systex | 3c4fc232e603ef1b091d4b8553ed1ebac674ccd7472dafd4661f106c1a8f9e0c

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260714-vhn4mag17l
SHA256 3c4fc232e603ef1b091d4b8553ed1ebac674ccd7472dafd4661f106c1a8f9e0c
MD5 5af01aa270e924fb4e95e5057c16462d
SHA1 1040282c6ffe63e9cf8a1eecbd656c9fca82ad0f
SHA512 1dbe227f971e888f6830e553944068b11b7bafd84ea8bcfe2ea8fb97d2ca1423fcfd35818dddbca5690b968d3c15a705fd7c5b7caaba8d05f9c9c86a4e57fa9a
SSDEEP 3072:w9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:CctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3316	bywrojgbztrljebw.exe
5984	bywrojgbztrljebw.sys
5360	CreateProcess.exe
5760	geywrojgbz.exe
1392	CreateProcess.exe
3412	CreateProcess.exe
4796	i_geywrojgbz.exe
3408	wtrljdbvtg.sys
1476	CreateProcess.exe
3372	dywqoigdyw.exe
5712	CreateProcess.exe
4888	CreateProcess.exe
4664	i_dywqoigdyw.exe
4368	dbytqoigay.sys
4584	CreateProcess.exe
932	qoigaysqli.exe
5744	CreateProcess.exe
4464	CreateProcess.exe
4700	i_qoigaysqli.exe
3376	aysqkidavs.sys
4276	CreateProcess.exe
4796	sqkidavtnl.exe
2488	CreateProcess.exe
4176	CreateProcess.exe
2568	i_sqkidavtnl.exe
1264	pnhfaxvpnh.sys
4872	CreateProcess.exe
4264	fcxvpnhfcx.exe
4340	CreateProcess.exe
4572	CreateProcess.exe
4076	i_fcxvpnhfcx.exe
1200	rpkhcausmk.sys
2804	CreateProcess.exe
3632	hecxupmhec.exe
4948	CreateProcess.exe
3060	CreateProcess.exe
1272	i_hecxupmhec.exe
2100	heczusmkec.sys
2444	CreateProcess.exe
3120	wuomhezwrp.exe
2548	CreateProcess.exe
5732	CreateProcess.exe
1216	i_wuomhezwrp.exe
3848	gecwuomjec.sys
2376	CreateProcess.exe
1344	hezxromjhb.exe
5368	CreateProcess.exe
3388	CreateProcess.exe
5172	i_hezxromjhb.exe
5136	geywqojgby.sys
956	CreateProcess.exe
5536	jgeywqojge.exe
3328	CreateProcess.exe
5104	CreateProcess.exe
4168	i_jgeywqojge.exe
1252	tolgdywqoi.sys
2676	CreateProcess.exe
3392	qolgeytrlj.exe
5772	CreateProcess.exe
3508	CreateProcess.exe
1940	i_qolgeytrlj.exe
1064	vtqoigaytq.sys
3972	CreateProcess.exe
3068	oigdxvtqoi.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1235774749\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_86850982\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_77348867\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_1235774749\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_86850982\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_86850982\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_86850982\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_940923013\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4284_77348867\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczujhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bywrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrligebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dywqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hecxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqojge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigaysqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcxvpnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hecxupmhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_oigdxvtqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	davsnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_heczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geywrojgbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomhezwrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxromjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigayvtqki.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxromjhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_davsnkfcxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkhcau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrligebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrojgbztrljebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oigdxvtqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcxvpnhfcx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgeytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	idavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hczujhecwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bywrljebwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dywqoigdyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_idavsnlfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	heczurmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqoigb.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
960	ipconfig.exe
5272	ipconfig.exe
4572	ipconfig.exe
5872	ipconfig.exe
3280	ipconfig.exe
4232	ipconfig.exe
1820	ipconfig.exe
4524	ipconfig.exe
2148	ipconfig.exe
5828	ipconfig.exe
5560	ipconfig.exe
2808	ipconfig.exe
2856	ipconfig.exe
5032	ipconfig.exe
5152	ipconfig.exe
6064	ipconfig.exe
5140	ipconfig.exe
2760	ipconfig.exe
4432	ipconfig.exe
1188	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285219852687131"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{57E59E5F-AC2A-48E1-B386-B953E535F1C4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe
3316	bywrojgbztrljebw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe
4284	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	i_geywrojgbz.exe
Token: SeDebugPrivilege	4664	i_dywqoigdyw.exe
Token: SeDebugPrivilege	4700	i_qoigaysqli.exe
Token: SeDebugPrivilege	2568	i_sqkidavtnl.exe
Token: SeDebugPrivilege	4076	i_fcxvpnhfcx.exe
Token: SeDebugPrivilege	1272	i_hecxupmhec.exe
Token: SeDebugPrivilege	1216	i_wuomhezwrp.exe
Token: SeDebugPrivilege	5172	i_hezxromjhb.exe
Token: SeDebugPrivilege	4168	i_jgeywqojge.exe
Token: SeDebugPrivilege	1940	i_qolgeytrlj.exe
Token: SeDebugPrivilege	5312	i_oigdxvtqoi.exe
Token: SeDebugPrivilege	4580	i_idavsnlfdx.exe
Token: SeDebugPrivilege	4528	i_davsnkfcxv.exe
Token: SeDebugPrivilege	4752	i_causmkhcau.exe
Token: SeDebugPrivilege	5780	i_hczujhecwu.exe
Token: SeDebugPrivilege	3448	i_heczurmkec.exe
Token: SeDebugPrivilege	724	i_bywrljebwt.exe
Token: SeDebugPrivilege	5632	i_ywtrligebw.exe
Token: SeDebugPrivilege	5708	i_igaytqoigb.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 3316	4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 4892 wrote to memory of 3284	4892	2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3284 wrote to memory of 4284	3284	iexplore.exe	90
PID 4284 wrote to memory of 5076	4284	msedge.exe	91
PID 4284 wrote to memory of 584	4284	msedge.exe	92
PID 4284 wrote to memory of 4556	4284	msedge.exe	94
PID 4284 wrote to memory of 584	4284	msedge.exe	92
PID 4284 wrote to memory of 584	4284	msedge.exe	92
PID 4284 wrote to memory of 3900	4284	msedge.exe	95
PID 4284 wrote to memory of 3900	4284	msedge.exe	95
PID 4284 wrote to memory of 4820	4284	msedge.exe	96
PID 4284 wrote to memory of 4820	4284	msedge.exe	96
PID 4284 wrote to memory of 1128	4284	msedge.exe	97
PID 4284 wrote to memory of 4820	4284	msedge.exe	96
PID 4284 wrote to memory of 1128	4284	msedge.exe	97
PID 4284 wrote to memory of 1128	4284	msedge.exe	97
PID 4284 wrote to memory of 1376	4284	msedge.exe	98
PID 4284 wrote to memory of 1376	4284	msedge.exe	98
PID 4284 wrote to memory of 1376	4284	msedge.exe	98
PID 4284 wrote to memory of 5940	4284	msedge.exe	99
PID 4284 wrote to memory of 5940	4284	msedge.exe	99
PID 4284 wrote to memory of 5940	4284	msedge.exe	99
PID 4284 wrote to memory of 5756	4284	msedge.exe	100
PID 4284 wrote to memory of 5756	4284	msedge.exe	100
PID 3316 wrote to memory of 5360	3316	bywrojgbztrljebw.exe	104
PID 5760 wrote to memory of 1392	5760	geywrojgbz.exe	107
PID 4284 wrote to memory of 5880	4284	msedge.exe	110
PID 4284 wrote to memory of 5880	4284	msedge.exe	110
PID 4284 wrote to memory of 5716	4284	msedge.exe	111
PID 4284 wrote to memory of 5716	4284	msedge.exe	111
PID 4284 wrote to memory of 4648	4284	msedge.exe	113
PID 4284 wrote to memory of 5816	4284	msedge.exe	114
PID 4284 wrote to memory of 5816	4284	msedge.exe	114
PID 4284 wrote to memory of 1860	4284	msedge.exe	117
PID 4284 wrote to memory of 1860	4284	msedge.exe	117
PID 3316 wrote to memory of 3412	3316	bywrojgbztrljebw.exe	118
PID 3316 wrote to memory of 1476	3316	bywrojgbztrljebw.exe	122
PID 3372 wrote to memory of 5712	3372	dywqoigdyw.exe	124
PID 3316 wrote to memory of 4888	3316	bywrojgbztrljebw.exe	127
PID 3316 wrote to memory of 4584	3316	bywrojgbztrljebw.exe	131
PID 932 wrote to memory of 5744	932	qoigaysqli.exe	133
PID 3316 wrote to memory of 4464	3316	bywrojgbztrljebw.exe	136
PID 3316 wrote to memory of 4276	3316	bywrojgbztrljebw.exe	141
PID 4796 wrote to memory of 2488	4796	sqkidavtnl.exe	143
PID 3316 wrote to memory of 4176	3316	bywrojgbztrljebw.exe	146
PID 4284 wrote to memory of 3484	4284	msedge.exe	148
PID 4284 wrote to memory of 1720	4284	msedge.exe	149
PID 4284 wrote to memory of 3012	4284	msedge.exe	150
PID 4284 wrote to memory of 3636	4284	msedge.exe	151
PID 4284 wrote to memory of 3636	4284	msedge.exe	151
PID 4284 wrote to memory of 3636	4284	msedge.exe	151
PID 4284 wrote to memory of 3028	4284	msedge.exe	152
PID 4284 wrote to memory of 3028	4284	msedge.exe	152
PID 4284 wrote to memory of 3028	4284	msedge.exe	152
PID 3316 wrote to memory of 4872	3316	bywrojgbztrljebw.exe	155
PID 4264 wrote to memory of 4340	4264	fcxvpnhfcx.exe	157
PID 3316 wrote to memory of 4572	3316	bywrojgbztrljebw.exe	160
PID 3316 wrote to memory of 2804	3316	bywrojgbztrljebw.exe	164
PID 3632 wrote to memory of 4948	3632	hecxupmhec.exe	166
PID 3316 wrote to memory of 3060	3316	bywrojgbztrljebw.exe	169
PID 3316 wrote to memory of 2444	3316	bywrojgbztrljebw.exe	173
PID 3120 wrote to memory of 2548	3120	wuomhezwrp.exe	175
PID 3316 wrote to memory of 5732	3316	bywrojgbztrljebw.exe	178
PID 3316 wrote to memory of 2376	3316	bywrojgbztrljebw.exe	182

C:\Users\Admin\AppData\Local\Temp\2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_5af01aa270e924fb4e95e5057c16462d_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Temp\bywrojgbztrljebw.exe
  C:\Temp\bywrojgbztrljebw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3316
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geywrojgbz.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5360
  - - C:\Temp\geywrojgbz.exe
      C:\Temp\geywrojgbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1392
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geywrojgbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3412
  - - C:\Temp\i_geywrojgbz.exe
      C:\Temp\i_geywrojgbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dywqoigdyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1476
  - - C:\Temp\dywqoigdyw.exe
      C:\Temp\dywqoigdyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dywqoigdyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\i_dywqoigdyw.exe
      C:\Temp\i_dywqoigdyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigaysqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4584
  - - C:\Temp\qoigaysqli.exe
      C:\Temp\qoigaysqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigaysqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4464
  - - C:\Temp\i_qoigaysqli.exe
      C:\Temp\i_qoigaysqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkidavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4276
  - - C:\Temp\sqkidavtnl.exe
      C:\Temp\sqkidavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2808
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkidavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4176
  - - C:\Temp\i_sqkidavtnl.exe
      C:\Temp\i_sqkidavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcxvpnhfcx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4872
  - - C:\Temp\fcxvpnhfcx.exe
      C:\Temp\fcxvpnhfcx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4340
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcxvpnhfcx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4572
  - - C:\Temp\i_fcxvpnhfcx.exe
      C:\Temp\i_fcxvpnhfcx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hecxupmhec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2804
  - - C:\Temp\hecxupmhec.exe
      C:\Temp\hecxupmhec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hecxupmhec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3060
  - - C:\Temp\i_hecxupmhec.exe
      C:\Temp\i_hecxupmhec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomhezwrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2444
  - - C:\Temp\wuomhezwrp.exe
      C:\Temp\wuomhezwrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3120
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2548
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3280
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomhezwrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5732
  - - C:\Temp\i_wuomhezwrp.exe
      C:\Temp\i_wuomhezwrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxromjhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2376
  - - C:\Temp\hezxromjhb.exe
      C:\Temp\hezxromjhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5368
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxromjhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3388
  - - C:\Temp\i_hezxromjhb.exe
      C:\Temp\i_hezxromjhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5172
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqojge.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:956
  - - C:\Temp\jgeywqojge.exe
      C:\Temp\jgeywqojge.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3328
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqojge.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5104
  - - C:\Temp\i_jgeywqojge.exe
      C:\Temp\i_jgeywqojge.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4168
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgeytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2676
  - - C:\Temp\qolgeytrlj.exe
      C:\Temp\qolgeytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3392
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgeytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3508
  - - C:\Temp\i_qolgeytrlj.exe
      C:\Temp\i_qolgeytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1940
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigdxvtqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3972
  - - C:\Temp\oigdxvtqoi.exe
      C:\Temp\oigdxvtqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5116
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_oigdxvtqoi.exe ups_ins
    3⤵
    PID:5524
  - - C:\Temp\i_oigdxvtqoi.exe
      C:\Temp\i_oigdxvtqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5312
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\idavsnlfdx.exe ups_run
    3⤵
    PID:244
  - - C:\Temp\idavsnlfdx.exe
      C:\Temp\idavsnlfdx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5660
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2148
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_idavsnlfdx.exe ups_ins
    3⤵
    PID:360
  - - C:\Temp\i_idavsnlfdx.exe
      C:\Temp\i_idavsnlfdx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\davsnkfcxv.exe ups_run
    3⤵
    PID:3520
  - - C:\Temp\davsnkfcxv.exe
      C:\Temp\davsnkfcxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3760
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_davsnkfcxv.exe ups_ins
    3⤵
    PID:5880
  - - C:\Temp\i_davsnkfcxv.exe
      C:\Temp\i_davsnkfcxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkhcau.exe ups_run
    3⤵
    PID:4788
  - - C:\Temp\causmkhcau.exe
      C:\Temp\causmkhcau.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkhcau.exe ups_ins
    3⤵
    PID:2688
  - - C:\Temp\i_causmkhcau.exe
      C:\Temp\i_causmkhcau.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hczujhecwu.exe ups_run
    3⤵
    PID:1896
  - - C:\Temp\hczujhecwu.exe
      C:\Temp\hczujhecwu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3116
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hczujhecwu.exe ups_ins
    3⤵
    PID:3012
  - - C:\Temp\i_hczujhecwu.exe
      C:\Temp\i_hczujhecwu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\heczurmkec.exe ups_run
    3⤵
    PID:5884
  - - C:\Temp\heczurmkec.exe
      C:\Temp\heczurmkec.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2732
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_heczurmkec.exe ups_ins
    3⤵
    PID:1284
  - - C:\Temp\i_heczurmkec.exe
      C:\Temp\i_heczurmkec.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bywrljebwt.exe ups_run
    3⤵
    PID:292
  - - C:\Temp\bywrljebwt.exe
      C:\Temp\bywrljebwt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4988
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bywrljebwt.exe ups_ins
    3⤵
    PID:4528
  - - C:\Temp\i_bywrljebwt.exe
      C:\Temp\i_bywrljebwt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrligebw.exe ups_run
    3⤵
    PID:2260
  - - C:\Temp\ywtrligebw.exe
      C:\Temp\ywtrligebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrligebw.exe ups_ins
    3⤵
    PID:3428
  - - C:\Temp\i_ywtrligebw.exe
      C:\Temp\i_ywtrligebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5632
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqoigb.exe ups_run
    3⤵
    PID:3088
  - - C:\Temp\igaytqoigb.exe
      C:\Temp\igaytqoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1176
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqoigb.exe ups_ins
    3⤵
    PID:2568
  - - C:\Temp\i_igaytqoigb.exe
      C:\Temp\i_igaytqoigb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5708
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\oigayvtqki.exe ups_run
    3⤵
    PID:3172
  - - C:\Temp\oigayvtqki.exe
      C:\Temp\oigayvtqki.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1804
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5272
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff8287cc188,0x7ff8287cc194,0x7ff8287cc1a0
      4⤵
      PID:5076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,15500035353678503077,11197878870503433217,262144 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8439265739047557202,368366374474665660,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
      4⤵
      System Time Discovery
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,4438090248136067287,11720886988032974592,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
      4⤵
      PID:3900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,14634076097503121890,11212285638595531379,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:4820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,16142487814794714157,9614669768973911310,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,1730475493437824389,1669918685647325572,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:9
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,10985170870711013513,16856531539924422568,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
      4⤵
      PID:5940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,16721909348808167731,15124908535674248867,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:14
      4⤵
      PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,10434849307357168322,10196973435228746280,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16636725232092320880,5052107205056790905,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:5716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8326732155439908664,15609878912995357023,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:2496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8326732155439908664,15609878912995357023,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,8665224303156103353,14603338736617914542,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,9759775320551513156,3467346156015295031,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:1860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7740314800541731264,372864087948631394,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:14
      4⤵
      PID:3484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,10338571216303858393,60316462567718638,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:14
      4⤵
      PID:1720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17874624339930999039,3589897477276838627,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5004,i,15121657153160536333,9759721731519440699,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:1
      4⤵
      PID:3636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3664,i,17043859869434348920,7471781723620357185,2097152 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,2298486270867020455,11848077472704730904,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,768184197355800761,3627468322642704470,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,2938029092177816544,366407185846926014,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:14
      4⤵
      PID:2552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,7982917881870437001,2289514276550793334,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
      4⤵
      PID:4904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6180,i,16088879071182192512,13762703751869826838,262144 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:10
      4⤵
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,15410752647760490262,12477850250024866210,524288 --field-trial-handle=2288,i,14022419815660112290,15656248431142993099,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2384

C:\Temp\bywrojgbztrljebw.sys
C:\Temp\bywrojgbztrljebw.sys
1⤵
- Executes dropped EXE
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5064

C:\Temp\wtrljdbvtg.sys
C:\Temp\wtrljdbvtg.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\dbytqoigay.sys
C:\Temp\dbytqoigay.sys
1⤵
- Executes dropped EXE
PID:4368

C:\Temp\aysqkidavs.sys
C:\Temp\aysqkidavs.sys
1⤵
- Executes dropped EXE
PID:3376

C:\Temp\pnhfaxvpnh.sys
C:\Temp\pnhfaxvpnh.sys
1⤵
- Executes dropped EXE
PID:1264

C:\Temp\rpkhcausmk.sys
C:\Temp\rpkhcausmk.sys
1⤵
- Executes dropped EXE
PID:1200

C:\Temp\heczusmkec.sys
C:\Temp\heczusmkec.sys
1⤵
- Executes dropped EXE
PID:2100

C:\Temp\gecwuomjec.sys
C:\Temp\gecwuomjec.sys
1⤵
- Executes dropped EXE
PID:3848

C:\Temp\geywqojgby.sys
C:\Temp\geywqojgby.sys
1⤵
- Executes dropped EXE
PID:5136

C:\Temp\tolgdywqoi.sys
C:\Temp\tolgdywqoi.sys
1⤵
- Executes dropped EXE
PID:1252

C:\Temp\vtqoigaytq.sys
C:\Temp\vtqoigaytq.sys
1⤵
- Executes dropped EXE
PID:1064

C:\Temp\gdyvtnlfdy.sys
C:\Temp\gdyvtnlfdy.sys
1⤵
PID:5456

C:\Temp\ifaxvpnifd.sys
C:\Temp\ifaxvpnifd.sys
1⤵
PID:1804

C:\Temp\iusnkhfzxv.sys
C:\Temp\iusnkhfzxv.sys
1⤵
PID:2808

C:\Temp\mkecxupnhf.sys
C:\Temp\mkecxupnhf.sys
1⤵
PID:2352

C:\Temp\hczusmjebz.sys
C:\Temp\hczusmjebz.sys
1⤵
PID:3740

C:\Temp\jheywrljeb.sys
C:\Temp\jheywrljeb.sys
1⤵
PID:2660

C:\Temp\gebztrljdb.sys
C:\Temp\gebztrljdb.sys
1⤵
PID:1704

C:\Temp\igeywqolgd.sys
C:\Temp\igeywqolgd.sys
1⤵
PID:3152

C:\Temp\nifdyvqolj.sys
C:\Temp\nifdyvqolj.sys
1⤵
PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkidavs.sys

Path C:\Temp\aysqkidavs.sys
Size 293KB
SHA256 6132e856b6916c603d63dfd4d4da68db001161a5ed82f872d67953b9054632a2
MD5 ff9ad0a6e1962b1cfd9ee915e2c48603
SHA1 a37fd8ace9e45896f718613acee58dc9efdac81f
SHA512 8477f35411b2efca5a11524d8ab127a7737d866e17c8696e8566951ba8f2d29d35760979d9c746a6cdfadda661f69165423a7011afd935d05f5cb57ebc855502
SSDEEP 3072:btKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:bIJjiJcbI03GBc3ucY5DCSj
TLSH
T180545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywrojgbztrljebw.exe

Path C:\Temp\bywrojgbztrljebw.exe
Size 384KB
SHA256 e41c59bad629055f3c412257418339557139d1d11f2d0ddb47ea0e6f1d38ddd8
MD5 69da2920a4673ce4b9c2ffb9e42e1a35
SHA1 6280f6a5c169c2afc51e3ae8b7c623719c1c64d5
SHA512 4e8467417c5408cff2e9dd863e434d6964e17f62248b557b7c4072f0161a7878e5fa84216c3c0f475847b3e5321267065f19beeebf9db52eebeda294dbdffa4c
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bywrojgbztrljebw.sys

Path C:\Temp\bywrojgbztrljebw.sys
Size 293KB
SHA256 9ed26a2389c32a5f17b601122870d985b3b2426be78a2b034a9b7685f6595403
MD5 48a90ce28e3bfbfa986c03bf4c927899
SHA1 321d0f901c664481eb265bb3f4fcdfc30f9b036b
SHA512 3b97b3d878542e3bf4d9f40da6798b6d957136e6fc2145b7789cc07c1ef960058859882018fa234a4c896596234ed0df64a4fcf3d40ae96718eaa75d27ea8eeb
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T1B0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbytqoigay.sys

Path C:\Temp\dbytqoigay.sys
Size 293KB
SHA256 df78aa50a1f4f4fef6082a622d790ffc7930e630f30a0ed43b498b8dd547e280
MD5 191da50d9b49ff4223eabf2884726eed
SHA1 6b60ce0bb2da96d811b175fc0178ac592614f2ed
SHA512 c0c9a34ae0e639565751c68274243c194ae914a13d637ced7c2e935bd5c62d16355b00c78616e964566a09bff3363bb4fafb8ef915f955c717b7b8abf2ce7a59
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T1AB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dywqoigdyw.exe

Path C:\Temp\dywqoigdyw.exe
Size 384KB
SHA256 dda9f4ef1be2a74456c7539b84455544cdf5efafc29ab774d2e0a7e35653ae88
MD5 f09d13cda9d4da0a441603611fc36602
SHA1 8b1f930f2239553b8fecba20fc6675a83d0b325e
SHA512 74864150c40ee7d824683f0799018d55a477679041ddb5af368189d54999178a48805e63fa956ef96d65c92a973215cafe011f6f1972db49255990cd7e495df4
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcxvpnhfcx.exe

Path C:\Temp\fcxvpnhfcx.exe
Size 384KB
SHA256 9c48f30589b5f84ef6c821aed5265de6feeab675cfec0d6ae44b792d8b10778b
MD5 36485e0146d9b64ded21b275df1bf635
SHA1 ade9046be3f0fa840d943cf04566706821e090fc
SHA512 0733e76a17f428e95371454690618c63614d3e2c12e5b33a97ee2c3bedeb2ad601c9c5fce9f9b621a2ddfbf2ff4f86f5dc97d403e2e0eef6680f56daa526339c
SSDEEP 3072:f9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywrojgbz.exe

Path C:\Temp\geywrojgbz.exe
Size 384KB
SHA256 8953b1031bbc53d94511918f4edc96d1987b217ddad8a34ffa8eb4f436e2f136
MD5 39914983ff7ce5ad824ccc89887e661a
SHA1 70a20a700b1784ea697904deb44dc8ee07f4c7cb
SHA512 b4992512b213ee599855fe2efa258f6aba92597e5d9c6fd3cfef51e2d3c8660fe75e5a7f81dac6f048cbf704d0f4244726c027b6f3f4bb9674c280967e53bdcf
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hecxupmhec.exe

Path C:\Temp\hecxupmhec.exe
Size 384KB
SHA256 9bdb2db9328a59380d8abef3b3ee322350997bf57ed6a9eba96c82961961e1b7
MD5 6866e9734bc7bbe9f83ccf82fe9fd1f7
SHA1 112d961368915fb815b946b6458c3a80c7d5089c
SHA512 fa6eff11287443b051484b80548ec1bc7cf05b4e315358d32b31e7a762e7c9f6ebfc1aa47da3cd070fd96096657ad6baf44e2ee3584d97bb99397fec4c8ecf41
SSDEEP 3072:99ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:PctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1FE847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dywqoigdyw.exe

Path C:\Temp\i_dywqoigdyw.exe
Size 384KB
SHA256 e1ee56723357d9b56aa91d0682f9cf1d6d886bfab4c658012b961fb7df99dfbc
MD5 e0a609707be718a44403a2344d6ac344
SHA1 fe1ec9b53ce4bb45ba37b5ac9d5e52180bdeef67
SHA512 0bd5f01d589e79f2af0b70d9513f7cab2c3e3043892580769bb6a2e1034c8ad677109ed0f72a05fd68903d2748eec80b9a71f413d917596b53fb01698a5ba38e
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_fcxvpnhfcx.exe

Path C:\Temp\i_fcxvpnhfcx.exe
Size 384KB
SHA256 38e5723727d81baa54213ec89a4ac9b33c1c2933bba71e3c03a825ae2ddc46fd
MD5 2142a8e85d116131e17d4805876d617d
SHA1 97fc133cd6f7b4d274dc6e4322c463a543108168
SHA512 26cf8db0206fcad48df90182b61e08ed79a4c47b687098d7497d2636d0c70a3f4918b2e8637c664a02cd4189a355fd0bdef7dc5cf24b8d1ed1156f3c4ab8a889
SSDEEP 3072:79ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:pctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T197847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_geywrojgbz.exe

Path C:\Temp\i_geywrojgbz.exe
Size 384KB
SHA256 16375acc6db4d2dc801d887a58bcba5f0a311ca16ca0bed87ff6caf8030601aa
MD5 72c929f19ef5f4585dcac9c90379de87
SHA1 dc0ced6f65e2125abac0140f4254eefecca95e09
SHA512 df7e83db79932f35a9fa845c9ab0f0f45283092614bbd3b3454a4c06ce9eba8435a4d9c95b6481d4ac9bef137757df0b3d38e14a26969642c60d5e3d7971a1bf
SSDEEP 3072:R9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:bctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14B847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qoigaysqli.exe

Path C:\Temp\i_qoigaysqli.exe
Size 384KB
SHA256 f62d97f837788531c999f468ed1fdee9aa3b078cba4be5e39a5795219aee28fc
MD5 6e8d98513dd12dab8a43184f87ca5f4c
SHA1 872e5b7f30778d244ba9b3a2c6fdc85912c98058
SHA512 93a0d18e5389dff84f0f0fccd34311a97c7be29e354d6aec85629f539b82e437f8511898fa0145a2d8e75ada9de131c401414c2030c986d099f32839ed71b8e8
SSDEEP 3072:p9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:DctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11B846A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkidavtnl.exe

Path C:\Temp\i_sqkidavtnl.exe
Size 384KB
SHA256 540926f0c2605757027e3d24616969b6a80ff121d2596441e4a4d158521d4069
MD5 7f85c3227d9995ddfc10abced330ce93
SHA1 2f5b1b11c25b12dddf6ac61dbab043ea721dd355
SHA512 5626d491216ae7dfbc6cc8522b91ae29be196634e36d3dde25cd018b891e70be33b64da1eadd2ed81f1ee7f8106be09bc4c15721296368b36f68985c91b11af6
SSDEEP 3072:b9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:JctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pnhfaxvpnh.sys

Path C:\Temp\pnhfaxvpnh.sys
Size 293KB
SHA256 f0db1105e45378ca7d843c4f886050b4b7e6e9dca10b759fa6893ed4b9a10b2e
MD5 a314e0da91c6589fa4a28826821d2bad
SHA1 0ed54891aabafefdc27a17ec6ca28bba3d6541a0
SHA512 1affedc0b136780b5f7d924367c1448e7212241cfecfe1fba460720df4a2744f30b7d732b5c866b8891d4a9f9a1a93bf784a78d1138a3aa5105162698a73cd57
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T1E1545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qoigaysqli.exe

Path C:\Temp\qoigaysqli.exe
Size 384KB
SHA256 fa55dd7ddc41757f3f36bb4ec17edaaa3b0d8a4e34da9e4dd47a207510c931e6
MD5 e2ed0ed35b952eb9991d3b5bff8020ee
SHA1 4b998e5302452bbd7a614ee260fadbdb9ba0617b
SHA512 b3e4dc1b9e734525de356482521689e4ba2c567c98ea65aa008cbcdf26e8540a701b30ebb07115592fb766ba5c0720d05ac590def6fbd7d8bdbb0e8ee09028a7
SSDEEP 3072:G9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:0ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T185847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rpkhcausmk.sys

Path C:\Temp\rpkhcausmk.sys
Size 293KB
SHA256 03b5ed04b1d6f5c4944520f57428e376cca98dbde2dcbf6ea7d48ffb08471391
MD5 aba313cfdaefb973457ffffe9d74c851
SHA1 cd69c49660af69fc7b48f990a169c711d4e58211
SHA512 0f770a604ca198dc43fa94fb17788a759cba84cf1e828963e321aeb0b887b69d098b9a7082afa8dc8ca660798d322beaa0c59389e0280a9533897513b7f1af1e
SSDEEP 3072:KtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:KIJjiJcbI03GBc3ucY5DCSj
TLSH
T130545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkidavtnl.exe

Path C:\Temp\sqkidavtnl.exe
Size 384KB
SHA256 18e721e28c6e7a1f1f839241857c9991416e7ec754621f128ef79a01e0448f27
MD5 a4d9c75e42a87ad14d77703591cb0242
SHA1 dafc062f2c8ab632cf3e885d3bfb335d57b34dec
SHA512 00a484440ab127a1533f6e9d1533c2d0f04a17d53b1497bc2139ae450fb04d0c9c3c3f9ac8cd7104d4204149610dde27735e397bfef8de64c258283ceebd171a
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T198847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wtrljdbvtg.sys

Path C:\Temp\wtrljdbvtg.sys
Size 293KB
SHA256 489897bde6af0484f9d8523452ae28bb3e85ed244b4b24a247e1257689672d95
MD5 7ba244dbf605f276139cc8f1a316b934
SHA1 ef7a4e03ef3b62cb66514184507eec67be1bed80
SHA512 e879167d762678787f8cd5889bdb66f71ba97ee174e103e9e80bd36d1769fb508f0817063b13188f4d9465bf797032e34db41a2986193996b09bedc29b1a96ea
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T10C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 90e9195a671965c25b1f99c9ebaa1afc0c287ccfc26f9a7f1af96890890b2dac
MD5 741ff51d05e55808130ef2b8e277311c
SHA1 8a120bb2bb080bc11c09c32775ba9c2c9bb428bf
SHA512 745908f24de4c71cbcb2568ddc9c21da68d607248de923830f58b1f74aeb84b31dff0652022667637b55dea27012841696e86e6cef6eaa30c9581df2dbcd43a6
TLSH
T11D513B20A32015D2EF210DBBA0F1879933F6EB89C1EB7FA0508D2C785906F34A3E0067
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

370d70f6-d38a-43b9-84b4-59e09b9245c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\370d70f6-d38a-43b9-84b4-59e09b9245c0.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bbdc5f724f636f38e84d2d1151814caa917f6f758a0b31eb9008615975a421fe
MD5 51d3b071bbec23f153cfac0f414af42d
SHA1 527490f1a720438b5196ec49dc9ef6333fb895f4
SHA512 29bef9f7d573573fe4627b56eb2184324521872ee1f71723e1689209b84532d79b95163a68d5d721c373bf3cbad9104db4755100f9120bcd9b028a6ec33bac2c
TLSH
T13D41BEF3C3E8866EC90156F0AA187E2BDE2D0915432C3D5AC9E4EF5BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 53c746c05045f6922e88fb2e647c99ea8d196033e172904540d532e2a0694d98
MD5 f6ad0ee156b742bdd9c95a8616c9a6ec
SHA1 d844fbd68b1c9c03ab02ab0c0803bf19095a9f43
SHA512 daaa92ed01ac057de334779a1d096d87908df1444cf06a9012af7018d3ea6a0d0f6d545e36b42d1172ab368e664dd6558a7381965d6d62003f1eb813b6ca4433
SSDEEP 192:sxRURbyM/jK1Ml8wCO/f8s/6WBbZu0ZzoA8pi/g6+WNIYD9a6STGwRIgtJ:sxRUX8O/f8sieVu0ki/5I2ST3
TLSH
T1E952FB056A24597B9CDBD20CFA557F93D6F91533A2901E44AAFCCA1C04EAAED1213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dd88219c852e65a4d5dd30faf3a0d9a28e4856548919ed677d764733c1eeef92
MD5 7bf37d649ddeed02510ae434b1102c4e
SHA1 610ee83b82480b3b21dc4f9c4b29a01fe805e4b7
SHA512 8b6d7a2af51e394688df2a533dace1079cccedc6d48c6c6487ad97ccd69f5a4790335c954a37be829ff372b0d50ca1295d56e67a6396c29670235bccc11329fe
SSDEEP 192:sxR3RbyM/jK1Ml8wCO/f8sc6WBbZu0ZzoA8pi/g6+WNIYD9a6STGwRIgDOJ:sxR3X8O/f8s/eVu0ki/5I2ST2
TLSH
T13B52FB066A34597B9CDBD20CFA517F93D6F91473A2901E44AAFCDA1C04EAADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4fc92f0d8c42441fb4ced14f4f6134dc2a1d5c8d95439c9d6db7070154ee5f5c
MD5 7a80a2c8bb9260187920edc24e783c44
SHA1 41c2da64aa3016454f7e7886e6b9fd0ec3124a2f
SHA512 3a076eb6faef08c1bdbfbcb5db9bc6a87f9df33a2a0f3accac20eb3233c111e8ab426e2b174be14fc16385bc2f7e8eb0c06dc06b49ce361ebd4acb13ccae6031
SSDEEP 192:sxR3RbyM/jK1Ml8wCO/f8sc6W7bZu8ZzoA8p98/g6+WNCp+/YD9h6STGwRIgDAJ:sxR3B8O/f8s/AVu8kO/5V/LSTA
TLSH
T14262E8166A245D7B9CDBD208FA517F93D6F91573A2901E44AAFCCB0C04EAADD2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d79c3541d47e2dd1a508920e8d7b7cb85a517e2899b5e51459e075e6d7be9489
MD5 4dbd5b0f29c883e4d088c7d09bb0d78c
SHA1 cd7879392b39f117f72a9559dd506c5a3a980d7a
SHA512 6d57239b76f10b10690c3964b51e811e213df84fd0cdcbe09eb5442d5cb7181e43d7c3900dd340ff0e4f5daade87f98b454ae85f083c23a3a7f306cb649efd76
SSDEEP 192:sxR3RbyM/jK1Ml8UQpCO/f8sc6W7bZu8ZzoA8pr8/g6+WNCp+/YD9h6STGwRIgDk:sxR3BqQO/f8s/AVu8kI/5V/LSTA
TLSH
T13862D8166A24597B9CDBD209FA517F93D2F95473A2901E44AAFCCB0C04EAADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 629d6e41ad045f93478bec042538d17ad5738d1fbe13831de36197b8c42fa45f
MD5 82ac02ddaa86f3ebad7dc84f0ca072b2
SHA1 1b742235bc29ec6ee83400b647fe7376b431d2f0
SHA512 8d67258feb3518c05f59b3d64975e0bfa2384d64d91ba878cc7e5fbc483f26753f21bb0ed9e7a30e3fc2a85a5116df40bd194bed65f12756fc53ab175f6ef984
SSDEEP 768:aW5WFL7pLuL710Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVT+Hc1s6ro/lPyU:aW5WFdE710Wg/XfCfu1jas+Hysx/lT
TLSH
T1DDE2EC3B280CCB7E4F444A9CED297D9AADA801CF96DCCD5447EA840C03C6BEB56165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a05378fe20c3c441a06657999a270a08fc13df4d023f0f4fed1afee2b369d1d9
MD5 67592b652f79384c064602858d678ed7
SHA1 368f8349fa98ad5c467f137e9c00b73e53c4a141
SHA512 24973e11840fa3e6b0facf2dde047dd6e2f2a340eeea9aca16540ae20e6f191dbc8b6aa15511e4b9038ce147af7eb71be5123a183d3f128e91ac4a52bee19510
SSDEEP 96:KREDEREkEQEiEOECEYWEmE7ELgEYEYK4E9gEKEYcEYE4ErEKEQE1HE3EgEFEBE3M:CEDEREkEQEiEOECEPEmE7EUEYE8E9gE+
TLSH
T190917F41317B420039BD794889648D1AD2C2B1B7301DB5EB7BA895A74F2FE174EFD8C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4a78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4a78.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 faea4b5daba362b4b96f683afc8ed6dda7e2c16d8a7ad13b6b232666c019a161
MD5 1cb451a78c359ad8de4a31a79e21197d
SHA1 dcf61caaa16e6eacb26797ff826f334e19afe912
SHA512 b305f3a5a4840cb4a30649ed75ee720d268d2d28979a75fb5645e181393acb8aee8bd3592b9e633c63b390169a6481a68ef539c5669f6b9990b359a3faecf700
SSDEEP 384:nctNn/s3n9SA38NKTQ9WW+WZlf8hyEGPORuXPN7My2rEoajo4cdR8eHhVODjYPNO:cj+9T3Mvi0DErEnjN3Gac1FF2b9Ma
TLSH
T146F2C0346C659EB38CEAD38572433792AEF016A785C50F94DAD9BB0D05CB6EC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 cf39f4d598d683d5d2f9233f7e87c6154421d73c122ef4acd5bb703b0c9a6aaf
MD5 de48665664579814a520617f72b7b04a
SHA1 80b3acd208a99cef9fcb35f7f80b628d4638b867
SHA512 71106b071fc6ac460abde0a86b2c3eaa6b5188862dfe6f3726d1129ee295ad444cbed29745ec650d0fc086f9a9f826588d1f65f32692af3ca9b0a49f22175b04
SSDEEP 768:rrv+4UNbdS3Qmi0IrEnjN3Gac1Z4ReVH1SCz:rbsbg3HIQnjMatEH1V
TLSH
T12603CF3669A89EB38CEBE385714776037FB4125386940BE4CACD6B0D029B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dac2d8f779b325c24899b192e1998dd837634d0101d06d1ad4c6b437a3dd5822
MD5 ac7984a1bc5ac8d64e0721ba41ad2af0
SHA1 9b486de7c730ee5f147fd1462112b54a97640265
SHA512 36f4dc6b318f355ac5a55e8aaeafd9a958389cd34594b44ea962cad025887d538c7aef0a9dc9645f3a11b568b21f1f32e4d15640dac0903e31846695f36baf57
SSDEEP 384:nltNn/s3n9SA38NK6Q9WW+WZlf8hyEGPORuXPN7My2rEoajo4cdR8eHhVODjYPNO:lj+9T3dvi0DErEnjN3Gac1FF2b9Ma
TLSH
T1E2F2C0356C659EB38CEAD38572433792AEF016A785C10F94DAC9BB0D05CB6EC170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 45f9780ad0bf4becbf3cd64a671908bacc91f748e0cb70d03f3aa2db75e07f33
MD5 72f08768ad3792c045193acb2ca2229d
SHA1 953bc1ce7724ea5ceb5d0db7153443fec7294ba2
SHA512 c2b08428bec515c08405537dc7d65540baf894258f5a467a3de49c9d5dcf32523d4c6e039dbbf00ca75c4277c1de2fa7a8ef6e7ed951268bb415b0504ade40f3
SSDEEP 768:krv+4UNbdp3Dvi0DErEnjN3Gac1FF2b9MY:kbsbv3ZgQnjMaI2b+Y
TLSH
T18413C0317968DEB38CFBD245B14376837FB016A785D50BA4DAC5AB0C058B9EC270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 88f2d9377447cb07a2d320c54338687b6815077b6c780df39ff1a85d9c844790
MD5 8d1a2adbe1b274761ce79eac6a5e6a44
SHA1 4fddf68b60ac9308132c2f8c3c73b1a8a9eb9a52
SHA512 7f9c679dda9f454a29d597dba32a5e169b0406aca44704540c7dc682039cf9986417bf79f2f39dd3e60f797f0272a0fd52704fe597616d02e8d1b491dcecc82e
SSDEEP 768:CF1j+9RS3JwgdAsDRrEnjN3Gac1FF2b9Ma:39RS37dQnjMaI2b+a
TLSH
T1081317F598D78A77D8EE8783633E2E4299BCC1A3B5844994B7C46D0CCC865BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

5396531f-f622-4013-8d5a-b90151f00a1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5396531f-f622-4013-8d5a-b90151f00a1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4284_204855196\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 076a3706aa045eb2a2bc521a38949c1e24aa4deb52bcf33dca0029fe9750bb28
MD5 f8987676d7fee975de26b8ab09653d38
SHA1 6b1edaeee2cb7345923d5c432496b86ab8a0f736
SHA512 d551d9b74dcd9c3bbc42444ed1003c9ca00908090fb8da940b48a34fd34125868c99e3ba2ddcc1e686e608647d51c34659019de2e7988214909739331d1527cf
TLSH
T1DE71238357F9D5F2C2DE5BF002835604F6FB2238072330240B555596EB70A3A24B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1064-384-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1200-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1252-385-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1264-317-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1704-485-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1804-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2100-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2352-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2660-481-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2808-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3152-497-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3376-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3740-460-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3848-336-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4368-247-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-514-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5136-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5456-405-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5984-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download