systex | 89a096d013e1ba0e999670b5b66bfd66d5d192a86be7b89f53ea725698ae2a7e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample260712-pdhhdsbv8y
SHA256 89a096d013e1ba0e999670b5b66bfd66d5d192a86be7b89f53ea725698ae2a7e
MD5 9acba7fd3edd23200480b2346d63b488
SHA1 684fa28d6838c76e4688e26f0d2bce8bd1b8535d
SHA512 39957b30447d692333ae82cf6bcfd6bbcb416c21b96e7b33ac01650e175a7ede7d44636e31d30378a792d01eb348198288db9b778d00ac5f1e6946fce2c867e1
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BA847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5432	idavtnlfdxvsqnif.exe
6008	idavtnlfdxvsqnif.sys
3396	CreateProcess.exe
2708	lfdavsnlfd.exe
4420	CreateProcess.exe
2972	CreateProcess.exe
4524	i_lfdavsnlfd.exe
5660	causpkicax.sys
3916	CreateProcess.exe
2420	xspkicausm.exe
5512	CreateProcess.exe
3000	CreateProcess.exe
2860	i_xspkicausm.exe
4952	spnhfzxrpn.sys
5584	CreateProcess.exe
4792	zwupmkecxu.exe
3268	CreateProcess.exe
3132	CreateProcess.exe
2356	i_zwupmkecxu.exe
432	mkhczusmke.sys
4980	CreateProcess.exe
1228	bzurmbztrm.exe
2428	CreateProcess.exe
5660	CreateProcess.exe
5344	i_bzurmbztrm.exe
5164	cwuomgeywr.sys
2704	CreateProcess.exe
5324	olgezwrojh.exe
4704	CreateProcess.exe
3632	CreateProcess.exe
5260	i_olgezwrojh.exe
5748	omgeywtomg.sys
4952	CreateProcess.exe
3784	gbytrljdbv.exe
3196	CreateProcess.exe
5768	CreateProcess.exe
2728	i_gbytrljdbv.exe
4932	nljdbvtqlj.sys
2508	CreateProcess.exe
4632	igaytqlidb.exe
5780	CreateProcess.exe
1980	CreateProcess.exe
1984	i_igaytqlidb.exe
5816	aysqlidbvt.sys
3328	CreateProcess.exe
4640	lidxvtnlfd.exe
1140	CreateProcess.exe
3740	CreateProcess.exe
2976	i_lidxvtnlfd.exe
4656	kigaysqkid.sys
5364	CreateProcess.exe
4964	ifaysqlfda.exe
2860	CreateProcess.exe
3420	CreateProcess.exe
1912	i_ifaysqlfda.exe
4872	dxvpnhfaxs.sys
4160	CreateProcess.exe
2884	xvpmkhfzxv.exe
2356	CreateProcess.exe
5800	CreateProcess.exe
4108	i_xvpmkhfzxv.exe
480	fcwupmkhca.sys
5844	CreateProcess.exe
5528	czurpkhcau.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_162979106\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1379219057\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1379219057\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1690572918\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1690572918\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1995276121\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1995276121\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1379219057\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3672_1379219057\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzurmbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czurpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigeywqolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_iczxspkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iczxspkfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspkicausm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lidxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzurmbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgezwrojh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbytrljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lidxvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpmkhfzxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjhbztrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdavsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_omgeywrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqlidbvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdaysqk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pnkfdxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwupmkecxu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqlidb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqlfda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpmkhfzxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czurpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbzxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqlidbvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pnkfdxvpnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavtnlfdxvsqnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwupmkecxu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2276	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2932	ipconfig.exe
1844	ipconfig.exe
984	ipconfig.exe
2364	ipconfig.exe
4356	ipconfig.exe
3312	ipconfig.exe
2756	ipconfig.exe
4600	ipconfig.exe
4620	ipconfig.exe
4728	ipconfig.exe
1912	ipconfig.exe
4600	ipconfig.exe
2144	ipconfig.exe
5048	ipconfig.exe
4584	ipconfig.exe
4408	ipconfig.exe
6056	ipconfig.exe
2888	ipconfig.exe
3424	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283319724157559"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{65C48E6A-75B2-4704-A7CC-F65A4999F1DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe
5432	idavtnlfdxvsqnif.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	i_lfdavsnlfd.exe
Token: SeDebugPrivilege	2860	i_xspkicausm.exe
Token: SeDebugPrivilege	2356	i_zwupmkecxu.exe
Token: SeDebugPrivilege	5344	i_bzurmbztrm.exe
Token: SeDebugPrivilege	5260	i_olgezwrojh.exe
Token: SeDebugPrivilege	2728	i_gbytrljdbv.exe
Token: SeDebugPrivilege	1984	i_igaytqlidb.exe
Token: SeDebugPrivilege	2976	i_lidxvtnlfd.exe
Token: SeDebugPrivilege	1912	i_ifaysqlfda.exe
Token: SeDebugPrivilege	4108	i_xvpmkhfzxv.exe
Token: SeDebugPrivilege	4764	i_czurpkhcau.exe
Token: SeDebugPrivilege	4384	i_xrpjhbzxrp.exe
Token: SeDebugPrivilege	4144	i_uomjhbztrp.exe
Token: SeDebugPrivilege	5972	i_omgeywrojg.exe
Token: SeDebugPrivilege	6044	i_oigeywqolg.exe
Token: SeDebugPrivilege	4068	i_vtqlidbvqn.exe
Token: SeDebugPrivilege	3084	i_qnlfdaysqk.exe
Token: SeDebugPrivilege	3272	i_pnkfdxvpnk.exe
Token: SeDebugPrivilege	4932	i_iczxspkfcx.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 5432	2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	87
PID 2464 wrote to memory of 1052	2464	2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	88
PID 1052 wrote to memory of 3672	1052	iexplore.exe	89
PID 3672 wrote to memory of 1440	3672	msedge.exe	90
PID 3672 wrote to memory of 2396	3672	msedge.exe	91
PID 3672 wrote to memory of 2276	3672	msedge.exe	93
PID 3672 wrote to memory of 2396	3672	msedge.exe	91
PID 3672 wrote to memory of 2396	3672	msedge.exe	91
PID 3672 wrote to memory of 1512	3672	msedge.exe	94
PID 3672 wrote to memory of 1512	3672	msedge.exe	94
PID 3672 wrote to memory of 1932	3672	msedge.exe	95
PID 3672 wrote to memory of 1932	3672	msedge.exe	95
PID 3672 wrote to memory of 1876	3672	msedge.exe	96
PID 3672 wrote to memory of 1932	3672	msedge.exe	95
PID 3672 wrote to memory of 1876	3672	msedge.exe	96
PID 3672 wrote to memory of 1876	3672	msedge.exe	96
PID 3672 wrote to memory of 4036	3672	msedge.exe	97
PID 3672 wrote to memory of 4036	3672	msedge.exe	97
PID 3672 wrote to memory of 2488	3672	msedge.exe	98
PID 3672 wrote to memory of 4036	3672	msedge.exe	97
PID 3672 wrote to memory of 2488	3672	msedge.exe	98
PID 3672 wrote to memory of 2488	3672	msedge.exe	98
PID 3672 wrote to memory of 988	3672	msedge.exe	99
PID 3672 wrote to memory of 988	3672	msedge.exe	99
PID 3672 wrote to memory of 928	3672	msedge.exe	103
PID 3672 wrote to memory of 928	3672	msedge.exe	103
PID 3672 wrote to memory of 3536	3672	msedge.exe	104
PID 3672 wrote to memory of 3536	3672	msedge.exe	104
PID 5432 wrote to memory of 3396	5432	idavtnlfdxvsqnif.exe	105
PID 3672 wrote to memory of 1184	3672	msedge.exe	108
PID 2708 wrote to memory of 4420	2708	lfdavsnlfd.exe	110
PID 3672 wrote to memory of 5368	3672	msedge.exe	115
PID 3672 wrote to memory of 5368	3672	msedge.exe	115
PID 3672 wrote to memory of 4360	3672	msedge.exe	116
PID 3672 wrote to memory of 4360	3672	msedge.exe	116
PID 5432 wrote to memory of 2972	5432	idavtnlfdxvsqnif.exe	117
PID 5432 wrote to memory of 3916	5432	idavtnlfdxvsqnif.exe	121
PID 2420 wrote to memory of 5512	2420	xspkicausm.exe	123
PID 5432 wrote to memory of 3000	5432	idavtnlfdxvsqnif.exe	126
PID 5432 wrote to memory of 5584	5432	idavtnlfdxvsqnif.exe	130
PID 4792 wrote to memory of 3268	4792	zwupmkecxu.exe	132
PID 5432 wrote to memory of 3132	5432	idavtnlfdxvsqnif.exe	135
PID 3672 wrote to memory of 2956	3672	msedge.exe	137
PID 3672 wrote to memory of 2956	3672	msedge.exe	137
PID 3672 wrote to memory of 2956	3672	msedge.exe	137
PID 3672 wrote to memory of 5128	3672	msedge.exe	141
PID 3672 wrote to memory of 5128	3672	msedge.exe	141
PID 3672 wrote to memory of 5128	3672	msedge.exe	141
PID 5432 wrote to memory of 4980	5432	idavtnlfdxvsqnif.exe	142
PID 1228 wrote to memory of 2428	1228	bzurmbztrm.exe	144
PID 3672 wrote to memory of 4876	3672	msedge.exe	147
PID 3672 wrote to memory of 1136	3672	msedge.exe	148
PID 3672 wrote to memory of 3056	3672	msedge.exe	149
PID 5432 wrote to memory of 5660	5432	idavtnlfdxvsqnif.exe	150
PID 5432 wrote to memory of 2704	5432	idavtnlfdxvsqnif.exe	154
PID 5324 wrote to memory of 4704	5324	olgezwrojh.exe	156
PID 5432 wrote to memory of 3632	5432	idavtnlfdxvsqnif.exe	159
PID 5432 wrote to memory of 4952	5432	idavtnlfdxvsqnif.exe	163
PID 3784 wrote to memory of 3196	3784	gbytrljdbv.exe	165
PID 5432 wrote to memory of 5768	5432	idavtnlfdxvsqnif.exe	168
PID 5432 wrote to memory of 2508	5432	idavtnlfdxvsqnif.exe	172
PID 4632 wrote to memory of 5780	4632	igaytqlidb.exe	174
PID 5432 wrote to memory of 1980	5432	idavtnlfdxvsqnif.exe	177
PID 5432 wrote to memory of 3328	5432	idavtnlfdxvsqnif.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9acba7fd3edd23200480b2346d63b488_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Temp\idavtnlfdxvsqnif.exe
  C:\Temp\idavtnlfdxvsqnif.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdavsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3396
  - - C:\Temp\lfdavsnlfd.exe
      C:\Temp\lfdavsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdavsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2972
  - - C:\Temp\i_lfdavsnlfd.exe
      C:\Temp\i_lfdavsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspkicausm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3916
  - - C:\Temp\xspkicausm.exe
      C:\Temp\xspkicausm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5512
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspkicausm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3000
  - - C:\Temp\i_xspkicausm.exe
      C:\Temp\i_xspkicausm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwupmkecxu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\zwupmkecxu.exe
      C:\Temp\zwupmkecxu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3268
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwupmkecxu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3132
  - - C:\Temp\i_zwupmkecxu.exe
      C:\Temp\i_zwupmkecxu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzurmbztrm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\bzurmbztrm.exe
      C:\Temp\bzurmbztrm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1228
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1844
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzurmbztrm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5660
  - - C:\Temp\i_bzurmbztrm.exe
      C:\Temp\i_bzurmbztrm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgezwrojh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2704
  - - C:\Temp\olgezwrojh.exe
      C:\Temp\olgezwrojh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgezwrojh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3632
  - - C:\Temp\i_olgezwrojh.exe
      C:\Temp\i_olgezwrojh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbytrljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4952
  - - C:\Temp\gbytrljdbv.exe
      C:\Temp\gbytrljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3196
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbytrljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5768
  - - C:\Temp\i_gbytrljdbv.exe
      C:\Temp\i_gbytrljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqlidb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2508
  - - C:\Temp\igaytqlidb.exe
      C:\Temp\igaytqlidb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5780
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqlidb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1980
  - - C:\Temp\i_igaytqlidb.exe
      C:\Temp\i_igaytqlidb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lidxvtnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3328
  - - C:\Temp\lidxvtnlfd.exe
      C:\Temp\lidxvtnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lidxvtnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3740
  - - C:\Temp\i_lidxvtnlfd.exe
      C:\Temp\i_lidxvtnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2976
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqlfda.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5364
  - - C:\Temp\ifaysqlfda.exe
      C:\Temp\ifaysqlfda.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqlfda.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3420
  - - C:\Temp\i_ifaysqlfda.exe
      C:\Temp\i_ifaysqlfda.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpmkhfzxv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4160
  - - C:\Temp\xvpmkhfzxv.exe
      C:\Temp\xvpmkhfzxv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2356
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4584
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpmkhfzxv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5800
  - - C:\Temp\i_xvpmkhfzxv.exe
      C:\Temp\i_xvpmkhfzxv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czurpkhcau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\czurpkhcau.exe
      C:\Temp\czurpkhcau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5528
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4728
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czurpkhcau.exe ups_ins
    3⤵
    PID:3544
  - - C:\Temp\i_czurpkhcau.exe
      C:\Temp\i_czurpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbzxrp.exe ups_run
    3⤵
    PID:4256
  - - C:\Temp\xrpjhbzxrp.exe
      C:\Temp\xrpjhbzxrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:984
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbzxrp.exe ups_ins
    3⤵
    PID:1128
  - - C:\Temp\i_xrpjhbzxrp.exe
      C:\Temp\i_xrpjhbzxrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjhbztrp.exe ups_run
    3⤵
    PID:4872
  - - C:\Temp\uomjhbztrp.exe
      C:\Temp\uomjhbztrp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5700
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjhbztrp.exe ups_ins
    3⤵
    PID:2288
  - - C:\Temp\i_uomjhbztrp.exe
      C:\Temp\i_uomjhbztrp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\omgeywrojg.exe ups_run
    3⤵
    PID:5272
  - - C:\Temp\omgeywrojg.exe
      C:\Temp\omgeywrojg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1604
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2932
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_omgeywrojg.exe ups_ins
    3⤵
    PID:5428
  - - C:\Temp\i_omgeywrojg.exe
      C:\Temp\i_omgeywrojg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigeywqolg.exe ups_run
    3⤵
    PID:3860
  - - C:\Temp\oigeywqolg.exe
      C:\Temp\oigeywqolg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3348
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigeywqolg.exe ups_ins
    3⤵
    PID:4176
  - - C:\Temp\i_oigeywqolg.exe
      C:\Temp\i_oigeywqolg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6044
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqlidbvqn.exe ups_run
    3⤵
    PID:204
  - - C:\Temp\vtqlidbvqn.exe
      C:\Temp\vtqlidbvqn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2672
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqlidbvqn.exe ups_ins
    3⤵
    PID:5488
  - - C:\Temp\i_vtqlidbvqn.exe
      C:\Temp\i_vtqlidbvqn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdaysqk.exe ups_run
    3⤵
    PID:4900
  - - C:\Temp\qnlfdaysqk.exe
      C:\Temp\qnlfdaysqk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdaysqk.exe ups_ins
    3⤵
    PID:5972
  - - C:\Temp\i_qnlfdaysqk.exe
      C:\Temp\i_qnlfdaysqk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pnkfdxvpnk.exe ups_run
    3⤵
    PID:420
  - - C:\Temp\pnkfdxvpnk.exe
      C:\Temp\pnkfdxvpnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3436
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pnkfdxvpnk.exe ups_ins
    3⤵
    PID:5548
  - - C:\Temp\i_pnkfdxvpnk.exe
      C:\Temp\i_pnkfdxvpnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\iczxspkfcx.exe ups_run
    3⤵
    PID:2292
  - - C:\Temp\iczxspkfcx.exe
      C:\Temp\iczxspkfcx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1912
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1688
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_iczxspkfcx.exe ups_ins
    3⤵
    PID:1012
  - - C:\Temp\i_iczxspkfcx.exe
      C:\Temp\i_iczxspkfcx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4932
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x380,0x7ff8eaa5c188,0x7ff8eaa5c194,0x7ff8eaa5c1a0
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,9271512024558755570,9906074020402750428,262144 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,3218025437822004088,7809077718758448889,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:11
      4⤵
      System Time Discovery
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2444,i,7077484350431125959,7936915962720804174,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:13
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,12516754257523259906,11276828522519060128,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:1932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=1652,i,2992428498345797445,3776496369755812253,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,9283465943754595724,9345669219219244049,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
      4⤵
      PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,18080744864673287887,11988848046775425471,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:9
      4⤵
      PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,6905426861079658201,15501231429344998165,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18387660497836088312,4597088411084610801,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,5238985121050526193,6513786601974282753,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,3486442447032930460,7299947349304723724,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,3486442447032930460,7299947349304723724,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
      4⤵
      PID:1184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,9953173609324753452,3416458019800537720,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:5368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,92602450338470726,1823604107048495314,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:14
      4⤵
      PID:4360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5152,i,5475144632462246539,14213056772803319239,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
      4⤵
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3900,i,13533082918958988974,6486572272885047555,2097152 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,13431616493597387273,11565429958871764632,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,17688964389971197844,7932402839660116516,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,9764340838689135295,12801965948353194600,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,15803077389268065343,8310518142576536937,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,4833057347251976886,14395482870268689305,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,5999570123920333783,11115061661851433452,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
      4⤵
      PID:3412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,12442391128383595374,7573135723360836400,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
      4⤵
      PID:6008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,12516919386325496317,10330151325449669108,262144 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:10
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,15323984867860877607,12405293011634708017,524288 --field-trial-handle=2284,i,4303118634011124889,8594413874122064431,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2312

C:\Temp\idavtnlfdxvsqnif.sys
C:\Temp\idavtnlfdxvsqnif.sys
1⤵
- Executes dropped EXE
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2356

C:\Temp\causpkicax.sys
C:\Temp\causpkicax.sys
1⤵
- Executes dropped EXE
PID:5660

C:\Temp\spnhfzxrpn.sys
C:\Temp\spnhfzxrpn.sys
1⤵
- Executes dropped EXE
PID:4952

C:\Temp\mkhczusmke.sys
C:\Temp\mkhczusmke.sys
1⤵
- Executes dropped EXE
PID:432

C:\Temp\cwuomgeywr.sys
C:\Temp\cwuomgeywr.sys
1⤵
- Executes dropped EXE
PID:5164

C:\Temp\omgeywtomg.sys
C:\Temp\omgeywtomg.sys
1⤵
- Executes dropped EXE
PID:5748

C:\Temp\nljdbvtqlj.sys
C:\Temp\nljdbvtqlj.sys
1⤵
- Executes dropped EXE
PID:4932

C:\Temp\aysqlidbvt.sys
C:\Temp\aysqlidbvt.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\kigaysqkid.sys
C:\Temp\kigaysqkid.sys
1⤵
- Executes dropped EXE
PID:4656

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
- Executes dropped EXE
PID:4872

C:\Temp\fcwupmkhca.sys
C:\Temp\fcwupmkhca.sys
1⤵
- Executes dropped EXE
PID:480

C:\Temp\kecwupmhez.sys
C:\Temp\kecwupmhez.sys
1⤵
PID:2872

C:\Temp\trmjeczurp.sys
C:\Temp\trmjeczurp.sys
1⤵
PID:5788

C:\Temp\uomgeywqoj.sys
C:\Temp\uomgeywqoj.sys
1⤵
PID:1168

C:\Temp\ligeywtolg.sys
C:\Temp\ligeywtolg.sys
1⤵
PID:3084

C:\Temp\gdbvtnljdb.sys
C:\Temp\gdbvtnljdb.sys
1⤵
PID:4384

C:\Temp\vqnifdxvqn.sys
C:\Temp\vqnifdxvqn.sys
1⤵
PID:4860

C:\Temp\vpnhfaxsqk.sys
C:\Temp\vpnhfaxsqk.sys
1⤵
PID:2976

C:\Temp\hfcaxspkic.sys
C:\Temp\hfcaxspkic.sys
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bzurmbztrm.exe

Path C:\Temp\bzurmbztrm.exe
Size 365KB
SHA256 12a135046b20e7598e4b5940982214d6afa3749cba0b1113a6f404eff1081169
MD5 12f7bb0bea672691d4fb5a31b2f729d5
SHA1 cc605b4e21913c01952e5637e1c4b77218e06aab
SHA512 2d5b26505a4770620af6e4b72ed326f31bb190777623598e2174b87ea25bf24b6d65b0fde1a9504815dbfe96b445d321bdb229362818e18a4daf784d020b5ff4
SSDEEP 3072:luxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:luxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causpkicax.sys

Path C:\Temp\causpkicax.sys
Size 293KB
SHA256 4c0f13e2d3525a7c0ad1a8ab7ea1e4424d03ebb5fc1b0444577ae7e131113b01
MD5 0e11081a08f9612f2fec4d0f771bd4c4
SHA1 a282fd952be073b85c097a3fb60c8ad50c6e02c4
SHA512 a1a1a0f6d66a85c55e39ad22eadc7305dd703fbdc1fbb57106faf1b472b7e4a025ca186918bad01a37e3ed017bf375c9408141c45f3d156090b60a7041cbf0e2
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgeywr.sys

Path C:\Temp\cwuomgeywr.sys
Size 293KB
SHA256 bf40e94de668452b263eae384147999192ef95e5c9b0f2060dff705dc5f6ed52
MD5 312441915896a4e20d4f1088b1817d7c
SHA1 1ddb8ef09a131bd366a7a0b8c5e2f64b17d59be1
SHA512 1e3c2b2e411d19c936c7e3869c934832bcbc4b09009b62e920df1519f5e963c4f8dd313cb474617797cfb0411e0eab51c539b22174b6be2fcfe65920fe29ccd5
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A6545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytrljdbv.exe

Path C:\Temp\gbytrljdbv.exe
Size 365KB
SHA256 c98b0c401c7c2baf6733273b76ca3c458f7aefd9647a91ed6a39cc811c35c4e1
MD5 d822d4635f8626c40cbfebd442f26254
SHA1 6603cf5e3b970f67bfefda06fd4f7c677d02d3eb
SHA512 b6fe7a0e2ef7708325eebdea403ad28918848a80cb451ecb8f1ec3af462a2b851cbe756fbab6ef1d9249690c4f5454d67c98b2c149447b40dcd1885f705394e8
SSDEEP 3072:guxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bzurmbztrm.exe

Path C:\Temp\i_bzurmbztrm.exe
Size 365KB
SHA256 271b6c5ac4a37f21bd01f8aa3582e0c73d054c1f3d38f0ad20c2a19460ed15ea
MD5 08ef12206eadb1e9352b78c7a5142b3a
SHA1 814d48114f8355884cf193997f4da3f21bba650e
SHA512 a4c0edd9085aa5e54705f71ec46034870ff34d786519b53fc92f651f1bf910e52a7cdbfecd7486332941b9d72d18f680acafd3102015a6417407b340c3c601b0
SSDEEP 3072:tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lfdavsnlfd.exe

Path C:\Temp\i_lfdavsnlfd.exe
Size 365KB
SHA256 017d01dc8a0c61e5b88be7bddfe1caa72cd368dc449defe537869beeb1bc4950
MD5 e2a1b52c0919205e90b079f4fe4cc326
SHA1 122447588d9e26b8d6622712c5498bd61203e717
SHA512 4e26c9b0fb8ea29a53b88b44ac582d1c302f445719e0aebcf9050715ccb616c177b7dea8dba9ea9d0d39974f8811c8ef6bb43f3ab2b9fbddacb404cf20aac369
SSDEEP 3072:8uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:8uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_olgezwrojh.exe

Path C:\Temp\i_olgezwrojh.exe
Size 365KB
SHA256 be6fbefc0cc15b14640cb155bb5f08c94c3e70c1bbb7b9785891f8bea89faeed
MD5 e7474a0f124a7f750be329857e02cc67
SHA1 d88d20ee10c7a5a229ae430335e836cd917d5702
SHA512 c6d1920f93ccecc7f34befcb929ee137eba876d32d52111362171a25c668a73ed664087859eeb14982f3d844aeb84c668c06807bc2a7c6d093810ff81e5787fa
SSDEEP 3072:xuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xspkicausm.exe

Path C:\Temp\i_xspkicausm.exe
Size 365KB
SHA256 3c0ed1c10a73b5bf42a4e8a19940ca743b279cda041b8af8c79fa08523ff56fd
MD5 25d6d21d990757d27d0ed3f4ae8b6af6
SHA1 fb0d38274a2774e5471dcf5cadf5c0213d50a4cc
SHA512 10f18ccb66dc19ef699b7d12c2f860409a2cedf9fb2a17336be65df6c5a4eca06d4c8a1b7d5e775833e69a81fec3a4b215ca855922b019ed8993c2bd142609ff
SSDEEP 3072:quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:quxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zwupmkecxu.exe

Path C:\Temp\i_zwupmkecxu.exe
Size 365KB
SHA256 5dfb83689843766c2fc0e8f4967c21d493feedfb58a3958e91bc44b638a49dbf
MD5 5272068772d36f1b68792b4fdd3a6539
SHA1 8a6d169f7078d3940f7aa9d3277683610256b940
SHA512 20a784dafc9fee1f56ef25f031a8713007957c765b3ed0e9b96e8305a56901d5643deb9468d9dfb2a51d72308b16eadd22ccadd523827140ec06200e0cd4c1aa
SSDEEP 3072:Muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdxvsqnif.exe

Path C:\Temp\idavtnlfdxvsqnif.exe
Size 365KB
SHA256 652f667f8ac8d4d7796f1883c5442cc704626e7c11ba5b316e098f3af6b9f418
MD5 20174503b1d0a442c0c9a01989da8afa
SHA1 18f69dd90bb36c913aabc675d13b525a6a98680c
SHA512 7a06ee35aa7d390e7bbbae8c99fde94faad39dab52f698547861dc63e9d887e1beb6b29bb186a10779b27aac0929909858f22e1cfc20d668e91b2807654a64fa
SSDEEP 3072:Ouxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idavtnlfdxvsqnif.sys

Path C:\Temp\idavtnlfdxvsqnif.sys
Size 293KB
SHA256 3dbe6f3bf2d4845067e7fe380975bce5749fc7728627bad533ec6bb7c5a4b780
MD5 52453c3ca53a513d84609da0ab50fd4c
SHA1 67c6c2fb86b2d90cb24d596615499dc4a38bb2e0
SHA512 2cd656d41533bed3bfd53ec0444d760bbc86e19df6327242bb223146ff7749e4a589a5d665e0d047b88f1f187549d3bdbe6494486270b7030289003026cfeac6
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T17E545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdavsnlfd.exe

Path C:\Temp\lfdavsnlfd.exe
Size 365KB
SHA256 0d7c04c01b9cfd5306e5a16ae28641fe340f3c923975dc38a6d0e4e13277505c
MD5 ac2a2aee79052ffcc6cecc86def5ffc7
SHA1 ee33822c32a92a68f3e4318e2458abe9744fff14
SHA512 36849903dec5d261a4de9e91dcc0123effc9995ed598f8a7f5b253a52b4a0c8312787ffb2fbea3a1bf62b236a423d1809c6cd6801a5eb0731ddea0e0ea8c09f4
SSDEEP 3072:duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F5847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkhczusmke.sys

Path C:\Temp\mkhczusmke.sys
Size 293KB
SHA256 1c99588470188121fb98e9df8031ed84d18bae66beb19f48238406e69b02d460
MD5 04f1a842249acf63969718cd9a9b871c
SHA1 e6e20efa6897826b0de2873d70e49f268ea40d92
SHA512 c7732827cd3a2783377794b821e1905c42e0f7d382a7a1cd42f08f35648069de6579685e1852ff3cf0933e3fad631d53d3884240c7789371e014e262309d217b
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgezwrojh.exe

Path C:\Temp\olgezwrojh.exe
Size 365KB
SHA256 b23113bff6967400a77ca6265d08d775b29f30afc9878aba2fbd341d09309995
MD5 40c110ba4cb8ad10087561edad12a3ac
SHA1 290d20c0a62d5845f1898bd0e481bd3a1f3373f5
SHA512 6032c3cddedb551e89b1107e226fe89e93856753d8920a4205322d8a3d9a74159a109bf0e05c3faf9802ed984be2d2be59f1c71f488f6db710d511599c057bd0
SSDEEP 3072:Wuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:WuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omgeywtomg.sys

Path C:\Temp\omgeywtomg.sys
Size 293KB
SHA256 c5b0fa73c6040ed54005c7b88ff51c61c32b2cdfb421c03e6cd96ee6212292f6
MD5 2ce900636474caa12bd41b1b771c0232
SHA1 9e75a8a09ccb205d938374dbdf2eaf2d929ab4d0
SHA512 9b4bbaccd3ddc841cee7001ea1be5f09875973ae693c61b038564bf60d42a21e28bdb07cc0f351399d5ff7e37ba6c3b18c222b3a33f1978ad6a3f05d4346b214
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T110545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spnhfzxrpn.sys

Path C:\Temp\spnhfzxrpn.sys
Size 293KB
SHA256 5849ad7b17ca57c43f898b35f6996d2ff76f4afeb77f4254c07acce04b7ab038
MD5 c155eed618f9a8c7b328a9340cd84d87
SHA1 9a8c952ac19d856d14c3b9be8ce41069d13ad4d9
SHA512 d59fe740311f050576cd0e39fd4115ea62b180ecb483441c14c8edc5202c53b606fa5858871aaa94073776921af94297ef120cca6e0b7a58daaa0d104c55b3a1
SSDEEP 3072:1tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:1IJjiJcbI03GBc3ucY5DCSj
TLSH
T146545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xspkicausm.exe

Path C:\Temp\xspkicausm.exe
Size 365KB
SHA256 680c56078f831b277869bf79500319dc43dc9bf9b8b592898c28766aef74b6f4
MD5 07f5836e814b88456b62a774d9eae4a9
SHA1 393af441e4d6f525839ceb398c1fbc15d58b2132
SHA512 ef469bcca6d3f9569f88eb4cb42c6a5ea6430107aaeb850576c27928edff09c48ac4e27dbe5dd33b03e9236d753e714810a0ad006dcdbd4f7ad5036ae1617f73
SSDEEP 3072:Fuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:FuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zwupmkecxu.exe

Path C:\Temp\zwupmkecxu.exe
Size 365KB
SHA256 5d0ec3e93539f42b437b4373a36029b8fac0bc0ce506d800c24f762931ec8302
MD5 8d26e976835aff4e0bc79ee87d028e44
SHA1 0ff0255d4fb8a53e2b3c9d8a6ebbf15e9a8915e7
SHA512 440c281d9149ebb46b1225785cde90095f26d95ba587140b17883ea911e54f9749d3f79c9c5ded3ede19b77022c82fdbebce6321faca51d388c17760c59f1e24
SSDEEP 3072:Cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

81e7df14-c2c7-40b9-8c15-7a785739f757.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\81e7df14-c2c7-40b9-8c15-7a785739f757.tmp
Size 14KB
SHA256 5744e17b7f4668465ac53aa8ee5cb383c48dcac7810173aa1e3e94d435064ff3
MD5 b221dae31f4ba6a239281b608d5163c0
SHA1 e73ce9e3b2a1f3c2f4398428c1ccfcfb1d89fda4
SHA512 f94af73f3bb292fab26985803c4d19106a2e8c8fecd2383b65074fd21440fe91e49bc2ca5093d9618be59abe2a5b8342f3b9c2310b297bdc049030607ce7342d
SSDEEP 192:sxRHRyyM/jK1Ml8wCb/fbsXtVCZlDHszoA8pi/g6+WNIYnY3hkGcIgDkJ:sxRHc8b/fbs9VE99i/5I5RgU
TLSH
T12852E9166A3459779CDBD20CFA557F93D6F81573A2901E44ABFCCA0C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9a592435f3d7ac404ca95305d4a04a9a1d5662957608a3718d3b8c80d9891f4b
MD5 73755be6414a7e8bc06e48d08924cdad
SHA1 2b3870a76cef343a63a38b86c30df36dceaa3cb1
SHA512 b711c1f37234855bc97cf9a473ca33eba12a350c780b24d3d0ec36dc95b284762098456e3818e2021cf5f2c8d466a3b38f2a39496f9e1611cad0fb4bae9172cd
TLSH
T172611CD2A3A10AE2E7358EBB84E5F45737F8CC5A81B32E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5917d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5917d4.TMP
Size 3KB
SHA256 5bd1909e118c4bb25068ec7506b636db53f8ef53508adb9ea259d674e1052a5a
MD5 67f2464544764387fa9248ec09026df0
SHA1 9a3d41a5bbbc716e556732a9b32b3d6c33b18a82
SHA512 d194371d7f597cec7a1b045a8c0628f7b8fc8b9f56121dc63d5bbac8c140b7dfa9378e73822568837965643198bd01de3d0df92c227787853d78d46ba9bcfd4b
TLSH
T151612ED2A3A10AE2E7354EBA84E1F45737F5CC5A81B31E0474835E746462FE0A2D5163
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 faab30a964a768b91a97c9bbee563c6b91789dc426099df12906d51b008a969b
MD5 5f2e70e6c977487756a0a345393af7d5
SHA1 f593df91d3cccc2115721eabed3eb8bc3cca6b91
SHA512 aaa6266b7a3dafa5fd361a705bd779ded58490fef3199044faf3274932df5e64c6622ce37ee7ffb775431a727ffe72ded73953c0fe6d6bb5362aa0f228f9e3ff
TLSH
T11641C0F7C7E8866E890156F0AA186E1BCE1D0954432C3D5AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d705008154e93c91aa20a42107a5c873c7dfab3189ac0bc2c33a16f6127c3679
MD5 d34102012a7bcfce60a4a03ca18972bb
SHA1 577850a2947a16b0207a1a24d918bee87629aec7
SHA512 7cd3dbd8c4dd285be51c594ce79e575190ae73cbc50029f1fb0dcf1ad9cfe92eabd0787e77ff4414fb03efd9639967cfb130992be3024bf569354e57ff490650
SSDEEP 192:sxRYRyyM/jK1Ml8wCb/fbsutVCZlDHszoA8pi/g6+WNIYnY3hkGcIgtJ:sxRYc8b/fbsSVE99i/5I5Rg3
TLSH
T16A52E9166A34597BDCDBD20CFA557F93D6F81573A2901E44AAFCCA0C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7e10f684b78d954ed8d7eecf4e4ec76ab90cd065526bf86dfa8e3c104d0cee69
MD5 6bf06347cb94d0f343e49443f52ab91a
SHA1 fb06984c6142a5b3d23493e3d826a79a9d7a1687
SHA512 89f2918a3a915b0ee14f6ccd7941eac6d4583f068ac1d9b10b20e9f21fd86a6bfeb0105d1963abc7942bc66185f923b0b482ea64f92ff29998f60f82a6e3c5ee
SSDEEP 192:sxRHRyyM/jK1Ml8wCb/fbsXt3CZlDH0zoA8prGl/g6+WNCGpn/YnaOhkGcIgDKJ:sxRH88b/fbs93E91e/5V/T0gy
TLSH
T17362E9166A245D779CDBD208FA51BF93D6F81573A2901E44ABFCCA0C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d4d7301bbd23168733ebb33e46722d95ee6ab111e552fcacaa6ea04772a53413
MD5 37ada37af5a218cfe0159be81272eafc
SHA1 d10f745d42ccca1a2135d174db75717fe15415d9
SHA512 069ed980066c3dc33d208e8df1efa907bfa63904ca2fd2ad44969b2c5a8c6a13f864da90e8cc3b916215c0164723ef3cab44829021a9d5367a77e53cf156d90f
SSDEEP 192:sxRHRyyM/jK1Ml8UQxCb/fbsXt3CZlDH0zoA8prGl/g6+WNCGpn/YnaOhkGcIgDG:sxRH8qob/fbs93E91e/5V/T0gy
TLSH
T1ED62D9166A2499779CDBD20DFA51BF93D6F81573A2941E44ABFCCA0C04E76ED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 12234e30ead8a288d7e7a400da52729bf1443543006ff324956bdec24fae9f05
MD5 5023a3e5c7f548fe57089afcfe22ce8d
SHA1 3dd34edd38ea5b3416b895a629f1fad579147c9c
SHA512 700020157491c5bdfbe5ee0267334f599dcb2a501d0aa27bcafe77845f7c2f38aa57a2e354cc3ea94d190ae6587c9483a8a78c06dbaa07496758dc0a2dd611c4
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mOu4YHroS88ry:wGedPsE7X6WgoufDMu1ja8mOVYUsy
TLSH
T171E2DB3B680CCB7E4F844EDCEC29BE9FADA801CB56D8895447EA840C03C57EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8246ff83e53fd4ceac6e5225cbace30918718a7d6db8f1b722f4dabc7b199c07
MD5 126fbf56f55c636a6e8c2f35f9d3b47f
SHA1 5c056d58608409b4e67d3010ad17fd477702634d
SHA512 c76e3ac5c1b10fe37e09d71b3256d41e172cc7894a8e4e38c07068e60a78e162bdbaa787736d91374c33256a68e18834c0114d663076b2540ce16c2a6ff22735
SSDEEP 96:KRdqjXNn7vWj4mgfvK4+gBvcldQzLkHm7KmgIIOW4tVgGOK47g0OcOGlkF7CK0UR:CdqjXNn7Oj4XfV+gBkldQzLkHm7KmgIj
TLSH
T1B3912F81B0762244387E761885689D5AC9C274B33126B56B7BE801D60FBBD134FFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33fae6ce-35ad-46bd-9850-652c852e31db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\33fae6ce-35ad-46bd-9850-652c852e31db.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 088470f55b33043d2bf3010b29acaebd89da43e701d10c16aee059de7d4c4af2
MD5 b12522254270687cd9fd89bceee5c9f4
SHA1 33ab46752f4e1ea6c29c3835f4d3a0478f97e7fc
SHA512 2e2664940f333e1d686561da9723cd50d4e8feeaef74044513720267adbc63bb1576dafabe9c092719143bb8709a2b116223c016244498b7ec5c0e01fdf0b9e2
SSDEEP 384:nDtNn/s3n9SG38NPfqw7D7VJDZNfNoXOVSUUq3heihETRzcoXfK86sfxEZxxsIjX:Dj+9h3s7DZIO00he5Nzc4ReyIsPPb9Mn
TLSH
T108F2C031AC25CD63DCF68696F6073AD6BEF4226B81C82D88DADD9F0C09872AC1757413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bbcba74d1fd3a25d4f26fdcbb0d2c0e8b2510655b7f3dcb6fdc168cf4f5babeb
MD5 91002fcdfb45933bb806a610156e8149
SHA1 40ed887599e1513abfa416f7fc501b18c11877e2
SHA512 1da22213b59765a01057cb8012e261dc63e0b31100fd18c23508fdbee9c6283baabb9b6a13330ac81d6341edf7c6dc7eb578aabdd185d3ad51839b669794d369
SSDEEP 768:6rv+4UNbds3+wDZIO0tNzc4ReyIsXAeVH1S5D:6bsbS3itc44bsQEH1Y
TLSH
T1AC03CF32AC789977ACF69786B50B76533EF8911B82D81E94C5EE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 cca7416a549b9ed978808cfb8f19340edc0970a43c89bef87f3c0cc0f93504ee
MD5 f39d2123d7d595569712d43ae0f87ae7
SHA1 680865e2021fbc180deaa3f8715c691885d05484
SHA512 c960cceb228019767f4ea08e76c756bb546cca11aafda242e9c09f94c47bd1a71733b57a5ef5ccc148aa3a12a00c764e1310b8fcbb381c2456f0804385274efd
SSDEEP 768:/F1j+953SwgqyZw5O00heJNzc4ReyIsPPb9Mn:2953qytc44bsnb+n
TLSH
T1871318F698D78976E8AE4783A73D2D86ADFCD157B1881884B7D95E0CCC821BFC706811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 bedd9ef388a171d0bd92e97951d6ca4dc24344ff677d3423a08ce10c042a94d2
MD5 f027ecfa1f835d068865f0186922e498
SHA1 aaabcbbd66a1aa402add2af1ffca552f7f5fd26b
SHA512 6ef31f9248236f28183c6789f4dfe2cb061e3b02473586c45640887436ca96df60da40700a6338238191c54b55f2765b78af43254c8ddcbfa3d8fa7d6141606c
SSDEEP 768:erv+4UNbdb3p7DZIO00heqNzc4ReyIsPPO7:ebsb935/tc44bsnO7
TLSH
T1BF03CF32B828DC63ECFA9645F10736937FF4215B85C41E98DADA5F4C08471AE275B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2b07a76904fcf75e0618c1871a7b5167a606d83db377ae32e088ab7b2c932a55
MD5 f78bb64ce4d9c37b2ea1318496065ce2
SHA1 92312c50be1391b227d2e5fbf069b6ae5756b16c
SHA512 fcc058b15bc0e3f533149a1048b1282f13529c2922eeb9b0c9b9be432638da8643d1046abf9c2fba3696576131a2ad640eadf6de3a42f3674ed60e18782fe8f0
SSDEEP 384:nPtNn/s3n9SG38NPCqw7D7VJDZNfNoXOVSUUq3heihETRzcoXfK86sfxEZxxsIjX:Pj+9h3F7DZIO00he5Nzc4ReyIsPPb9Mn
TLSH
T179F2C031AC25CD63DCF69696F6073AD6BEF4226B81C82D88DADD9F0C09872AC1757413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3672_1838585759\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0e372a35aa135c1a93e4056f69d03af5f79b63bc3ff9102669f0e691e422e4e3
MD5 97af3ea9edf717276649c4a55e3cb335
SHA1 5112fe18a97f979a1d58246410126b3d73b29085
SHA512 1cc75044e040f8b1e2929cb084a371f7bfef5fba50ac1922c6775673129a6552375ead14dd5ca33197674686bc321def9226898c091ba0322c08f651de80efb6
TLSH
T10B71278357A9C6B3C5DE5BF502835248F1FB23384763301447565587AB30A3954B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/432-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/432-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/480-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1168-434-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2872-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2976-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3084-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3280-499-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4384-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4656-341-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4860-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4872-366-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4932-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4952-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5164-286-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5660-210-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5748-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5788-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-231-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/6008-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download