systex | 6939864c64ea01176ef84b32bbba39c55c4366e48a37756af1d735ed89098827

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260701-v2rc4acy9s
SHA256 6939864c64ea01176ef84b32bbba39c55c4366e48a37756af1d735ed89098827
MD5 0d0bcb7c47bda49bd2a0626c6b873a8b
SHA1 824f095f24a42045e419f232e70b035737700830
SHA512 ced2f45bdf1243ad96dae521c33168f384236ec93ce8bc17ed56c0959b667ad926b4ca59cc2a38c1b267d5887dfad8ed77a3f6dab3b6a4c804021e0ec20b2cc6
SSDEEP 6144:gvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:gvzsVKZzGjSGecvX
TLSH
T12F847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4676	icausqkicavsnkfd.exe
3488	icausqkicavsnkfd.sys
2868	CreateProcess.exe
1096	nlfdxvsnki.exe
5752	CreateProcess.exe
1324	CreateProcess.exe
576	i_nlfdxvsnki.exe
2388	czxspkhczx.sys
4260	CreateProcess.exe
1768	ausmkecaus.exe
2908	CreateProcess.exe
2424	CreateProcess.exe
4468	i_ausmkecaus.exe
1776	rpjhczusmk.sys
2332	CreateProcess.exe
2316	mkeczurmjh.exe
4696	CreateProcess.exe
2504	CreateProcess.exe
2040	i_mkeczurmjh.exe
724	urmbzwuomj.sys
3788	CreateProcess.exe
3396	rmjheztrmj.exe
5888	CreateProcess.exe
2900	CreateProcess.exe
2444	i_rmjheztrmj.exe
5864	rljebwuomg.sys
3004	CreateProcess.exe
5632	mjetrljdbw.exe
4668	CreateProcess.exe
5588	CreateProcess.exe
4804	i_mjetrljdbw.exe
3340	jdbvtoljgb.sys
4536	CreateProcess.exe
2612	gbytqojgby.exe
2540	CreateProcess.exe
5220	CreateProcess.exe
5952	i_gbytqojgby.exe
2712	igdyvtnlig.sys
4812	CreateProcess.exe
5412	ligaytqoid.exe
4688	CreateProcess.exe
5684	CreateProcess.exe
6132	i_ligaytqoid.exe
2832	daytqljdbv.sys
5296	CreateProcess.exe
1996	xsqkicavsn.exe
1164	CreateProcess.exe
404	CreateProcess.exe
300	i_xsqkicavsn.exe
2912	qnifaysqki.sys
5760	CreateProcess.exe
3408	nigaysqkid.exe
2828	CreateProcess.exe
2636	CreateProcess.exe
4468	i_nigaysqkid.exe
3672	caxspkicau.sys
5748	CreateProcess.exe
3236	ausnkfcaus.exe
5300	CreateProcess.exe
2676	CreateProcess.exe
2832	i_ausnkfcaus.exe
4316	hfzxspjhcz.sys
1544	CreateProcess.exe
4108	ecxupmhfzx.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_1852895351\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_783939778\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_435377414\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_916113333\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_916113333\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_916113333\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_916113333\smart_switch_list.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_783939778\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5908_435377414\nav_config.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvsqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mjetrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausqkicavsnkfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtoljgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtoljgbywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxuhecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkecaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjheztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligaytqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgbywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkeczurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgbywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvsqnigay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnlfdxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxuhecxupm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytqojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkeczurmjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdxvsnki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjheztrmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligaytqoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nigaysqkid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausnkfcaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecxupmhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mjetrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhezwurpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhezwurpjh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4852	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1536	ipconfig.exe
3672	ipconfig.exe
1136	ipconfig.exe
5608	ipconfig.exe
2568	ipconfig.exe
2476	ipconfig.exe
5444	ipconfig.exe
5668	ipconfig.exe
2052	ipconfig.exe
4464	ipconfig.exe
4196	ipconfig.exe
5112	ipconfig.exe
5504	ipconfig.exe
2508	ipconfig.exe
3760	ipconfig.exe
2324	ipconfig.exe
5836	ipconfig.exe
1348	ipconfig.exe
5476	ipconfig.exe
3348	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274005756996384"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2132828192-1552876075-2324613956-1000\{284EC87F-4621-4C16-8553-A94A6CBD2EC7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe
4676	icausqkicavsnkfd.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe
5908	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	576	i_nlfdxvsnki.exe
Token: SeDebugPrivilege	4468	i_ausmkecaus.exe
Token: SeDebugPrivilege	2040	i_mkeczurmjh.exe
Token: SeDebugPrivilege	2444	i_rmjheztrmj.exe
Token: SeDebugPrivilege	4804	i_mjetrljdbw.exe
Token: SeDebugPrivilege	5952	i_gbytqojgby.exe
Token: SeDebugPrivilege	6132	i_ligaytqoid.exe
Token: SeDebugPrivilege	300	i_xsqkicavsn.exe
Token: SeDebugPrivilege	4468	i_nigaysqkid.exe
Token: SeDebugPrivilege	2832	i_ausnkfcaus.exe
Token: SeDebugPrivilege	2004	i_ecxupmhfzx.exe
Token: SeDebugPrivilege	3428	i_jhezwurpjh.exe
Token: SeDebugPrivilege	4644	i_ecwuomhezw.exe
Token: SeDebugPrivilege	784	i_bwuomgbywr.exe
Token: SeDebugPrivilege	2812	i_wtoljgbywq.exe
Token: SeDebugPrivilege	5068	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	4276	i_dbvsqnigay.exe
Token: SeDebugPrivilege	1052	i_avsnlfdxvp.exe
Token: SeDebugPrivilege	1680	i_pnkfcxupnh.exe
Token: SeDebugPrivilege	2812	i_cxuhecxupm.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 4676	6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 6084 wrote to memory of 5396	6084	2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 5396 wrote to memory of 5908	5396	iexplore.exe	90
PID 5908 wrote to memory of 4892	5908	msedge.exe	91
PID 5908 wrote to memory of 4848	5908	msedge.exe	92
PID 5908 wrote to memory of 4852	5908	msedge.exe	93
PID 5908 wrote to memory of 4848	5908	msedge.exe	92
PID 5908 wrote to memory of 4848	5908	msedge.exe	92
PID 5908 wrote to memory of 2976	5908	msedge.exe	94
PID 5908 wrote to memory of 2976	5908	msedge.exe	94
PID 5908 wrote to memory of 2320	5908	msedge.exe	96
PID 5908 wrote to memory of 2320	5908	msedge.exe	96
PID 5908 wrote to memory of 2320	5908	msedge.exe	96
PID 5908 wrote to memory of 5764	5908	msedge.exe	97
PID 5908 wrote to memory of 5764	5908	msedge.exe	97
PID 5908 wrote to memory of 5764	5908	msedge.exe	97
PID 5908 wrote to memory of 6040	5908	msedge.exe	98
PID 5908 wrote to memory of 1132	5908	msedge.exe	99
PID 5908 wrote to memory of 6040	5908	msedge.exe	98
PID 5908 wrote to memory of 6040	5908	msedge.exe	98
PID 5908 wrote to memory of 1132	5908	msedge.exe	99
PID 5908 wrote to memory of 1132	5908	msedge.exe	99
PID 5908 wrote to memory of 5780	5908	msedge.exe	101
PID 5908 wrote to memory of 5780	5908	msedge.exe	101
PID 5908 wrote to memory of 1480	5908	msedge.exe	104
PID 5908 wrote to memory of 1480	5908	msedge.exe	104
PID 5908 wrote to memory of 3212	5908	msedge.exe	105
PID 5908 wrote to memory of 3212	5908	msedge.exe	105
PID 5908 wrote to memory of 4804	5908	msedge.exe	107
PID 4676 wrote to memory of 2868	4676	icausqkicavsnkfd.exe	108
PID 1096 wrote to memory of 5752	1096	nlfdxvsnki.exe	111
PID 5908 wrote to memory of 6132	5908	msedge.exe	112
PID 5908 wrote to memory of 6132	5908	msedge.exe	112
PID 5908 wrote to memory of 3324	5908	msedge.exe	117
PID 5908 wrote to memory of 3324	5908	msedge.exe	117
PID 4676 wrote to memory of 1324	4676	icausqkicavsnkfd.exe	118
PID 4676 wrote to memory of 4260	4676	icausqkicavsnkfd.exe	122
PID 1768 wrote to memory of 2908	1768	ausmkecaus.exe	124
PID 4676 wrote to memory of 2424	4676	icausqkicavsnkfd.exe	127
PID 4676 wrote to memory of 2332	4676	icausqkicavsnkfd.exe	131
PID 2316 wrote to memory of 4696	2316	mkeczurmjh.exe	133
PID 4676 wrote to memory of 2504	4676	icausqkicavsnkfd.exe	136
PID 4676 wrote to memory of 3788	4676	icausqkicavsnkfd.exe	140
PID 3396 wrote to memory of 5888	3396	rmjheztrmj.exe	142
PID 4676 wrote to memory of 2900	4676	icausqkicavsnkfd.exe	146
PID 5908 wrote to memory of 4308	5908	msedge.exe	148
PID 5908 wrote to memory of 2696	5908	msedge.exe	149
PID 5908 wrote to memory of 4760	5908	msedge.exe	150
PID 4676 wrote to memory of 3004	4676	icausqkicavsnkfd.exe	153
PID 5632 wrote to memory of 4668	5632	mjetrljdbw.exe	155
PID 4676 wrote to memory of 5588	4676	icausqkicavsnkfd.exe	158
PID 4676 wrote to memory of 4536	4676	icausqkicavsnkfd.exe	162
PID 2612 wrote to memory of 2540	2612	gbytqojgby.exe	164
PID 4676 wrote to memory of 5220	4676	icausqkicavsnkfd.exe	167
PID 4676 wrote to memory of 4812	4676	icausqkicavsnkfd.exe	171
PID 5412 wrote to memory of 4688	5412	ligaytqoid.exe	173
PID 4676 wrote to memory of 5684	4676	icausqkicavsnkfd.exe	176
PID 4676 wrote to memory of 5296	4676	icausqkicavsnkfd.exe	180
PID 1996 wrote to memory of 1164	1996	xsqkicavsn.exe	182
PID 4676 wrote to memory of 404	4676	icausqkicavsnkfd.exe	185
PID 5908 wrote to memory of 4864	5908	msedge.exe	187
PID 5908 wrote to memory of 4864	5908	msedge.exe	187
PID 4676 wrote to memory of 5760	4676	icausqkicavsnkfd.exe	193
PID 3408 wrote to memory of 2828	3408	nigaysqkid.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0d0bcb7c47bda49bd2a0626c6b873a8b_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Temp\icausqkicavsnkfd.exe
  C:\Temp\icausqkicavsnkfd.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdxvsnki.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2868
  - - C:\Temp\nlfdxvsnki.exe
      C:\Temp\nlfdxvsnki.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdxvsnki.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1324
  - - C:\Temp\i_nlfdxvsnki.exe
      C:\Temp\i_nlfdxvsnki.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:576
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkecaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\ausmkecaus.exe
      C:\Temp\ausmkecaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkecaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2424
  - - C:\Temp\i_ausmkecaus.exe
      C:\Temp\i_ausmkecaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkeczurmjh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2332
  - - C:\Temp\mkeczurmjh.exe
      C:\Temp\mkeczurmjh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2316
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkeczurmjh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2504
  - - C:\Temp\i_mkeczurmjh.exe
      C:\Temp\i_mkeczurmjh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjheztrmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3788
  - - C:\Temp\rmjheztrmj.exe
      C:\Temp\rmjheztrmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3396
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjheztrmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2900
  - - C:\Temp\i_rmjheztrmj.exe
      C:\Temp\i_rmjheztrmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2444
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mjetrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3004
  - - C:\Temp\mjetrljdbw.exe
      C:\Temp\mjetrljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mjetrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5588
  - - C:\Temp\i_mjetrljdbw.exe
      C:\Temp\i_mjetrljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytqojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4536
  - - C:\Temp\gbytqojgby.exe
      C:\Temp\gbytqojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2612
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytqojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5220
  - - C:\Temp\i_gbytqojgby.exe
      C:\Temp\i_gbytqojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligaytqoid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4812
  - - C:\Temp\ligaytqoid.exe
      C:\Temp\ligaytqoid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5412
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligaytqoid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5684
  - - C:\Temp\i_ligaytqoid.exe
      C:\Temp\i_ligaytqoid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xsqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5296
  - - C:\Temp\xsqkicavsn.exe
      C:\Temp\xsqkicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1164
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xsqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:404
  - - C:\Temp\i_xsqkicavsn.exe
      C:\Temp\i_xsqkicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nigaysqkid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5760
  - - C:\Temp\nigaysqkid.exe
      C:\Temp\nigaysqkid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nigaysqkid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2636
  - - C:\Temp\i_nigaysqkid.exe
      C:\Temp\i_nigaysqkid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausnkfcaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5748
  - - C:\Temp\ausnkfcaus.exe
      C:\Temp\ausnkfcaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3236
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausnkfcaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2676
  - - C:\Temp\i_ausnkfcaus.exe
      C:\Temp\i_ausnkfcaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecxupmhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1544
  - - C:\Temp\ecxupmhfzx.exe
      C:\Temp\ecxupmhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:300
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecxupmhfzx.exe ups_ins
    3⤵
    PID:1896
  - - C:\Temp\i_ecxupmhfzx.exe
      C:\Temp\i_ecxupmhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhezwurpjh.exe ups_run
    3⤵
    PID:3660
  - - C:\Temp\jhezwurpjh.exe
      C:\Temp\jhezwurpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1540
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhezwurpjh.exe ups_ins
    3⤵
    PID:5216
  - - C:\Temp\i_jhezwurpjh.exe
      C:\Temp\i_jhezwurpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3428
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezw.exe ups_run
    3⤵
    PID:3060
  - - C:\Temp\ecwuomhezw.exe
      C:\Temp\ecwuomhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3148
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezw.exe ups_ins
    3⤵
    PID:5056
  - - C:\Temp\i_ecwuomhezw.exe
      C:\Temp\i_ecwuomhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomgbywr.exe ups_run
    3⤵
    PID:948
  - - C:\Temp\bwuomgbywr.exe
      C:\Temp\bwuomgbywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2004
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5112
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomgbywr.exe ups_ins
    3⤵
    PID:5876
  - - C:\Temp\i_bwuomgbywr.exe
      C:\Temp\i_bwuomgbywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtoljgbywq.exe ups_run
    3⤵
    PID:3652
  - - C:\Temp\wtoljgbywq.exe
      C:\Temp\wtoljgbywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtoljgbywq.exe ups_ins
    3⤵
    PID:5044
  - - C:\Temp\i_wtoljgbywq.exe
      C:\Temp\i_wtoljgbywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    PID:2380
  - - C:\Temp\bvtnlgdyvq.exe
      C:\Temp\bvtnlgdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2352
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    PID:5976
  - - C:\Temp\i_bvtnlgdyvq.exe
      C:\Temp\i_bvtnlgdyvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvsqnigay.exe ups_run
    3⤵
    PID:5036
  - - C:\Temp\dbvsqnigay.exe
      C:\Temp\dbvsqnigay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3672
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvsqnigay.exe ups_ins
    3⤵
    PID:5392
  - - C:\Temp\i_dbvsqnigay.exe
      C:\Temp\i_dbvsqnigay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnlfdxvp.exe ups_run
    3⤵
    PID:2716
  - - C:\Temp\avsnlfdxvp.exe
      C:\Temp\avsnlfdxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2088
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4196
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnlfdxvp.exe ups_ins
    3⤵
    PID:3308
  - - C:\Temp\i_avsnlfdxvp.exe
      C:\Temp\i_avsnlfdxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfcxupnh.exe ups_run
    3⤵
    PID:4804
  - - C:\Temp\pnkfcxupnh.exe
      C:\Temp\pnkfcxupnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfcxupnh.exe ups_ins
    3⤵
    PID:5816
  - - C:\Temp\i_pnkfcxupnh.exe
      C:\Temp\i_pnkfcxupnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxuhecxupm.exe ups_run
    3⤵
    PID:1300
  - - C:\Temp\cxuhecxupm.exe
      C:\Temp\cxuhecxupm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4732
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3084
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxuhecxupm.exe ups_ins
    3⤵
    PID:1148
  - - C:\Temp\i_cxuhecxupm.exe
      C:\Temp\i_cxuhecxupm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2812
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffa4c1fc188,0x7ffa4c1fc194,0x7ffa4c1fc1a0
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9249515399868730269,4986014849912611431,262144 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
      4⤵
      PID:4848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9225721443917291357,8877857412170191142,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
      4⤵
      System Time Discovery
      PID:4852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,8237828631274578066,2542349184061992237,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:13
      4⤵
      PID:2976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,4219954827781311087,13447622335406973139,2097152 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:2320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3588,i,3315704738517926538,17912524153449247806,2097152 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,6863634205627091406,14696975484736542490,2097152 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
      4⤵
      PID:6040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,14490740858077246334,5027060212130974865,2097152 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:9
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,7249962154291358431,4019001185439745903,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:5780
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3510630744161115561,7726679810123300521,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,1554028896925714564,11793659467524984696,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,1842966691394422957,7544524507983569648,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,1842966691394422957,7544524507983569648,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
      4⤵
      PID:4804
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16874595441827741024,4366328352829241955,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:6132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,15581189980280343208,18333713147856044931,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:3324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,17519238511894206878,7577254563166153793,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8401143961070108975,11214114858186301802,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11948820097037077626,17748962693938934345,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,685857640173212732,13495060821037145921,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:4864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13641897957476970131,2565081889835425820,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
      4⤵
      PID:5608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=936,i,17906825886539463175,7320604614973937236,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:14
      4⤵
      PID:688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,3795054222256031768,8946853869151157737,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=936 /prefetch:14
      4⤵
      PID:3716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6884,i,15626904145622980163,17609118990666400904,262144 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:10
      4⤵
      PID:3232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,17756114093326460934,14178331567854635430,524288 --field-trial-handle=2360,i,2686044037487086575,2263286957429695505,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:14
      4⤵
      PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2444

C:\Temp\icausqkicavsnkfd.sys
C:\Temp\icausqkicavsnkfd.sys
1⤵
- Executes dropped EXE
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5176

C:\Temp\czxspkhczx.sys
C:\Temp\czxspkhczx.sys
1⤵
- Executes dropped EXE
PID:2388

C:\Temp\rpjhczusmk.sys
C:\Temp\rpjhczusmk.sys
1⤵
- Executes dropped EXE
PID:1776

C:\Temp\urmbzwuomj.sys
C:\Temp\urmbzwuomj.sys
1⤵
- Executes dropped EXE
PID:724

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
- Executes dropped EXE
PID:5864

C:\Temp\jdbvtoljgb.sys
C:\Temp\jdbvtoljgb.sys
1⤵
- Executes dropped EXE
PID:3340

C:\Temp\igdyvtnlig.sys
C:\Temp\igdyvtnlig.sys
1⤵
- Executes dropped EXE
PID:2712

C:\Temp\daytqljdbv.sys
C:\Temp\daytqljdbv.sys
1⤵
- Executes dropped EXE
PID:2832

C:\Temp\qnifaysqki.sys
C:\Temp\qnifaysqki.sys
1⤵
- Executes dropped EXE
PID:2912

C:\Temp\caxspkicau.sys
C:\Temp\caxspkicau.sys
1⤵
- Executes dropped EXE
PID:3672

C:\Temp\hfzxspjhcz.sys
C:\Temp\hfzxspjhcz.sys
1⤵
- Executes dropped EXE
PID:4316

C:\Temp\pmkhczxrpj.sys
C:\Temp\pmkhczxrpj.sys
1⤵
PID:3568

C:\Temp\bztrpjhbzu.sys
C:\Temp\bztrpjhbzu.sys
1⤵
PID:3652

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:3756

C:\Temp\tqolgdbytr.sys
C:\Temp\tqolgdbytr.sys
1⤵
PID:4192

C:\Temp\lgdywqoiga.sys
C:\Temp\lgdywqoiga.sys
1⤵
PID:2436

C:\Temp\davsqkigdy.sys
C:\Temp\davsqkigdy.sys
1⤵
PID:6112

C:\Temp\dxvsnkfdxv.sys
C:\Temp\dxvsnkfdxv.sys
1⤵
PID:1148

C:\Temp\fvpnhfzxsp.sys
C:\Temp\fvpnhfzxsp.sys
1⤵
PID:2172

C:\Temp\zxupnhfcxu.sys
C:\Temp\zxupnhfcxu.sys
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkecaus.exe

Path C:\Temp\ausmkecaus.exe
Size 376KB
SHA256 f2d2cd6cdd059e0ec49228d4a7459fd18e493bc0a6a37d1b750af8176133536d
MD5 70f75f2e9fd160ca5327acba14c5b874
SHA1 be820dbbed258c05b0e214306a7659afdca668f2
SHA512 a1b277d21bd25cfaa3a1798256a74cee7b47d3024628987d2513af8709d71f878efe3828b949d9da24aa67ffb3055f8553dd1a641d347c1b51749c326b1b3d34
SSDEEP 6144:0vzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:0vzsVKZzGjSGecvX
TLSH
T152847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czxspkhczx.sys

Path C:\Temp\czxspkhczx.sys
Size 293KB
SHA256 474f9e961413ccbbba9ea6183747d754c28b3bc2e660b3607cb17ee1078a013b
MD5 77e58623342bdbe8ca51a6dfacfe55f0
SHA1 4644f740275f506f0b6da745685d13866be39ee0
SHA512 bf35c1bca781582fa56d0c4ef487268ef9b848c3a44d51bc05dc3eac9e133057a5884d034ccea44dc4349c222a08213493ece7000517865b7ef681aee0989e24
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T175545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqojgby.exe

Path C:\Temp\gbytqojgby.exe
Size 376KB
SHA256 55e2f9119ab75017bd022046afb5000145a8de21c6eb2c5ac65d5f9e4ddf340c
MD5 bac1b967ca0e4bc1f9b391828b618e65
SHA1 a2f080af3e1120ca4c8624d64ba1ac8a8f401c7f
SHA512 295103ec0b9c6b6afaa1322190be111762470ee7539fde517edb6db9e1f9d0b66199c7d7d91f608670158c142003b644e010f62a0b78458f86bfcc4429655859
SSDEEP 6144:pvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:pvzsVKZzGjSGecvX
TLSH
T1DA847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkecaus.exe

Path C:\Temp\i_ausmkecaus.exe
Size 376KB
SHA256 c5c8b8611d45d2297d450140203bd076e1939eb47a824f5098b11dddb007edc3
MD5 bf42b3e6133f7a9a3e1b77a04efd54a4
SHA1 66de5b8fd4ddd58f2d2d2ac7643181cc4aae1415
SHA512 b86d42d72b8725c188e8d24b9b70470d1c6e5b13acca8b9d54d388f2e749eebf8dcf5481202b0e7526cd4803faf1dda669859025c25110c96e0a1e3e20a59859
SSDEEP 6144:MvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:MvzsVKZzGjSGecvX
TLSH
T15B847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mjetrljdbw.exe

Path C:\Temp\i_mjetrljdbw.exe
Size 376KB
SHA256 ad47c8a0c83fef1285d34e95c0d572ddedb88a213a689bd2fc7f56089ac6fa39
MD5 da1cda46d838b502b8c43d98a777f2d8
SHA1 619608b808db3b594cb8ff4cb6dce80b1647159c
SHA512 c0f604bc3bce702c3fbf4c2cc695139c3e4a7a5d8ba3521a1713ded492c4378762e9a616579283dc32d30af04445161c685a1d14c1bbda1fe5e75f9a50b1506d
SSDEEP 6144:8vzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:8vzsVKZzGjSGecvX
TLSH
T177847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mkeczurmjh.exe

Path C:\Temp\i_mkeczurmjh.exe
Size 376KB
SHA256 160c6f09cd58b5cfed08b926466bfc79794d7c1af621fd44c480db4b8621bead
MD5 38e1359c7202d0e547605cd8d6a91808
SHA1 62df305ab859161b8f62e9ef2f6aff28e6bfbc84
SHA512 f78fbbae61513061e0fce64e6812ab4e88d62832d81e50d279634d25d259ec5d144ca4d2a0df431ed0c702af05192eac37e9f17a91cf7abbe655c009ca03ec9a
SSDEEP 6144:7vzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:7vzsVKZzGjSGecvX
TLSH
T114847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_nlfdxvsnki.exe

Path C:\Temp\i_nlfdxvsnki.exe
Size 376KB
SHA256 6d69f03fdd1520152681908feb3b2586f5cf0c481e82e5fa4ffa95ad01044e7c
MD5 78131f6a96ac53abcfdd7b6bf870c97f
SHA1 c3f881684bf81dc3010b53d3d195241d06d90fea
SHA512 fdc29624accad2b22985d7e7739ace4258faee07ba7a3a40228c765d5afbcdd5ef357fea9b2d9eb495e0ee474cfc5c7fb6044ed7dd4aba3c2c3b1bc37f54a673
SSDEEP 6144:DvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:DvzsVKZzGjSGecvX
TLSH
T152847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_rmjheztrmj.exe

Path C:\Temp\i_rmjheztrmj.exe
Size 376KB
SHA256 89c67a9a2248a7e18f442a8d145814a106c414691469c2b45da1ac7c85ee7500
MD5 b6082f0cc1934b51cd9923f6865702b2
SHA1 52cab7466dba4837db820e93486b69f6b762e098
SHA512 72c495961a6e559ec4ae47569b34e95e402da239f7329b0ced5b32c8a167aea3f81868d137f8cd636cb00e5bb8706c666666247faf1f06e50678426174cb2060
SSDEEP 6144:AvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:AvzsVKZzGjSGecvX
TLSH
T17D847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausqkicavsnkfd.exe

Path C:\Temp\icausqkicavsnkfd.exe
Size 376KB
SHA256 07a6b603e22a24ea1d02014ea61988b68d1216f7d66a2ecb45bbfb4e59e8e99b
MD5 3b330c1e04a464381bca99cf90808609
SHA1 01746800342f47a2ca528a68dd1cf3673a4f8440
SHA512 0cdf2dd8e84667fc017b6e9d2bee87dc8b4e7bf08cadeaf8b38d8f1e7306f6719a4659854acd04fcda29a9b5d425f98f9cbadd143cb4a9454427c40c7e2db8c9
SSDEEP 6144:PvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:PvzsVKZzGjSGecvX
TLSH
T146847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausqkicavsnkfd.sys

Path C:\Temp\icausqkicavsnkfd.sys
Size 293KB
SHA256 79d0d7bc210c51b3999fd0ce53ab13592db7b1f06f77e8261c113965ffc46be6
MD5 01ff46530830ca21f9e812c22662ebab
SHA1 16c0d7a72d960f30c42ab4421e348369a4abf136
SHA512 e5f9976c4d5f1c8fd0fb966f650fb95762d0c815188f6e69ec439d1f058ce2b98b5e90f18d18115408ce7ea236bae4c0b0462d312066cf27dbdaa1e2642b6be7
SSDEEP 3072:gtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:gIJjiJcbI03GBc3ucY5DCSj
TLSH
T174545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdbvtoljgb.sys

Path C:\Temp\jdbvtoljgb.sys
Size 293KB
SHA256 4a7035733b05f501d78e273911b9a6dffaf3ab2d69b84a60f3d66c68bcc79a9b
MD5 59b7dbcdcb77f67907f9f913773126fc
SHA1 1f7c52daf95397ab671319bd277ff71510699290
SHA512 414cfca62fce4174a37bd26616f47f601dfc6aebcfb6fd0bebae34deb366720484b71ad0d55040623d0612d8dee1be05f893a30f0f0aeb5c2e4a1321d61d57c3
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T131545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mjetrljdbw.exe

Path C:\Temp\mjetrljdbw.exe
Size 376KB
SHA256 adafbc44e911c3a78d4be45241535241ce8481358fabc6a90d753147ce5fd87f
MD5 7dcee11d6359cdca8300b43cf9ec21d5
SHA1 81d1957b49b731320723c9671f99f6114c8253f9
SHA512 03ffa7699bfebab15947b7e2ba177e5f46492b9113f3bf9d3b9ad65596dad361f281bb7edcc06db6d6fd0981147d9762865eca27d09958e6aea3ce83e0c3770c
SSDEEP 6144:BvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:BvzsVKZzGjSGecvX
TLSH
T144847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkeczurmjh.exe

Path C:\Temp\mkeczurmjh.exe
Size 376KB
SHA256 021b590c97b5240d932068cfaa5ca5fc853f386d27ff75b9f4542406d9fec512
MD5 b5fbc8ed8c71a6c594438eac0cff7f15
SHA1 a29a8bdd0bb719ba220773a2e4a8dc60b04c09a6
SHA512 565c898f6755d086f518668670907a89d784679632d5b0dc7aa3f9a3cbe8c2a5d0b6683bb737f2d66b3fabbad1ea0eeecaf84c4127d1e359c762dfced5219f48
SSDEEP 6144:AvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:AvzsVKZzGjSGecvX
TLSH
T1B3847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nlfdxvsnki.exe

Path C:\Temp\nlfdxvsnki.exe
Size 376KB
SHA256 28b57f83774dd25461557204cc80814aa248e75dce4b8a1c315ef29aeb22e8c8
MD5 f117277d469e58a1c27ef691eb3147ad
SHA1 1fb7685ee83d62f379e90d21ce3400405a8a4ae3
SHA512 e8f174743ef61a913017fff0fe56e2b2c126382f7ab1f679efa93e7b55c050d98514da7fb645380edb81dca5f71799cb4dff6444a41aec1a72c3785d91a863db
SSDEEP 6144:LvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:LvzsVKZzGjSGecvX
TLSH
T174847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rljebwuomg.sys

Path C:\Temp\rljebwuomg.sys
Size 293KB
SHA256 ca28602563d0dca120dd7acd443d5d6eced85b26c517ce51a1aedb2d4f309581
MD5 23b86c39d0a2b8937d1d3f87f976c35e
SHA1 27821ba38bbf24544ea8fe41e5c0286806492ac6
SHA512 6c5e0812d6914283e3b2e42c4925e4dbf78a6854f48c26d9b8c61012ea1315983e524d6ee41c96baa9e3110810aa46d58f23fa7905515b266f45e1b033b2e500
SSDEEP 3072:FtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:FIJjiJcbI03GBc3ucY5DCSj
TLSH
T18B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rmjheztrmj.exe

Path C:\Temp\rmjheztrmj.exe
Size 376KB
SHA256 1f30880b3809d7f0866ef0ed85abe3681e12e7c01ce2331208e301c41a5961e4
MD5 3b3e041c1847f768bcde57d9a576893f
SHA1 1fdff90df06a5a6e467dcbc349e487b35418ec6f
SHA512 58a663f5ba37b7df12f10558db7900dd5eb7352ede8f990eaa023506ff156ab3ad54cfcdde6b18b02aa410ea033084e501ed2fcb0646fc2633edf7a8b05cde85
SSDEEP 6144:HvzsVKLY+oIJjiJcbI03GBc3ucY5DCSjX:HvzsVKZzGjSGecvX
TLSH
T1E2847C04BAA4F0B6D995043800DBAF36A67EB4281726CBC7F354CE5D9A113C3A93579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpjhczusmk.sys

Path C:\Temp\rpjhczusmk.sys
Size 293KB
SHA256 319f3d7c986ce9491a41bae5ceb6182461f90e287b69a08118e6cbba675ca356
MD5 5fe3cc041dd07910ff02334cd93bf9a6
SHA1 27b10f0b9735564db9b33ca5fa3594712f330e69
SHA512 32590f09e69bf6df1454090b99f3db0c41b2080d216f94cecfea8135eceadd5f4b7b82f99c8fee45d1e4f96cbbd5e4d8c22871b596ee151f4e6724ba28f4f309
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmbzwuomj.sys

Path C:\Temp\urmbzwuomj.sys
Size 293KB
SHA256 2bdd3e913bd266ad970a49890bea1861bb5b698750e571df6485a67a8b48aaa5
MD5 478c6d621758ec1ab80d52701a070ac3
SHA1 c6738ce60db3878211f3f964fab156794e9ad7b1
SHA512 edd7336bf3b673464019898d2eb9b7c18ef4d337698ae785161deca81bbb0480abe6df1da6f539f431e04f235488c0e528ca78e188a5e322dbd472bf602ffadb
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T15B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 daa8d4e7c4d9303a680464186b627d47a0a570b37eab6df7cf80d6c3e4b42c4d
MD5 e3a43c91a98e4df69aedcb32e9837b12
SHA1 4c7d6eaa74ca9b4cff1f7541a2a432e62a402757
SHA512 25795f66928561b692a5a9bb479ee81674ec56fcb4f00ea338d6080a8b81d2bf30151d6720e9e531d8467b4653722d8c105b4ceb9d37ed7b3ed93137f72ed938
TLSH
T111610873F7718AD1FB81517E01E6AC983A76C0BAC6C3AE4C2074F13C8846745A9CF052
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59289d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59289d.TMP
Size 3KB
SHA256 6912ceaf1cdada230b38005957cfdb543b3e0aa238c95066d2ba7c903acfabd7
MD5 cc88988503cf1165bf0210cf435c0cfa
SHA1 4a8720d2ccca80c462976135a5552801a7684340
SHA512 3292dd3a143a892d1548d50f34ff2ec0b0f521158abfdc17a652cd8c4812c93ce659f39220ce04f3c4310781fe4f8446da40ec96af7c0ff069c2c8bf9633711d
TLSH
T120611973F7718AD0FB91517E01E6AC983A76C0BAC5C3AE4C2074F13C9846745A9CF052
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0bd144ced527660346d430bffb26ca4f2f1150efaa258ccde0b4881187f150d0
MD5 36c8366229546237858fe1c7ee4ee86d
SHA1 687bf68a01c5eebd3e628a24ffcc41907c1e50e6
SHA512 9d482ae4cc3ebd11cfa5cb65ad995247ce869be9e58b143d881904e707d275af65125909cb5728cf00d7cb0c72d23380daae6e33f2c3475f5ae8581d699933b7
TLSH
T1B651CEF7C7E8866D8A0156F4BB186E2BCE2D0914832C7D5AC8E4AF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 15ac836b3dfdb8117c2377f434a81e497d2d6381c110f0da8565f667da8aaf78
MD5 c0b3bb18bc745fb36e240b70f934a499
SHA1 6f86f0e9818c5fb7f6edd9a07dc25540e2778aaa
SHA512 a4f725da1bd54ca3040b8c1c4b89c10052bcbc33afde51b8b264c82530e8b3d16b15a7330b568ac0d5a5f0625bdddf5c5e4b1861c8244dd7001a4c59f73b4293
SSDEEP 192:sxRQpR2yM/jK1Ml8wc5/f3sYC9zaZvkv+zDzoA8p9x/g6+WNCVS/YTRVHG3IgDnJ:sxRQpEC5/f3sRtMvkvNj/5l/6iN
TLSH
T1E262E915AA2499778CDBD209FA55BF53D2F81573A2901E44A9FCCA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d5ebcbbba6593a700ed6dbf631aa95914fb2b9d6cd50a4d9452dea3c868a9eaa
MD5 f4efe2532cca18f2167aae34ff4f9f19
SHA1 a21a90e665301c799b85a3e8cc59f3bc08b535f6
SHA512 80c698abac230d918a29ae37f04eed8cc31e1cd1242fe97824ba4e6578135dbc75bab020dd58c9b0c30712268788c2d22da1cc828b5128709d1ea97a03bd244a
SSDEEP 192:sxRQpR2yM/jK1Ml8UQ/c5/f3sYC9OaZvkv+zDzoA8prx/g6+WNCVS/YTiVHG3Ig7:sxRQpEqU5/f3sRQMvkvNN/5l/Zi7
TLSH
T19D62EA16A6389A77CCDBD209FA55BF53D2F41573A2941E44AAFCCA0C01E76DD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3affbcf4af75dd5eecea13a8ddf6a74777dd64e7a33f4a5f140ea4a400af1328
MD5 2869d3cb8c3145bc34286d8c8f0c8197
SHA1 362982bbb68e88e74a5e9becbf978e9a7517d6cd
SHA512 50357d3ce7c02376b7d239f2ec3fda914de962776e2de47f7dc2a4f8d37eb98f2149d039f21cf3dd32965284aaf8b7991bd47a1a053d362a82f30b763a6d3d09
SSDEEP 192:sxRQ6R2yM/jK1Ml8wc5/f3suC9zaZvkv+zDzoA8p9x/g6+WNCVS/YTRVHG3IgtJ:sxRQ6EC5/f3sPtMvkvNj/5l/6i3
TLSH
T16462EA156A28997BCCDBD209FA55BF53D2F81573A2901E44A9FCCA0C01E76ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 2ebb7c5274763e39a29c535fee99742aaa5ad801f4ab9f91216782d8db1d1d3e
MD5 122064ae2c6870583dae81c6a60d57c6
SHA1 937bb262cad837d02fe807934548694139579b37
SHA512 f0256bb32f46dd1cea5c8f87379190aed0dd45e90ada5498bcfd98a53e74fd139d06e42296f20be4c523791ba319d30255f341341b6a354a6eff047c0b71d894
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkaDzFYnroJ8m:RGqOBfE7CrWgTvfiXu1jabaDRY0Jl
TLSH
T12AE2EC7F680CCB7E4F80499CEC29BD8E6DE801CB56D88D5447EA894C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d687d4f5485f81a4fe3c53bf1f9f77aaef6038e2c4219d74ed934fc2c351fa7a
MD5 7dc8e5fca506c369c299262462d32036
SHA1 d04d255958e2aa41a5b231960c378255ede97811
SHA512 9ed3ecad31dba4210c6402a1f7c50a3f9e76512a74c28f1508000a944489a306c7f89384e54aa2756d05ddf71475a354a975c0aa75a15e4e99a5e9105c278163
SSDEEP 96:KsO8KvKKWP+KQA0izici5iti7ixixiNWiliqiggiViNK4isgi7iNciDi7iSiFiRH:qf9ngRkQiOCPm7UY89gK3Y4rKQ1HzfzR
TLSH
T1BB913906323B3690393E390981A2946E42827163705DFC7B7BAA51E50F37E01DEFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59c598.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59c598.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 666253ceca9e560753c35dcafbbc94e6264e58fa425c272a20f3f68ebedc19f3
MD5 a47391f31827f4fba9188d27067181e9
SHA1 537a24099f429732f760708c530ccef2dbb0af24
SHA512 9492f10df502f77ecdb18b6d4c89bed132a1d506a6c730f7593f9765cca613dff62ea443ab1c3b9b0a1d9bb160a55d67abe00fff44c034d84e08ff146070b140
SSDEEP 768:JF1j+9c3WwgAYiC63tLy6XodOiIyN8Y1M1fmBnZfc8KzeJY:49c3CiCw7XodI11cctzeJY
TLSH
T1A11328F588D38937D8AE4787A73D2E469AFCC1A3B5885994B7D85D0DCC822BFD306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8926461cfac58b2482534b9cc5041b0b04da033f406f2d1ba12fbfb738fc57f6
MD5 2f98fcedbf37f94536666ade90743984
SHA1 8df48984399bd71e62dfa73605a325ce643b3e32
SHA512 71ec9034a4d38b1821cd459e3d11992125073831268f15c85632bba6ae1645ad8c75a67c425d8c372308c5f35ac1de95ff5bbb00412941b8a853196d6ad236b7
SSDEEP 768:Yrv+4UNbdj3e6URwXodOiIyN8Y1M1fmBnlBv0B:Ybsbl3emXodI11C8
TLSH
T12103BF32E864A9778CF28288F55772433FF491978BC50B94D9DC6B0E8147AEE234B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2a09f68bd684a3ab2f012104251570564fc799fd18e50d3f2ba496617e72976b
MD5 3c08e6f500ec07083c4ba39321093c31
SHA1 3907984b9df6318658b0ca299f73b65b5c5c3682
SHA512 9ee8cbd1a9b63c236708215cea6a4f6b1c389d344c5b8957901e3b2fc6e754c1545fca52129041687fb380da50c62e2d5aaba66329724e107298ae5205da898b
SSDEEP 768:Cj+903nYiC6701yFXodOiIyN8Y1M1fmBnZfc8KzeJY:x903YiCBWXodI11cctzeJY
TLSH
T1DAF2BF319C628D638CE69288B5573786AFF051A397C52F58D5EC9B0E04877AE330B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5aa0128499b2e3b052b1db5c3aca140e9dd79e54c9d7adf75a7a16b092f19cfe
MD5 c967e70874a9e13f5f5712dce027388f
SHA1 9e5b9d11eb891d054e52a1280b686df6df90061e
SHA512 9a508e9d2ab486219fdf55d55bef258b4a951e6445bdf4eb3ef0694ab74ff4062757fb22dcfc962e6a07614bfe253e014d155a808ceb38ca87bd42754a81f4df
SSDEEP 768:5rv+4UNbdm3dYiC6n01yFXodOiIyN8Y1M1fmBnZfv0F:5bsb43CiC7WXodI11ck
TLSH
T1B913CF329864D9738CF7C284F45762837FF421A38AC51B98D9D9AB0E4547BEE230F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

42bde8ad-a900-4030-a0c4-de064a79b17e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\42bde8ad-a900-4030-a0c4-de064a79b17e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5908_1967073650\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 54cef9f9812299482712e946825a0fdc99a1993031e5e54294853f63b08f6f69
MD5 c1bc167fb180fad1bb175b5f349e9a3b
SHA1 decf6f6fde0291d8af0528ce5b6dec335d4fb180
SHA512 abe3bb0cdd6cfd94fbd278a839097789ef7d617ef39f312e076a339e33558243fb582d378d0a10ab72344a71c24fd05992b1d439922f489c6de3db4d9c1da9d6
TLSH
T1B671238357E8D6B3C2DA5BF403C35244F6FB2278072330200B5255C6AB30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/724-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1148-472-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1776-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2172-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2388-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2436-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2832-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2912-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3340-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3488-57-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3568-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3652-397-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3672-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3756-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4192-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4316-372-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5864-281-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6112-451-0x0000000000010000-0x00000000000AB000-memory.dmp

Download