systex | a95eed9aaa4d445f603f42a9a6dfb8ac85195653bcf9f8ae2409c3519d0ec00e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260713-2a7dkaby9w
SHA256 a95eed9aaa4d445f603f42a9a6dfb8ac85195653bcf9f8ae2409c3519d0ec00e
MD5 5d83ebdb3f36c83f44ccb3af626e6a1f
SHA1 9629904b07a9f793145bc9418f73bb9eb057048b
SHA512 1c53b2abd5dc0aa1d5c6a4499f390076dc669b2ab4bda35a1feba37f93bf013130152009d825e49cd39d19c53a495c29adba9c3720bec1a7ba726d480d820e18
SSDEEP 3072:2ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:2ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3272	trljgbztrojgeywt.exe
1084	trljgbztrojgeywt.sys
4860	CreateProcess.exe
2644	ywtomgeywr.exe
2380	CreateProcess.exe
964	CreateProcess.exe
552	i_ywtomgeywr.exe
2208	gdyvtqljdb.sys
1224	CreateProcess.exe
3004	yvqolgdbwq.exe
1220	CreateProcess.exe
4620	CreateProcess.exe
2024	i_yvqolgdbwq.exe
2880	gdyvtnlyvq.sys
5968	CreateProcess.exe
5980	qnlfdxvsnl.exe
4556	CreateProcess.exe
2796	CreateProcess.exe
5896	i_qnlfdxvsnl.exe
1780	sqnigaysqk.sys
4736	CreateProcess.exe
6000	axvpnhfaxs.exe
3184	CreateProcess.exe
3868	CreateProcess.exe
4568	i_axvpnhfaxs.exe
5416	hfzxvpnhca.sys
756	CreateProcess.exe
3728	ausmkfcxup.exe
5956	CreateProcess.exe
3432	CreateProcess.exe
4572	i_ausmkfcxup.exe
4912	nhfzxrpnhf.sys
5996	CreateProcess.exe
1292	ecwupkhfzx.exe
4480	CreateProcess.exe
3520	CreateProcess.exe
1416	i_ecwupkhfzx.exe
5188	xrpjhbzurm.sys
1780	CreateProcess.exe
4704	mhezwrpjhb.exe
4576	CreateProcess.exe
5844	CreateProcess.exe
2552	i_mhezwrpjhb.exe
2556	ebzxrpjhbz.sys
2828	CreateProcess.exe
4108	ojgbztrojg.exe
4428	CreateProcess.exe
5536	CreateProcess.exe
2852	i_ojgbztrojg.exe
5300	geywqojgbz.sys
1804	CreateProcess.exe
5900	ywqojgebwt.exe
2548	CreateProcess.exe
4944	CreateProcess.exe
2272	i_ywqojgebwt.exe
4088	qoigbytqlj.sys
3444	CreateProcess.exe
4508	jdbvtnligb.exe
4616	CreateProcess.exe
2088	CreateProcess.exe
2284	i_jdbvtnligb.exe
2552	vtnlfdxvqn.sys
5940	CreateProcess.exe
4980	nlfdyvqoig.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_252827905\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_252827905\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_247965942\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_839576194\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_839576194\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_839576194\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_247965942\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_839576194\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3152_32063080\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trljgbztrojgeywt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwupkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causnkfvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqolgdbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezwrpjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jdbvtnligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vpnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwrojebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljdbwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdxvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwupkhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jdbvtnligb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causnkfvsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqolgdbwq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vpnhfaxspn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmhezxrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdyvqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdxvsnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrojg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywqojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdyvqoig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axvpnhfaxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ausmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fzxrpkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwrojebzwr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ausmkfcxup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqojgebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdyvqoi.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1008	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1212	ipconfig.exe
4136	ipconfig.exe
1376	ipconfig.exe
3320	ipconfig.exe
2276	ipconfig.exe
5380	ipconfig.exe
4332	ipconfig.exe
3256	ipconfig.exe
5312	ipconfig.exe
5764	ipconfig.exe
1816	ipconfig.exe
1252	ipconfig.exe
4840	ipconfig.exe
1808	ipconfig.exe
5108	ipconfig.exe
3420	ipconfig.exe
3020	ipconfig.exe
2284	ipconfig.exe
1052	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284550398755371"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{17E727D6-97EC-44B2-B4DF-F9E520DE9C55}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3272	trljgbztrojgeywt.exe
3272	trljgbztrojgeywt.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	i_ywtomgeywr.exe
Token: SeDebugPrivilege	2024	i_yvqolgdbwq.exe
Token: SeDebugPrivilege	5896	i_qnlfdxvsnl.exe
Token: SeDebugPrivilege	4568	i_axvpnhfaxs.exe
Token: SeDebugPrivilege	4572	i_ausmkfcxup.exe
Token: SeDebugPrivilege	1416	i_ecwupkhfzx.exe
Token: SeDebugPrivilege	2552	i_mhezwrpjhb.exe
Token: SeDebugPrivilege	2852	i_ojgbztrojg.exe
Token: SeDebugPrivilege	2272	i_ywqojgebwt.exe
Token: SeDebugPrivilege	2284	i_jdbvtnligb.exe
Token: SeDebugPrivilege	2152	i_nlfdyvqoig.exe
Token: SeDebugPrivilege	5816	i_vpnhfaxspn.exe
Token: SeDebugPrivilege	5552	i_causnkfvsn.exe
Token: SeDebugPrivilege	2972	i_fzxrpkhcau.exe
Token: SeDebugPrivilege	1660	i_pmhezxrpjh.exe
Token: SeDebugPrivilege	1828	i_zwrojebzwr.exe
Token: SeDebugPrivilege	1516	i_bztrljdbwt.exe
Token: SeDebugPrivilege	3448	i_ljdbvqoigb.exe
Token: SeDebugPrivilege	4072	i_qnlfdyvqoi.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3152	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 3272	3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	87
PID 3388 wrote to memory of 3000	3388	2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 3000 wrote to memory of 3152	3000	iexplore.exe	89
PID 3152 wrote to memory of 3248	3152	msedge.exe	90
PID 3152 wrote to memory of 2572	3152	msedge.exe	91
PID 3152 wrote to memory of 1008	3152	msedge.exe	92
PID 3152 wrote to memory of 2572	3152	msedge.exe	91
PID 3152 wrote to memory of 2572	3152	msedge.exe	91
PID 3152 wrote to memory of 2420	3152	msedge.exe	93
PID 3152 wrote to memory of 2420	3152	msedge.exe	93
PID 3152 wrote to memory of 5064	3152	msedge.exe	95
PID 3152 wrote to memory of 5064	3152	msedge.exe	95
PID 3152 wrote to memory of 5064	3152	msedge.exe	95
PID 3152 wrote to memory of 5212	3152	msedge.exe	96
PID 3152 wrote to memory of 5212	3152	msedge.exe	96
PID 3152 wrote to memory of 5212	3152	msedge.exe	96
PID 3152 wrote to memory of 4592	3152	msedge.exe	97
PID 3152 wrote to memory of 4592	3152	msedge.exe	97
PID 3152 wrote to memory of 4592	3152	msedge.exe	97
PID 3152 wrote to memory of 4572	3152	msedge.exe	98
PID 3152 wrote to memory of 4572	3152	msedge.exe	98
PID 3152 wrote to memory of 4572	3152	msedge.exe	98
PID 3152 wrote to memory of 2852	3152	msedge.exe	99
PID 3152 wrote to memory of 2852	3152	msedge.exe	99
PID 3272 wrote to memory of 4860	3272	trljgbztrojgeywt.exe	103
PID 3152 wrote to memory of 5396	3152	msedge.exe	106
PID 3152 wrote to memory of 1916	3152	msedge.exe	107
PID 3152 wrote to memory of 5396	3152	msedge.exe	106
PID 3152 wrote to memory of 1916	3152	msedge.exe	107
PID 2644 wrote to memory of 2380	2644	ywtomgeywr.exe	108
PID 3152 wrote to memory of 5436	3152	msedge.exe	112
PID 3152 wrote to memory of 4080	3152	msedge.exe	113
PID 3152 wrote to memory of 4080	3152	msedge.exe	113
PID 3152 wrote to memory of 4320	3152	msedge.exe	116
PID 3152 wrote to memory of 4320	3152	msedge.exe	116
PID 3272 wrote to memory of 964	3272	trljgbztrojgeywt.exe	117
PID 3272 wrote to memory of 1224	3272	trljgbztrojgeywt.exe	121
PID 3004 wrote to memory of 1220	3004	yvqolgdbwq.exe	123
PID 3272 wrote to memory of 4620	3272	trljgbztrojgeywt.exe	126
PID 3152 wrote to memory of 2856	3152	msedge.exe	128
PID 3152 wrote to memory of 2856	3152	msedge.exe	128
PID 3152 wrote to memory of 2856	3152	msedge.exe	128
PID 3152 wrote to memory of 5840	3152	msedge.exe	131
PID 3152 wrote to memory of 5840	3152	msedge.exe	131
PID 3152 wrote to memory of 5840	3152	msedge.exe	131
PID 3272 wrote to memory of 5968	3272	trljgbztrojgeywt.exe	132
PID 5980 wrote to memory of 4556	5980	qnlfdxvsnl.exe	134
PID 3272 wrote to memory of 2796	3272	trljgbztrojgeywt.exe	137
PID 3272 wrote to memory of 4736	3272	trljgbztrojgeywt.exe	142
PID 6000 wrote to memory of 3184	6000	axvpnhfaxs.exe	144
PID 3272 wrote to memory of 3868	3272	trljgbztrojgeywt.exe	147
PID 3152 wrote to memory of 3056	3152	msedge.exe	149
PID 3152 wrote to memory of 4408	3152	msedge.exe	150
PID 3152 wrote to memory of 4428	3152	msedge.exe	151
PID 3272 wrote to memory of 756	3272	trljgbztrojgeywt.exe	154
PID 3728 wrote to memory of 5956	3728	ausmkfcxup.exe	156
PID 3272 wrote to memory of 3432	3272	trljgbztrojgeywt.exe	159
PID 3272 wrote to memory of 5996	3272	trljgbztrojgeywt.exe	163
PID 1292 wrote to memory of 4480	1292	ecwupkhfzx.exe	165
PID 3272 wrote to memory of 3520	3272	trljgbztrojgeywt.exe	168
PID 3272 wrote to memory of 1780	3272	trljgbztrojgeywt.exe	172
PID 4704 wrote to memory of 4576	4704	mhezwrpjhb.exe	174
PID 3272 wrote to memory of 5844	3272	trljgbztrojgeywt.exe	177
PID 3272 wrote to memory of 2828	3272	trljgbztrojgeywt.exe	181

C:\Users\Admin\AppData\Local\Temp\2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_5d83ebdb3f36c83f44ccb3af626e6a1f_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Temp\trljgbztrojgeywt.exe
  C:\Temp\trljgbztrojgeywt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtomgeywr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\Temp\ywtomgeywr.exe
      C:\Temp\ywtomgeywr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2644
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtomgeywr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:964
  - - C:\Temp\i_ywtomgeywr.exe
      C:\Temp\i_ywtomgeywr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqolgdbwq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1224
  - - C:\Temp\yvqolgdbwq.exe
      C:\Temp\yvqolgdbwq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1220
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1212
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqolgdbwq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4620
  - - C:\Temp\i_yvqolgdbwq.exe
      C:\Temp\i_yvqolgdbwq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdxvsnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5968
  - - C:\Temp\qnlfdxvsnl.exe
      C:\Temp\qnlfdxvsnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdxvsnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2796
  - - C:\Temp\i_qnlfdxvsnl.exe
      C:\Temp\i_qnlfdxvsnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axvpnhfaxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4736
  - - C:\Temp\axvpnhfaxs.exe
      C:\Temp\axvpnhfaxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axvpnhfaxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\i_axvpnhfaxs.exe
      C:\Temp\i_axvpnhfaxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ausmkfcxup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\ausmkfcxup.exe
      C:\Temp\ausmkfcxup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ausmkfcxup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3432
  - - C:\Temp\i_ausmkfcxup.exe
      C:\Temp\i_ausmkfcxup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwupkhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5996
  - - C:\Temp\ecwupkhfzx.exe
      C:\Temp\ecwupkhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4480
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwupkhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3520
  - - C:\Temp\i_ecwupkhfzx.exe
      C:\Temp\i_ecwupkhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezwrpjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1780
  - - C:\Temp\mhezwrpjhb.exe
      C:\Temp\mhezwrpjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezwrpjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5844
  - - C:\Temp\i_mhezwrpjhb.exe
      C:\Temp\i_mhezwrpjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrojg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2828
  - - C:\Temp\ojgbztrojg.exe
      C:\Temp\ojgbztrojg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4428
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2276
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrojg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5536
  - - C:\Temp\i_ojgbztrojg.exe
      C:\Temp\i_ojgbztrojg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqojgebwt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1804
  - - C:\Temp\ywqojgebwt.exe
      C:\Temp\ywqojgebwt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5900
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3020
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywqojgebwt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4944
  - - C:\Temp\i_ywqojgebwt.exe
      C:\Temp\i_ywqojgebwt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jdbvtnligb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3444
  - - C:\Temp\jdbvtnligb.exe
      C:\Temp\jdbvtnligb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4508
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jdbvtnligb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2088
  - - C:\Temp\i_jdbvtnligb.exe
      C:\Temp\i_jdbvtnligb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdyvqoig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5940
  - - C:\Temp\nlfdyvqoig.exe
      C:\Temp\nlfdyvqoig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdyvqoig.exe ups_ins
    3⤵
    PID:264
  - - C:\Temp\i_nlfdyvqoig.exe
      C:\Temp\i_nlfdyvqoig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vpnhfaxspn.exe ups_run
    3⤵
    PID:4452
  - - C:\Temp\vpnhfaxspn.exe
      C:\Temp\vpnhfaxspn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vpnhfaxspn.exe ups_ins
    3⤵
    PID:4296
  - - C:\Temp\i_vpnhfaxspn.exe
      C:\Temp\i_vpnhfaxspn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causnkfvsn.exe ups_run
    3⤵
    PID:3268
  - - C:\Temp\causnkfvsn.exe
      C:\Temp\causnkfvsn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2932
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causnkfvsn.exe ups_ins
    3⤵
    PID:5144
  - - C:\Temp\i_causnkfvsn.exe
      C:\Temp\i_causnkfvsn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fzxrpkhcau.exe ups_run
    3⤵
    PID:2264
  - - C:\Temp\fzxrpkhcau.exe
      C:\Temp\fzxrpkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fzxrpkhcau.exe ups_ins
    3⤵
    PID:944
  - - C:\Temp\i_fzxrpkhcau.exe
      C:\Temp\i_fzxrpkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2972
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmhezxrpjh.exe ups_run
    3⤵
    PID:5068
  - - C:\Temp\pmhezxrpjh.exe
      C:\Temp\pmhezxrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:428
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4152
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmhezxrpjh.exe ups_ins
    3⤵
    PID:2308
  - - C:\Temp\i_pmhezxrpjh.exe
      C:\Temp\i_pmhezxrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwrojebzwr.exe ups_run
    3⤵
    PID:2784
  - - C:\Temp\zwrojebzwr.exe
      C:\Temp\zwrojebzwr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2528
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwrojebzwr.exe ups_ins
    3⤵
    PID:5884
  - - C:\Temp\i_zwrojebzwr.exe
      C:\Temp\i_zwrojebzwr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljdbwt.exe ups_run
    3⤵
    PID:6088
  - - C:\Temp\bztrljdbwt.exe
      C:\Temp\bztrljdbwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6024
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljdbwt.exe ups_ins
    3⤵
    PID:4356
  - - C:\Temp\i_bztrljdbwt.exe
      C:\Temp\i_bztrljdbwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvqoigb.exe ups_run
    3⤵
    PID:2320
  - - C:\Temp\ljdbvqoigb.exe
      C:\Temp\ljdbvqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2452
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvqoigb.exe ups_ins
    3⤵
    PID:2084
  - - C:\Temp\i_ljdbvqoigb.exe
      C:\Temp\i_ljdbvqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdyvqoi.exe ups_run
    3⤵
    PID:1508
  - - C:\Temp\qnlfdyvqoi.exe
      C:\Temp\qnlfdyvqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdyvqoi.exe ups_ins
    3⤵
    PID:3460
  - - C:\Temp\i_qnlfdyvqoi.exe
      C:\Temp\i_qnlfdyvqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4072
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff89fbbc188,0x7ff89fbbc194,0x7ff89fbbc1a0
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,5942851518435221026,1606623146924127708,262144 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,14476859920480582885,7298497292570044562,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
      4⤵
      System Time Discovery
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,4322833193336302967,2486963256835094466,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:13
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,9714805630133381402,3703978735805750224,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,2480119321486342408,7483024274404963226,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:5212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,12526495338366331429,13287970387212921179,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
      4⤵
      PID:4592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,3297205201925580392,8070085712125664400,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:9
      4⤵
      PID:4572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,541661552847862165,12211244760622599293,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,17028344782108563686,5497785394304101821,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,2517643633225254384,17965756067565989819,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12947552309644665776,15984314221324992904,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:4200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,12947552309644665776,15984314221324992904,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7555587946096898353,17511526444536489347,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
      4⤵
      PID:4080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,1768182269241788561,7791754016231218712,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5028,i,10182656217653994693,6836022439448692384,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3612,i,17056819853453722245,5840902666351843550,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
      4⤵
      PID:5840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,7813891196373944794,9253667976234488649,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
      4⤵
      PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,8704098456790272771,4979716496540372708,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
      4⤵
      PID:4408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,6358541063554617428,4825897308594709620,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,4341352314571478908,1982917523276789683,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,10382126789084915084,4710368342288082567,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
      4⤵
      PID:5728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6356,i,7166659431621788177,1123870487521796164,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7538865035091757729,1175183650366374031,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3728,i,13672838416402853458,8247121029901622078,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:3848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,11016678225098080076,11088719882612881221,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:5008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6288,i,7050778557799712615,11003577422576715082,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2740,i,15806530700111003222,17562987766423730533,262144 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:10
      4⤵
      PID:928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,18161825182975327745,14259919579360346676,524288 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
      4⤵
      PID:2604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5592,i,5886359478575423087,5113622694839752641,2097152 --field-trial-handle=2316,i,5429914374529026940,7032229087395077245,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4568

C:\Temp\trljgbztrojgeywt.sys
C:\Temp\trljgbztrojgeywt.sys
1⤵
- Executes dropped EXE
PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1508

C:\Temp\gdyvtqljdb.sys
C:\Temp\gdyvtqljdb.sys
1⤵
- Executes dropped EXE
PID:2208

C:\Temp\gdyvtnlyvq.sys
C:\Temp\gdyvtnlyvq.sys
1⤵
- Executes dropped EXE
PID:2880

C:\Temp\sqnigaysqk.sys
C:\Temp\sqnigaysqk.sys
1⤵
- Executes dropped EXE
PID:1780

C:\Temp\hfzxvpnhca.sys
C:\Temp\hfzxvpnhca.sys
1⤵
- Executes dropped EXE
PID:5416

C:\Temp\nhfzxrpnhf.sys
C:\Temp\nhfzxrpnhf.sys
1⤵
- Executes dropped EXE
PID:4912

C:\Temp\xrpjhbzurm.sys
C:\Temp\xrpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:5188

C:\Temp\ebzxrpjhbz.sys
C:\Temp\ebzxrpjhbz.sys
1⤵
- Executes dropped EXE
PID:2556

C:\Temp\geywqojgbz.sys
C:\Temp\geywqojgbz.sys
1⤵
- Executes dropped EXE
PID:5300

C:\Temp\qoigbytqlj.sys
C:\Temp\qoigbytqlj.sys
1⤵
- Executes dropped EXE
PID:4088

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:2552

C:\Temp\lfdxvpnifa.sys
C:\Temp\lfdxvpnifa.sys
1⤵
PID:2292

C:\Temp\nkfdxvpnhf.sys
C:\Temp\nkfdxvpnhf.sys
1⤵
PID:4840

C:\Temp\pkicausmkf.sys
C:\Temp\pkicausmkf.sys
1⤵
PID:3404

C:\Temp\urmkeczurm.sys
C:\Temp\urmkeczurm.sys
1⤵
PID:2344

C:\Temp\mjztrmjebw.sys
C:\Temp\mjztrmjebw.sys
1⤵
PID:5312

C:\Temp\romgezwroj.sys
C:\Temp\romgezwroj.sys
1⤵
PID:2964

C:\Temp\trljdbztrl.sys
C:\Temp\trljdbztrl.sys
1⤵
PID:3760

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
PID:5164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ausmkfcxup.exe

Path C:\Temp\ausmkfcxup.exe
Size 376KB
SHA256 9504d4052eaba67cbda44bb4d0bc737d895faa5b4132b2d7c0cf7b5cb96ace6b
MD5 a121a298bf17057049d15d2e05eccadd
SHA1 ae75dc280e6c616b90de785f925f4554b475dff3
SHA512 48fd83880e79fd4dd77d2f4035d7c1994ee6ad7b4df3fbd0802c97d6745faa7b7db11fa03663b5df29ddc44b6da91e7433a749d8e47cbb41f1d13f7ba2efa8f6
SSDEEP 3072:6ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T110847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

axvpnhfaxs.exe

Path C:\Temp\axvpnhfaxs.exe
Size 376KB
SHA256 48e07ecd14440239582700dc276769bbc764013d50e18d1bd03dc8d022dae333
MD5 4b5c840fb7dae578e866cbedfbf5c9ba
SHA1 03f8f81c7ce6e4e874dd4dff3d81c517f8a8dd38
SHA512 40fbd7ff16be113cb8335de583fdaa227dd76f60a41820cffb301455bbe33c160233aa6093bbcae2d891a2e5f2d6b0a963f88a4b12a0609fad7d78a4241c313b
SSDEEP 3072:eViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:eViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwupkhfzx.exe

Path C:\Temp\ecwupkhfzx.exe
Size 376KB
SHA256 4d9f2700c48d76c353a3b487b28cd85ccdc14c1db56d18da24495fe932c7a953
MD5 00b573c94b789391a0989dfc7a60e7b3
SHA1 1ce9361e15c22482a9ce956c8a9f6e4b552a1f06
SHA512 63989d1f1efc35aca97079251b3df1fb4f149d34c3f311d034c6961ed60252bca2287db6ab0b3b214d36b23cedc6baa292f8b09fb544c1106298fe68a776a976
SSDEEP 3072:gViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:gViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E6847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvtnlyvq.sys

Path C:\Temp\gdyvtnlyvq.sys
Size 293KB
SHA256 0d4ec64387cbf80beae229722eec67c96ddbdfd28b1e64a787d7bacb40328990
MD5 1a9955dbe2bd2bb57be67c1f78caf217
SHA1 5baef0651994351cf5a8861d10413464de93d41b
SHA512 6783d7a703b82e5203b1aa185aae52e8c0a6fadb957de34224542d9452f1474ded3d12ad3cb807937a595bfb5f5ccc4341dadcb112e6a27f9fc39c4ce554c1b8
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdyvtqljdb.sys

Path C:\Temp\gdyvtqljdb.sys
Size 293KB
SHA256 a32c85c6dbb5c039f84362facb937980c43297b961dfc885efb33f0949563008
MD5 56aa5173aca52776e86f1a04e8e7e618
SHA1 22b7562875cf14352dd17f0750a7b8bfdac26a68
SHA512 bf71e788c5cc3f54a5a1ad0a2a161a4c1b28497d8306bbb027964ecf33867cd768c059405290fb5ebb3a03bbad3deb8be210c44f0c3aa5b366412ef15b5746f9
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T10B545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxvpnhca.sys

Path C:\Temp\hfzxvpnhca.sys
Size 293KB
SHA256 3646248fdb91d7cc4446473a58ebc9360816798e34a7a982c91591f89252ff4b
MD5 cf8b44eacd4dc79bcaf2b1ba08114a66
SHA1 339baccf563141ddcc8af17151a564e5c55471f1
SHA512 28986620f03060c95b7fa56abbb938fb1db00ed32646afb1a878a3cfd0a2079bff460dbf22a3cc7347c1bd7719cad2f04698ed4f5dff95ee192e36d4a8d4f29c
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T10B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ausmkfcxup.exe

Path C:\Temp\i_ausmkfcxup.exe
Size 376KB
SHA256 4f96ba98eb0b83d536c05f2ffa4dab98f1433e096313b9b907ada82d4bc06371
MD5 b8f37ee4f600c1caa0392072b17a4d34
SHA1 886edebeb6875b7948469444dd38102a406e2ca3
SHA512 f9d07089cff7714c550cdabda0b773ac8bd3e7c07aa2e0883d36f39d164a8e7d1c6ebc9f30a1eaa0188cf8b85e8150112385a40fc4657117548d430999f1ecfe
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_axvpnhfaxs.exe

Path C:\Temp\i_axvpnhfaxs.exe
Size 376KB
SHA256 540b075bc65aabd8fc5b41cce9576c2c6cc103bb203f644917bf789365bd82f1
MD5 fe5c8b3908f8098512219e5f52046546
SHA1 4861ffac13480e99b1561a8677eae02d60cfb2f0
SHA512 f8774ff67ccdb02b6dd9522500f2131f35426ef7b7987132d8081dda26081b464fba7aacc2868bb45107b708558f11305b6543f43bd7ee1b7cc3ee197765b58f
SSDEEP 3072:GViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:GViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D3847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdxvsnl.exe

Path C:\Temp\i_qnlfdxvsnl.exe
Size 376KB
SHA256 76d78b444818d14d281256cd7db40e20a8d5c141004780afff2041b58aaa37a5
MD5 3704fa70b2f162385adf6fc7184c3a25
SHA1 1ec3d925697a0fb9361d2266fc8b2a08d39e4b39
SHA512 c515da6015baf674cb125ba4145c083bde3dad387c2a7afd3d1c2cccfa5bdd105b49289e020228ea726b9b900ba2ca456cf501ac263b16479f0887c25b890079
SSDEEP 3072:qViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:qViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C2847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqolgdbwq.exe

Path C:\Temp\i_yvqolgdbwq.exe
Size 376KB
SHA256 cf23c8a2fab64b766b10756a6eb6038757cb58171aec06b0ac923992d750b062
MD5 0e97a7f8db688a42725d6e71423337c0
SHA1 2a408fcc0720c039dca94f2992a3a3af5f2d0946
SHA512 99e5fdffedff340206c4f1df945331464224d62d2e4d0dc2914731e87d4f4b2fac605decc5f38f281443a2526c72d226c6b0c58069adf6f1d7df6e4e12c0a933
SSDEEP 3072:6ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ywtomgeywr.exe

Path C:\Temp\i_ywtomgeywr.exe
Size 376KB
SHA256 952b45cc2ec46a227027cecd3f50182c9d3e2b7b0b8d58b0a7e7d34abf155b7e
MD5 fd7e7d35a5d82930936d5ae91b07e14d
SHA1 50bc2d4c464cd70c1c1184ac3795a441d823e8e0
SHA512 0565785b7ee17f6065e1a31fe4c68ef42db1dfd5fd321650f8b63a9aa90ff956253dbd700e276a92342407911e4217313089addca88ca53f9252648c8d1069f2
SSDEEP 3072:VViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nhfzxrpnhf.sys

Path C:\Temp\nhfzxrpnhf.sys
Size 293KB
SHA256 7250bcfbdd3be5bb793397fb5e1040af2b2e3028713cfa789c3751c0d944a686
MD5 e31a7d5a60c8a4df08f524cf6b9054f1
SHA1 5c404c6a58f17da4000e83b2be47b0d1b7c8160c
SHA512 f0acd7352a831bd1c0c1042df23ff15931fe058720776102ab06d6342d866fd320b6cb6863b4cd95cc755cdab75c297755bcbee5ad1912cdb48f5a4e23da2a43
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdxvsnl.exe

Path C:\Temp\qnlfdxvsnl.exe
Size 376KB
SHA256 d01f4da841b7744031f7d7232781b157680acf0519d3da05bc4d1fceb24658f1
MD5 241affb6659600a9893a76c46c978f42
SHA1 c642269c9c03ebdeb5b93206a6b57d46a1422485
SHA512 7ecb008b97065e4bd3b632875a4ad0686f3496422f6cf3d90df34989c0aace7c0e66ea824811bfa62d3f6a968659e5673756b10a2254487b17d92a7afe1d8e02
SSDEEP 3072:jViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqnigaysqk.sys

Path C:\Temp\sqnigaysqk.sys
Size 293KB
SHA256 adfabd3a7401488da980e55bc54771e225496ac56f2498b859017189ddc90ebb
MD5 63943281b759c90d27055b172723f463
SHA1 bd0758145d430d2712613a0661771d4ff854d6c2
SHA512 c4559183d70faab40bf92466f81317a4b1d94aa44de2c5a2df593e34d0bb73fdd935477a0111d35bc1ccbeaaa4a2aaffc0ada742ea41e1e07c31f71e81b20397
SSDEEP 3072:jtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:jIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljgbztrojgeywt.exe

Path C:\Temp\trljgbztrojgeywt.exe
Size 376KB
SHA256 15691550f2f7a8cbab3dbdfcc52cc88ef89bd70a529746c9a1a256dbd2fff878
MD5 15c4a53fa00647f8757a537f3a3466c3
SHA1 23e1e21be4cb4aafa49c3dcf81da6409c212e7f1
SHA512 d056d76c81fd4a5ed13c8748e7a924fcff5d2c58f603543e63b0542564599cf25b62dfb03f001860823285f19d71e64460ce4e9c9e96d9f518112c7716af8955
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F8847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljgbztrojgeywt.sys

Path C:\Temp\trljgbztrojgeywt.sys
Size 293KB
SHA256 acd3550e99c7e750c70b1e41abe5b89a9a2af56399abde5dfcf6b687064a36c9
MD5 8936ab9d2e8d0a834f3ba309c9a9defb
SHA1 c4c1640d8602f4e35e89c6bedb7579b311aee084
SHA512 18ba25e4440ee740bc29f2f1a7c3b672e81c0935d3ede506e1cd3db0dfc2bcf6b5b2841d2dbb0fcc5c0f5aac6fdb12377e12fc11da2492e3447c094a40c82bdc
SSDEEP 3072:XtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:XIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqolgdbwq.exe

Path C:\Temp\yvqolgdbwq.exe
Size 376KB
SHA256 b568ac3fdea998959d23115d5d128bee284d627b559825aa341abead79a68926
MD5 f3e5586b6102785104d2afc34c65f89f
SHA1 9822c0b31058b40f9938a20c0e43745e096ca532
SHA512 90d6dc650471df62bd4c753c504a05884f35b9cc316f2b09286b3b0b48f9518c1b356e3acbaa9aeb91aee13733fa8ba903ab9abf2a5b1d8e563ff6ce48e2089b
SSDEEP 3072:DViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F7847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywtomgeywr.exe

Path C:\Temp\ywtomgeywr.exe
Size 376KB
SHA256 c9ade2bb937e746f564306838f22f9f304bb7e673fa8072a649a991dfc6eda33
MD5 f53b76e572caa6295a3ec87b2fe9ce6e
SHA1 341f82d1f43d27186276e81d88187b1be5b89e65
SHA512 2ad1ece2cb469301c4354f3b2b2184c71b4bb51d1fbaf3754993fae7a732473a818467362608a12394c4fcbb9b0c71493b58c8fc595fdab4951854af02add438
SSDEEP 3072:ZViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ZViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14D847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5677fabec761ffd0b65d4d0369b054416210b0a089259169a8866cc352dfbfb1
MD5 f96e091dea8dc5d7ecd9b2a1a7443ce4
SHA1 978fa9c746514296e9e4230fcb2c87b9409df1d7
SHA512 8f08d74cf2c871b1c0315e3d07fe4921cf96432808d14b25cbcafe85288255b14bdf6a86caba5a317bc5836558f087b859262a4bd37a017deb30bba9277f9296
TLSH
T1D86150D5231A2B92EF204EB1DDE2764D35F3C754090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b7fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b7fc.TMP
Size 3KB
SHA256 70413c4c31d0a97d338127fa0176e28d62416aa04f7016e9dd695ed954a4b309
MD5 f8ddd51c8cfad3b6a66e3aaad3429082
SHA1 7789ecca55097359c3b2fd93a6b72b7d5ef473a7
SHA512 5dc03ba14f420988e4ea52882612ef931341a6429b4dd5c5a8833cf981f15c0272bc14e7b9cbbc76d279bd00100786131edb26bb07537ac929b3ccb25a4a9d86
TLSH
T18A6150E5271A2B92EF204EB1DDE2764D35F3C754090BAAB048006D360B2EF1954D2DE3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8edff8f36d89d99ace693f51931d37c112a4b1fba079899bfee8ababb998316a
MD5 49ba1db5f04966637c20910350ccd5e3
SHA1 d639a1f1b2d62f3784e7d0b754c9ae66f18f6b62
SHA512 9dcecfb026d929905dda48804154d2bd90cd682f228638d5a05f950c0cd545fd0d8dc8bf3e827d1f43a45addbb1e62d2c637a025829d38b6cb26ed629b093124
TLSH
T12541DEF7C7E4866ECA0196F0AA187E2BCE1D0914432C3D5AC9E4EF5BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0e426d556d6d78d741c5123d3e102adee25fb7bcaaa079a6adc14df4275355ba
MD5 5ee3d0b45f9f0f01eb15fc84f1d53bf1
SHA1 c4f571800a429a586e42378ed2b1771ef8e0204a
SHA512 3e6f8fff101952aa3662b6381529cec9e3f25aeb51b22f6a96dabc89e6aabb68b2160527636e6777c8559656a8cd204769d589db501c76bfa4808758bd41ff20
SSDEEP 192:sxR1ROyM/jK1Ml8wCm/fuscNymZQPzoA8pi/g6+WNIYD9a6SJGvtIgtJ:sxR1g8m/fus8yQQmi/5I2Sm3
TLSH
T17452E8156A24997BDCDBD20DFA517F93D6F85573E2901E44AAFC8A0C00F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5da874e84a19a176378b5678bba99e3f7df7a2ed2ff128221a85258d07da63d0
MD5 bb42e215bb415c944c10d730b3a7bc48
SHA1 ba5ad26d4979bcaf6bd1a6f777e8900a0b133b12
SHA512 1b3f06bd209c53d6c1b4b56fcb5b7dcd254d4f19a2d039b401a5881a7329cd1cc12bdaef05ad32895783f8d8d4814ba6223b02b89e8437a0216261650fcee5cc
SSDEEP 192:sxRuROyM/jK1Ml8UQCCm/fusW3NImZQXzoA8prTS/g6+WNIYD9Z6SJGvtIgD/J:sxRugq1m/fusW9IQQ+XS/5IpSml
TLSH
T1E862E816AA24597BDCDBD219FA517F93D6F85573A2901E44ABFC8B0C00F6ADD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c1b91157962d2850904c814e043877f2a6f7f72e4cab403dad0a2d4b0864f392
MD5 084d3f1b59ba2b9c2f70fcef0b60c87c
SHA1 f1eca58474e783cc3e0069e28666fbc8b4d75832
SHA512 3054d1b62a45b6126dafcd6d525ce8ea89ad108b64337f40af43a87c49ad0a2e82d6ba3d055ae0c94078f079a9904851a2841999e6440f3f83ff4c83900ef9ff
SSDEEP 192:sxRuROyM/jK1Ml8wCm/fusW3NymZQXzoA8p9I/g6+WNIYD986SJGvtIgDdJ:sxRug8m/fusW9yQQ+K/5ISSmL
TLSH
T11052E8156A24597BDCDBD209FA517F93D6F85573E2902E44AAFC8A0C00F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 642262435c76d6d3ea58617cd70ed29f325bae380c7a3d307a9c5cd858cd4073
MD5 4de22d06f0089c0b3354011516600043
SHA1 5bd14819bbb57a91d56a7083e7fa95eedec118ad
SHA512 4e9c4036423a5befd3d0a0336644a1cc19276e3febc44de627f286738fde25594b0a4d230d4174a0b4685a930ccc37c066f48ad08cec29963d8fc39e0303e497
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVn1Ac1sTro/lC1E:aW5WFdE710Wg/XfCfu1jag1Aysg/ll
TLSH
T17FE2EB3B280CCB7E4F444A9CED297D9AADA801CB96DCCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 85cf407a03c30501a37881424065d8a8a491b5352f8846c32d8f64838e294bfe
MD5 9a82a15ec3ef1e1a8db64a3f140dd072
SHA1 fce5abbd6fdd4acbb4ff34c0a3eb5e238847b81a
SHA512 e78ecee28b8f37487ed077304998a52140ba28513a4dc5ebc092f7df96558d94836c7f1bd43e5b74a1a651c2cea1f334ece9123e1d6b1f909967edbda0da8f4c
SSDEEP 96:KRE/iE/nE/OE/iE/UE/0E/kE/iWE/sE/5E/RgE/SE/iK4E/HgE/IE/icE/yE/6EJ:CE/iE/nE/OE/iE/UE/0E/kE/dE/sE/57
TLSH
T158914841317A0240387E660DD9E6992AD6C2B472341DA5AF7BEA51A50F6FE134CFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 17959943aea820485d6eb753a6652ed5f8f35816e1503525e5f675521438739c
MD5 14551722062ffdcf0e9b419e0ef1f4b1
SHA1 f913d7c34c103d4bfd13861b910f1b54a54de865
SHA512 065be518b82aad2ff0d2d26d0f664ade377c2b2620d1096f5c297a4dfbe79fec7cdfc614d4e390e284df36421d79d79033c02fb4f5e9eb9073d81b1514c0fdf1
SSDEEP 384:notNn/s3n9Sd38NyBunDrz94WZlf8hyEG6f77h7F+sy2rEoajo4cdR8eHhVODjYm:oj+9q3G9Zi0QW4rEnjN3Gac1F4b9M4
TLSH
T1DBF2C03469658EB38CD7D795B6473B83BEE007A385C50E98DAC9AB0C05D36EC170B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a24bb2842a892573ce1f3f87d43f8bf61af7d385c6c53a2a3d5284876bb45431
MD5 4d669b8aec71f231e3d2c909a96cd6ee
SHA1 c44b95c1018d124d1d7a0a1c2be91f28dc0ffebc
SHA512 af3b1a680a3f9044264dab4f36802ff68e5bf4423126953fe9a8b6ae0db9b60763e3baf326b6a801abc07162cf91583895db8cc551ad0d75ac03ce1af7739706
SSDEEP 768:rrv+4UNbdS3zmi0QyrEnjN3Gac1ZBeVH1SCz:rbsbg3Y7QnjMaaEH1V
TLSH
T1AA03CF3269A88AB39CE7E38575877A037EF4525385D40BE0C6DD6B0D02DB5EC230B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 c44b9626cd0841abba4efae20c98a82e222207401c6f5a032e89e3e19a079d22
MD5 7f92a409e8513dfd1fcad06e06804bc5
SHA1 3ef8b37ca33d68df61aa6b2c9b9f791eee613559
SHA512 b5b6b36bd7e5288734be49c55fb535019e63c5293d5bda373a079404e0057b9fe3fd164aeab047bc67d32c836179a5134c257ca423610f24379a676f0cd6bbc2
SSDEEP 768:jrv+4UNbdY3R9Zi0QWHrEnjN3Gac1F4b9Mz:jbsbu37XHQnjMaPb+z
TLSH
T1DE13CF3169788EB38CE7D255B1873B837FE416A385D50B94EAC9AB0C05975EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2edc700b493799363882819d791d33c4f48db6740bbd715608f6602cbabf8667
MD5 4a664a7c845b94abe906e4986b20b69d
SHA1 d1abe16bbe5cc03df977b2a1572e849c5a988f87
SHA512 f76d9a7fa41598694676cf92a08664943455cbf251c519d377b6582e242abce6bd162c5248231aeab723872198a3721d50c66ab61c2e387261ca2e35b79f982a
SSDEEP 384:n3tNn/s3n9Sd38NysunDrz94WZlf8hyEG6f77h7F+sy2rEoajo4cdR8eHhVODjYm:3j+9q3b9Zi0QW4rEnjN3Gac1F4b9M4
TLSH
T123F2C03469658EB38CE7D795B6473B83BEE007A785C50E98DAC9AB0C05D36EC170B426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fd5e955a527cec85511829fd8f7822a91e7b9eeecc9607ba2b5c4caf2df2b349
MD5 f369407a267ae17877271eb3395239f9
SHA1 7a4f21651894b6441c2735a4b8aed05bfc896bae
SHA512 9e040e8f57d8b36dbd13088206c414808c8c49d13db655fd582acad7fbf220e2b973d7a40869ba47a948bb6728f8817fed4af4afcccb15acfbd419dd07e1350d
SSDEEP 768:PF1j+9c35wgF9qsQW1rEnjN3Gac1F4b9M4:m9c3/X1QnjMaPb+4
TLSH
T12F039E359865CEB79CE797D6B7467B86EEE002A785D85DD4EAC86E0C00D32EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

6067fe5a-ba95-48cc-a508-0512ba9b5a3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6067fe5a-ba95-48cc-a508-0512ba9b5a3f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3152_1316602633\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 06758a3c8193348d51184ed6506d453437a21f5bc96b4ce6e5eaa80614157a15
MD5 d3b39875c62e3331b194e20e3bcab6d5
SHA1 6aa72da7632d6377525ea6a61f0971bdeeede470
SHA512 8298dc9beb432336a338146f4fc848d500e728d9dcb6e9991e904dd6bd33721b06d16aedac61a2db966401ed401a72b8c9a3e723a6f7d76df59c3c495b5c2a4a
TLSH
T15171274357A8D5B3C1DE5FF113835144F5FB127C072370640B515946E730A795479F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1084-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1780-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2208-196-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-406-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2344-430-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2552-365-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2556-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2880-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2964-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2964-476-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3404-426-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3760-466-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4088-357-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4912-314-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5164-492-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5188-321-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5300-332-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5312-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5416-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download