4c1a361145f3d9d66ecb5990209d8824753a1157f5fa545b8e2552a0678ace8927008642fc72de
TLSH
T15E61FE5593611EF2CBE94AB3F2F05C5833E88446668B2A0DC05EAFF55406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598802.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598802.TMP
Size 3KB
SHA256 075260539d7ec3d7d7a24e39a76af9ce248c3e07304e80f995a0a871125e0cbe
MD5 dc21a26d81a19d7f0a5553cd79ab0daf
SHA1 3c4ca817d7611ee70500a70129ad14db66f59caa
SHA512 83d8f8a47c86b9bae3aeb12044f7fec1904bd24411a6be82088ea0dc341586e2465c01452f82ddad5527074e92f5d5043e75d93c22d736a5c51a485d8a805b16
TLSH
T16D61FD5493611EF2CBE94AB3F2F06C9833E88446668B2A0DC05EAFF51406F5D93E1633
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 2608b60c5cd3d71360fb8905ad150fba035212438effdf8a4d9b022d7105c01a
MD5 ac0b285cc7a176026bf7e6f0565b11df
SHA1 937d335e4c5168727c9094d3d8960833fafb7d33
SHA512 92cce79d82af75dde13531d74c4451cf8f4d3f3aab670cd8c19319afa6262945778964a6fbac9fd207ed36cf95c97bbd2346ee4448bfe94a8a3523afd17cd1a1
TLSH
T1D041CDF7C3E8866E890196F0AA187E1BCE1C0915832C3D5AC9E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b50d35baa66c23525e6d1a10c307984fbf4aac4d095b8afdf21fe2054e9b2b64
MD5 d8562ae8ac6c357ed07439d3b328aecd
SHA1 b467c4acfe901f34c1099a6b0b3f573f90acf617
SHA512 c744ec7605e34708f4a51ca52471a5f1b96c0c9b6000af3f73bccffcbe49f629f495b6e27346fc92a5f706969a7939e942b58f88f4d7f8c5938dcd837dec88dc
SSDEEP 192:sxRzR2yM/jK1Ml8wCg/fKs72t2CZUbzoA8prU/g6+WNCSC/YncXhkGuzEIgDWJ:sxRzg8g/fKs7K2ElY/5q/VxOzo2
TLSH
T1E062D8166A3499779CDBD20DFA51BF93D6F91533A2901E44AAFCCB0C01E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a084990fac681f8e41820f64d311860b40a7a18c4e2d6524ac1df4e892d3b74c
MD5 2a8620b54fc62bc3480c5e0a248059a4
SHA1 365c9fe13940e0c487aba0e563ce77fa11108738
SHA512 01f6efd80cdef4e92f9aa1c771955978c9954672ed61dbe63eceb48f534dce91751ec8a12cf14e8b77439bee34292080c4393d9bd745e5d729f7789b2c1feb50
SSDEEP 192:sxRYR2yM/jK1Ml8wCg/fKs+2tlCZUnzoA8pi/g6+WNIYnY3hkGuzEIgtJ:sxRYQ8g/fKs+KlE9i/5I5ROzo3
TLSH
T11752D9166A3499778CDBD20DFA557F93D6F91533A2901E44AAFCCA0C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 88ee431791f97bd2a9bacdacc31c9f466ad2bb2b6211fb4ad776a4d43cac098f
MD5 b33e6efcf3665e40837e161b5258cb53
SHA1 f28cf2ec56d94ecd4fa0c3d300b2f1a319e6103e
SHA512 ca512c605a4751e79f30294255c0111719833ab0a82a7eaa394fc6b4fc403cb9017a39527339f1d00dd16f146056919fb210c4a2e9cb849522f69a8916f249f6
SSDEEP 192:sxRzR2yM/jK1Ml8wCg/fKs72tlCZUnzoA8pi/g6+WNIYnY3hkGuzEIgDgJ:sxRzQ8g/fKs7KlE9i/5I5ROzoY
TLSH
T1BC52D9166A3499778CDBD20DFA55BF93D6F91533A2901E44AAFCCA0C01E76ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e8c9bfa013064e51c532c6737e1f86b765d31cb42613b2bf811548464cea9976
MD5 acda5196808beebaef992ccc3decde70
SHA1 df1aeedfe599c511d18102bfd7883cffd8c33795
SHA512 78c7b1493f754ea30b7bb27037c34bc15262531ae963a6a25507ecee1fbc69b9c426da9b4717b6e78df3a8e7e6adca970411e5941ff532145812da4ffe24a616
SSDEEP 192:sxRzR2yM/jK1Ml8UQKCg/fKs72t2CZUbzoA8prU/g6+WNCSC/YncXhkGuzEIgDWJ:sxRzgqtg/fKs7K2ElY/5q/VxOzo2
TLSH
T11362E9166A3499779CDBD20DFA51BF93D6F51533A2901E44AAFCCB0C00E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 95c5bdf18e37c91bf804d12a9774eef1830422aff1428df6572e90378819ac0f
MD5 fcdda416643db497f4c8022f36589b2d
SHA1 75d365255e55671276efe4f068767a0db6466807
SHA512 1edfcf7db884ea208e58d5e085a30caf77a01897b78292d35ecc7ea4bf27bc447b43b3dddf99fb3023f249806c2d2e5d769685b0c8730f0d50729df4d867710a
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVv9Ou4YHroSG8nG:wGedPsE7X6WgoufDMu1jaM9OVYU6G
TLSH
T117E2DB3B680CCB7E4F844EDCEC29BE9FADA801CB56D88D5447EA840C03C66EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f13919000c4c373c555da24454a1d1752ef9bccd927c0735afcddc4c026bac89
MD5 2cb4cb1835b2a7f291d4b366403fef49
SHA1 18f8789b06aa12845edc48c4c5d224683722078b
SHA512 807fe8484bdd5967d6a2e37e38d89079f35a3223141e5df66c493d4d1ce5952f0a5c41c7630db2baad45b5cf3ff144643cf332f2dca582045cb582cfd50eab67
SSDEEP 96:KReTieYgQGWAltgeGK4DgcGcW+9M+XHklQUuSW0Wyf/gc0K4xgW0cUUfO3gYKRGr:CeTieYgQxAl+eODgc1W+9M+XHklQUuSr
TLSH
T18A919556713A175438BE764C84669D1AD6C6B0B33218F62B37E901E20F27E038DFE4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a22fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a22fa.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5d955306d61aeae922a6f904f47b58e1dfb616b5ad12281b77b00310e4d96c39
MD5 62e6f3bed2cbad9bb458d8f4844329b8
SHA1 91e63471381f1d9be7614c84034686f3a10c39b9
SHA512 4cbb4c0fa99d4544ea8205f7c9ce83ab48fb9b0e5e4325bb9ba4161363646554dc8a5befcd4501a1235cfaab9a90a1d13b5eceeeb400efcf458b511d97418ba7
SSDEEP 768:6rv+4UNbds3fiDZIO0CEl8dNzc4ReyIsX9eVH1S5D:6bsbS3wDtc44bsNEH1Y
TLSH
T16903CF32A8688977ACF69786B44B76133EF8612B82C81ED4C5DE2F0C464B1DD130F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4622375a1ceed73399a04123cefc317e3d1dff86f57be73f0d697ac07f1afbd9
MD5 66c1be6fc407d9833f608f73b2e67c33
SHA1 c3d94f74943277b4aa446957ced1b1f35cc4f11c
SHA512 c4eb59a9916d18c03b1e2280fcaf3f5b53a0ac957df58c24298a890c5dd20db56fbafff2caf677ddb11228bb1ab1983003277b8a5f360e9ded7b70088b682ac0
SSDEEP 768:vF1j+9b3SwgglZw5O0CEl8sANzc4ReyIsPXOot:G9b3PiAtc44bsfOot
TLSH
T176F28D36DC65CD6BBCF65B86FA067686AEF0116786C86DD4EAD95E4C00832ED034BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c7c069c2ebf70e5798dcf2661e22e772eedb36db90e136b07ebe6d38fa58d7db
MD5 91c4251daf5ecd586e622d0439f11689
SHA1 49e5b88691ace588cfc07f8d014bd69bf9a56803
SHA512 17162e33c31d33fd6a84f9b41ae0eff0ca895f7332d1b8c3dd662f1e5a838a944de6c137d767d7ec7d34b2487a9e5c850164733c03e3a017ec76a6b2102db178
SSDEEP 768:9rv+4UNbd236EDZIO0CEl8skNzc4ReyIsPXeVH1S5F:9bsb831iktc44bsfEH1W
TLSH
T12113CF32A8799D73ACFAA746B44776937EF4212B81C80E94D5EA4F0C0A4B1DD135F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b2c84cad5dba13399ddb7528fd9fc6e50ba3938ddbdd8e7e4ed957e204bae7a3
MD5 565fc40e1900c3c8ce2f39fd61ff6296
SHA1 3792f2ce4718ef9966227191bb2a1e1f42e4b7e9
SHA512 d189cd54cb455224bf2009ce297d2952bfa9afe3f37c5c30ba131dbc8cb0cbe0c66078a3a25c112130ac58870ffddf5d0227b741d27a26e1db36380a5a2d5057
SSDEEP 768:Urv+4UNbd23tEDZIO0CEl8sgNzc4ReyIsPXOo4:Ubsb83Uigtc44bsfOo4
TLSH
T15903CF32F829DD63ACFAA642B40776837EF4215786C80E94EADA5F4C09471ED275F813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 a55adb55104f2b43dc7c2636619418253c7ae0bb46c9ad11285e846ba96d47ee
MD5 119521333a78b79ce05c7f4229d38a17
SHA1 4a0bc5a7bc32df7f606eabc49606b1e225d4bf33
SHA512 e8b65956e2da1ffe45e487dcc4188a22297c979da2d382361631ad0a453cef3dcdaad5944427001acadc77a76194bfd0b74e3f65777e220ed639a5a62d5cff66
SSDEEP 768:Vj+943HEDZIO0CEl8sgNzc4ReyIsPXOot:g943qigtc44bsfOot
TLSH
T1D9E2BF31AC66DC67ACEAA746F9073682BEF0116B81C42D94DAED9F0C05833ED175F416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

61d4d449-6731-41f3-9e8d-9c826bc4ea48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\61d4d449-6731-41f3-9e8d-9c826bc4ea48.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1060_1661387627\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 6e2de20aed09610915872e8c7757073c1408ccf6733bda306cce8d13681ab1ce
MD5 aefe7d6242ea96b99a3a7d14fc6da58c
SHA1 dde5d43b227e47bc51cd21dff40c23c8cc5435c6
SHA512 b49c997c976483488f005d715be595555f0bdb0ec9992e7a820e4e7b311dfb044f879bf2fefae0c03efd34125c5f78cf985e40d029e34ad015b2cd07f5d0d1cd
TLSH
T13B71238397B9C6B3C2DA9BF002835648F5FF6238476370200B915586AB30A7A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/632-328-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/760-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2164-193-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2328-240-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2412-376-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2900-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3308-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4152-518-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4152-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4164-488-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4456-392-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4520-517-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4676-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5388-268-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5608-452-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5692-313-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-432-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5968-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download