systex | 342d59a82349a863a5a2f17f46bde9f116b7ce0189256eb9ae56a48a86fc0257

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260715-sd5jpsh14x
SHA256 342d59a82349a863a5a2f17f46bde9f116b7ce0189256eb9ae56a48a86fc0257
MD5 f92f7614a4da3357ecb0a6ee4ef6c592
SHA1 dead792b9f57e9cf8544af219f681359409f48db
SHA512 d4c95ed27f92046cbb51138c5eede3cf794a04d351a10c9293a0ce48c88ac104f97e84e8ebaf66ba6d3338ce71f803a83c23ea45675ffc8d63958b4a8537dfba
SSDEEP 3072:/ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EA847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5668	bvtnlgdywqoigayt.exe
4564	bvtnlgdywqoigayt.sys
4752	CreateProcess.exe
4776	ayvqolgdbv.exe
5324	CreateProcess.exe
2568	CreateProcess.exe
2520	i_ayvqolgdbv.exe
4564	vtnlfdavtn.sys
4072	CreateProcess.exe
1132	sqkfayvqni.exe
4556	CreateProcess.exe
2848	CreateProcess.exe
3240	i_sqkfayvqni.exe
3460	kfcausnkfc.sys
5428	CreateProcess.exe
5032	kicauspnkf.exe
4264	CreateProcess.exe
3096	CreateProcess.exe
2484	i_kicauspnkf.exe
4972	hfcxvpnhfa.sys
5816	CreateProcess.exe
1268	causmkfcwu.exe
4440	CreateProcess.exe
2060	CreateProcess.exe
4892	i_causmkfcwu.exe
4644	mkecxusmke.sys
1320	CreateProcess.exe
4172	mhecxupmke.exe
1888	CreateProcess.exe
5584	CreateProcess.exe
5604	i_mhecxupmke.exe
5720	ecwurmjebz.sys
4076	CreateProcess.exe
3008	ebzurmjhbz.exe
4900	CreateProcess.exe
1732	CreateProcess.exe
4552	i_ebzurmjhbz.exe
5348	geywrojhey.sys
5340	CreateProcess.exe
3800	geztrljdbw.exe
6100	CreateProcess.exe
372	CreateProcess.exe
3408	i_geztrljdbw.exe
5304	ojgbywtolj.sys
2664	CreateProcess.exe
1684	ywtrljgbyw.exe
692	CreateProcess.exe
6020	CreateProcess.exe
1944	i_ywtrljgbyw.exe
4212	lgdbvtrljd.sys
4964	CreateProcess.exe
2020	olgaytqlid.exe
4360	CreateProcess.exe
5580	CreateProcess.exe
1180	i_olgaytqlid.exe
4300	gaysqkigay.sys
5956	CreateProcess.exe
3000	aysqnigdbv.exe
5712	CreateProcess.exe
3868	CreateProcess.exe
4636	i_aysqnigdbv.exe
4760	igayvtndax.sys
948	CreateProcess.exe
5096	avsnkfdavs.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1142152004\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_74773137\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1466936909\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1182733769\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_74773137\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1466936909\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1182733769\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1182733769\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3580_1182733769\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xusnkfvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upmkecxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qkidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkfayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geztrljdbw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljgbyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_olgaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqnigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwusmkecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkfayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicauspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	olgaytqlid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xusnkfvpnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztromjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	causmkfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsnkfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicauspnkf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgbztrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhecxupmke.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qkidxvtnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdywqoigayt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ayvqolgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqnigdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsnkfdavs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upmkecxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztromjebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_causmkfcwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtolgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtolgbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ayvqolgdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzurmjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_geztrljdbw.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4396	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5752	ipconfig.exe
4960	ipconfig.exe
2152	ipconfig.exe
1320	ipconfig.exe
5096	ipconfig.exe
4388	ipconfig.exe
4960	ipconfig.exe
1668	ipconfig.exe
4624	ipconfig.exe
1160	ipconfig.exe
6064	ipconfig.exe
924	ipconfig.exe
4792	ipconfig.exe
4680	ipconfig.exe
2528	ipconfig.exe
4660	ipconfig.exe
2032	ipconfig.exe
1508	ipconfig.exe
3144	ipconfig.exe
4088	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286013028306069"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{DF2D6831-E4FD-4F04-A26E-BA94EC09E80A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe
5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
5668	bvtnlgdywqoigayt.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	i_ayvqolgdbv.exe
Token: SeDebugPrivilege	3240	i_sqkfayvqni.exe
Token: SeDebugPrivilege	2484	i_kicauspnkf.exe
Token: SeDebugPrivilege	4892	i_causmkfcwu.exe
Token: SeDebugPrivilege	5604	i_mhecxupmke.exe
Token: SeDebugPrivilege	4552	i_ebzurmjhbz.exe
Token: SeDebugPrivilege	3408	i_geztrljdbw.exe
Token: SeDebugPrivilege	1944	i_ywtrljgbyw.exe
Token: SeDebugPrivilege	1180	i_olgaytqlid.exe
Token: SeDebugPrivilege	4636	i_aysqnigdbv.exe
Token: SeDebugPrivilege	2520	i_avsnkfdavs.exe
Token: SeDebugPrivilege	4944	i_xusnkfvpnh.exe
Token: SeDebugPrivilege	3364	i_upmkecxusm.exe
Token: SeDebugPrivilege	5016	i_ecwusmkecw.exe
Token: SeDebugPrivilege	1160	i_bztromjebz.exe
Token: SeDebugPrivilege	5308	i_ojgbztrlje.exe
Token: SeDebugPrivilege	1448	i_dbvtolgbyt.exe
Token: SeDebugPrivilege	1076	i_vtnlgdbvtn.exe
Token: SeDebugPrivilege	1968	i_qkidxvtnlf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3580	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5892 wrote to memory of 5668	5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	88
PID 5892 wrote to memory of 2688	5892	2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 2688 wrote to memory of 3580	2688	iexplore.exe	90
PID 3580 wrote to memory of 4876	3580	msedge.exe	91
PID 3580 wrote to memory of 4416	3580	msedge.exe	93
PID 3580 wrote to memory of 4396	3580	msedge.exe	94
PID 3580 wrote to memory of 4416	3580	msedge.exe	93
PID 3580 wrote to memory of 4416	3580	msedge.exe	93
PID 3580 wrote to memory of 3616	3580	msedge.exe	95
PID 3580 wrote to memory of 3616	3580	msedge.exe	95
PID 3580 wrote to memory of 2284	3580	msedge.exe	96
PID 3580 wrote to memory of 2284	3580	msedge.exe	96
PID 3580 wrote to memory of 2284	3580	msedge.exe	96
PID 3580 wrote to memory of 1408	3580	msedge.exe	97
PID 3580 wrote to memory of 1408	3580	msedge.exe	97
PID 3580 wrote to memory of 1408	3580	msedge.exe	97
PID 3580 wrote to memory of 4712	3580	msedge.exe	98
PID 3580 wrote to memory of 4712	3580	msedge.exe	98
PID 3580 wrote to memory of 4712	3580	msedge.exe	98
PID 3580 wrote to memory of 244	3580	msedge.exe	99
PID 3580 wrote to memory of 244	3580	msedge.exe	99
PID 3580 wrote to memory of 244	3580	msedge.exe	99
PID 3580 wrote to memory of 3472	3580	msedge.exe	101
PID 3580 wrote to memory of 3472	3580	msedge.exe	101
PID 5668 wrote to memory of 4752	5668	bvtnlgdywqoigayt.exe	104
PID 3580 wrote to memory of 4144	3580	msedge.exe	106
PID 3580 wrote to memory of 4144	3580	msedge.exe	106
PID 3580 wrote to memory of 3936	3580	msedge.exe	107
PID 3580 wrote to memory of 3936	3580	msedge.exe	107
PID 4776 wrote to memory of 5324	4776	ayvqolgdbv.exe	109
PID 3580 wrote to memory of 5292	3580	msedge.exe	113
PID 3580 wrote to memory of 628	3580	msedge.exe	114
PID 3580 wrote to memory of 628	3580	msedge.exe	114
PID 3580 wrote to memory of 4280	3580	msedge.exe	115
PID 3580 wrote to memory of 4280	3580	msedge.exe	115
PID 5668 wrote to memory of 2568	5668	bvtnlgdywqoigayt.exe	118
PID 5668 wrote to memory of 4072	5668	bvtnlgdywqoigayt.exe	122
PID 1132 wrote to memory of 4556	1132	sqkfayvqni.exe	124
PID 5668 wrote to memory of 2848	5668	bvtnlgdywqoigayt.exe	127
PID 5668 wrote to memory of 5428	5668	bvtnlgdywqoigayt.exe	131
PID 5032 wrote to memory of 4264	5032	kicauspnkf.exe	133
PID 5668 wrote to memory of 3096	5668	bvtnlgdywqoigayt.exe	136
PID 5668 wrote to memory of 5816	5668	bvtnlgdywqoigayt.exe	140
PID 1268 wrote to memory of 4440	1268	causmkfcwu.exe	143
PID 5668 wrote to memory of 2060	5668	bvtnlgdywqoigayt.exe	146
PID 3580 wrote to memory of 6108	3580	msedge.exe	148
PID 3580 wrote to memory of 5752	3580	msedge.exe	149
PID 3580 wrote to memory of 4648	3580	msedge.exe	150
PID 5668 wrote to memory of 1320	5668	bvtnlgdywqoigayt.exe	153
PID 4172 wrote to memory of 1888	4172	mhecxupmke.exe	155
PID 5668 wrote to memory of 5584	5668	bvtnlgdywqoigayt.exe	158
PID 5668 wrote to memory of 4076	5668	bvtnlgdywqoigayt.exe	162
PID 3008 wrote to memory of 4900	3008	ebzurmjhbz.exe	164
PID 5668 wrote to memory of 1732	5668	bvtnlgdywqoigayt.exe	167
PID 5668 wrote to memory of 5340	5668	bvtnlgdywqoigayt.exe	171
PID 3800 wrote to memory of 6100	3800	geztrljdbw.exe	173
PID 5668 wrote to memory of 372	5668	bvtnlgdywqoigayt.exe	176
PID 5668 wrote to memory of 2664	5668	bvtnlgdywqoigayt.exe	180
PID 1684 wrote to memory of 692	1684	ywtrljgbyw.exe	182
PID 5668 wrote to memory of 6020	5668	bvtnlgdywqoigayt.exe	185
PID 3580 wrote to memory of 3304	3580	msedge.exe	187
PID 3580 wrote to memory of 3304	3580	msedge.exe	187
PID 5668 wrote to memory of 4964	5668	bvtnlgdywqoigayt.exe	193
PID 2020 wrote to memory of 4360	2020	olgaytqlid.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_f92f7614a4da3357ecb0a6ee4ef6c592_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5892
- C:\Temp\bvtnlgdywqoigayt.exe
  C:\Temp\bvtnlgdywqoigayt.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ayvqolgdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4752
  - - C:\Temp\ayvqolgdbv.exe
      C:\Temp\ayvqolgdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4776
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5324
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ayvqolgdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2568
  - - C:\Temp\i_ayvqolgdbv.exe
      C:\Temp\i_ayvqolgdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkfayvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4072
  - - C:\Temp\sqkfayvqni.exe
      C:\Temp\sqkfayvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4556
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1320
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkfayvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2848
  - - C:\Temp\i_sqkfayvqni.exe
      C:\Temp\i_sqkfayvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3240
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicauspnkf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5428
  - - C:\Temp\kicauspnkf.exe
      C:\Temp\kicauspnkf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicauspnkf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3096
  - - C:\Temp\i_kicauspnkf.exe
      C:\Temp\i_kicauspnkf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\causmkfcwu.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5816
  - - C:\Temp\causmkfcwu.exe
      C:\Temp\causmkfcwu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1268
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5096
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_causmkfcwu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2060
  - - C:\Temp\i_causmkfcwu.exe
      C:\Temp\i_causmkfcwu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhecxupmke.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1320
  - - C:\Temp\mhecxupmke.exe
      C:\Temp\mhecxupmke.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhecxupmke.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\i_mhecxupmke.exe
      C:\Temp\i_mhecxupmke.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebzurmjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4076
  - - C:\Temp\ebzurmjhbz.exe
      C:\Temp\ebzurmjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebzurmjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1732
  - - C:\Temp\i_ebzurmjhbz.exe
      C:\Temp\i_ebzurmjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4552
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\geztrljdbw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5340
  - - C:\Temp\geztrljdbw.exe
      C:\Temp\geztrljdbw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3800
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4088
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_geztrljdbw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:372
  - - C:\Temp\i_geztrljdbw.exe
      C:\Temp\i_geztrljdbw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrljgbyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\ywtrljgbyw.exe
      C:\Temp\ywtrljgbyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrljgbyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6020
  - - C:\Temp\i_ywtrljgbyw.exe
      C:\Temp\i_ywtrljgbyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\olgaytqlid.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4964
  - - C:\Temp\olgaytqlid.exe
      C:\Temp\olgaytqlid.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4360
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4792
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_olgaytqlid.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5580
  - - C:\Temp\i_olgaytqlid.exe
      C:\Temp\i_olgaytqlid.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1180
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqnigdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5956
  - - C:\Temp\aysqnigdbv.exe
      C:\Temp\aysqnigdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5712
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqnigdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3868
  - - C:\Temp\i_aysqnigdbv.exe
      C:\Temp\i_aysqnigdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4636
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsnkfdavs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:948
  - - C:\Temp\avsnkfdavs.exe
      C:\Temp\avsnkfdavs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:376
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5752
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsnkfdavs.exe ups_ins
    3⤵
    PID:4232
  - - C:\Temp\i_avsnkfdavs.exe
      C:\Temp\i_avsnkfdavs.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xusnkfvpnh.exe ups_run
    3⤵
    PID:5292
  - - C:\Temp\xusnkfvpnh.exe
      C:\Temp\xusnkfvpnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4980
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2364
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xusnkfvpnh.exe ups_ins
    3⤵
    PID:2856
  - - C:\Temp\i_xusnkfvpnh.exe
      C:\Temp\i_xusnkfvpnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upmkecxusm.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\upmkecxusm.exe
      C:\Temp\upmkecxusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upmkecxusm.exe ups_ins
    3⤵
    PID:2484
  - - C:\Temp\i_upmkecxusm.exe
      C:\Temp\i_upmkecxusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwusmkecw.exe ups_run
    3⤵
    PID:4176
  - - C:\Temp\ecwusmkecw.exe
      C:\Temp\ecwusmkecw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4636
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2248
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwusmkecw.exe ups_ins
    3⤵
    PID:3016
  - - C:\Temp\i_ecwusmkecw.exe
      C:\Temp\i_ecwusmkecw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5016
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztromjebz.exe ups_run
    3⤵
    PID:4388
  - - C:\Temp\bztromjebz.exe
      C:\Temp\bztromjebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4564
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztromjebz.exe ups_ins
    3⤵
    PID:2816
  - - C:\Temp\i_bztromjebz.exe
      C:\Temp\i_bztromjebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgbztrlje.exe ups_run
    3⤵
    PID:3536
  - - C:\Temp\ojgbztrlje.exe
      C:\Temp\ojgbztrlje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4400
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgbztrlje.exe ups_ins
    3⤵
    PID:1668
  - - C:\Temp\i_ojgbztrlje.exe
      C:\Temp\i_ojgbztrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtolgbyt.exe ups_run
    3⤵
    PID:1764
  - - C:\Temp\dbvtolgbyt.exe
      C:\Temp\dbvtolgbyt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtolgbyt.exe ups_ins
    3⤵
    PID:1816
  - - C:\Temp\i_dbvtolgbyt.exe
      C:\Temp\i_dbvtolgbyt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdbvtn.exe ups_run
    3⤵
    PID:3684
  - - C:\Temp\vtnlgdbvtn.exe
      C:\Temp\vtnlgdbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2864
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdbvtn.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_vtnlgdbvtn.exe
      C:\Temp\i_vtnlgdbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1076
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qkidxvtnlf.exe ups_run
    3⤵
    PID:1072
  - - C:\Temp\qkidxvtnlf.exe
      C:\Temp\qkidxvtnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4108
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qkidxvtnlf.exe ups_ins
    3⤵
    PID:5220
  - - C:\Temp\i_qkidxvtnlf.exe
      C:\Temp\i_qkidxvtnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1968
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnlfd.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\kicausnlfd.exe
      C:\Temp\kicausnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5908
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4444
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6064
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x25c,0x7ffe4c0fc188,0x7ffe4c0fc194,0x7ffe4c0fc1a0
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,6185539545440099624,3719194069730916529,262144 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
      4⤵
      PID:4416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,9717073066517022922,16281772956444414503,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:11
      4⤵
      System Time Discovery
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,10354684547268236779,7697451328471280527,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:13
      4⤵
      PID:3616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,12984072048696440157,9079948284462267895,2097152 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,11512562825836369485,17922222387321448633,2097152 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7892060517776600535,7657775056342338191,2097152 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11059961790823982603,17282314591918621609,2097152 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:9
      4⤵
      PID:244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,11095964757701954027,2850637417042710491,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:14
      4⤵
      PID:3472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,937806240920401587,1686817111674062567,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
      4⤵
      PID:4144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,18010877197178941474,17502621862203482877,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
      4⤵
      PID:3936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8421384388397735926,16102507810643124326,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:2848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8421384388397735926,16102507810643124326,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,10887925800216262106,17234562708420225721,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,8784192533595520192,11535062597666077437,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,18265863444236228410,18187569902316529350,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,17198325151790767017,2115913405210750323,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,1002613172422477706,15377410591391300168,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:4648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,7979881596779358809,4103674731210923198,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,6460426662038407706,17779717974761077244,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
      4⤵
      PID:1312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,7847104123834467646,18029929974028898272,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
      4⤵
      PID:3652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,7217141172912650210,7914850702640023942,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,10786330659813380128,4977962247924865861,262144 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:10
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,723125895391484496,11182965010225280764,524288 --field-trial-handle=2500,i,15044840955111283087,12985065095855307189,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:4644

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5408

C:\Temp\bvtnlgdywqoigayt.sys
C:\Temp\bvtnlgdywqoigayt.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2288

C:\Temp\vtnlfdavtn.sys
C:\Temp\vtnlfdavtn.sys
1⤵
- Executes dropped EXE
PID:4564

C:\Temp\kfcausnkfc.sys
C:\Temp\kfcausnkfc.sys
1⤵
- Executes dropped EXE
PID:3460

C:\Temp\hfcxvpnhfa.sys
C:\Temp\hfcxvpnhfa.sys
1⤵
- Executes dropped EXE
PID:4972

C:\Temp\mkecxusmke.sys
C:\Temp\mkecxusmke.sys
1⤵
- Executes dropped EXE
PID:4644

C:\Temp\ecwurmjebz.sys
C:\Temp\ecwurmjebz.sys
1⤵
- Executes dropped EXE
PID:5720

C:\Temp\geywrojhey.sys
C:\Temp\geywrojhey.sys
1⤵
- Executes dropped EXE
PID:5348

C:\Temp\ojgbywtolj.sys
C:\Temp\ojgbywtolj.sys
1⤵
- Executes dropped EXE
PID:5304

C:\Temp\lgdbvtrljd.sys
C:\Temp\lgdbvtrljd.sys
1⤵
- Executes dropped EXE
PID:4212

C:\Temp\gaysqkigay.sys
C:\Temp\gaysqkigay.sys
1⤵
- Executes dropped EXE
PID:4300

C:\Temp\igayvtndax.sys
C:\Temp\igayvtndax.sys
1⤵
- Executes dropped EXE
PID:4760

C:\Temp\axspnhfdxv.sys
C:\Temp\axspnhfdxv.sys
1⤵
PID:3160

C:\Temp\uspkhczxus.sys
C:\Temp\uspkhczxus.sys
1⤵
PID:560

C:\Temp\jhezxrpjhb.sys
C:\Temp\jhezxrpjhb.sys
1⤵
PID:5912

C:\Temp\hezwrpmcwt.sys
C:\Temp\hezwrpmcwt.sys
1⤵
PID:4124

C:\Temp\rljebwuomg.sys
C:\Temp\rljebwuomg.sys
1⤵
PID:4828

C:\Temp\gbztrljdby.sys
C:\Temp\gbztrljdby.sys
1⤵
PID:4804

C:\Temp\aytqljdyvq.sys
C:\Temp\aytqljdyvq.sys
1⤵
PID:240

C:\Temp\aysqkidays.sys
C:\Temp\aysqkidays.sys
1⤵
PID:3440

C:\Temp\sqkicaxvpn.sys
C:\Temp\sqkicaxvpn.sys
1⤵
PID:1532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ayvqolgdbv.exe

Path C:\Temp\ayvqolgdbv.exe
Size 376KB
SHA256 c7c9f27ee57dfff2b9acf86a29d07bc1aec6e6abb2277b43f005350c2b448826
MD5 77c72ebdfc0dc02e55e6523bdd926483
SHA1 4caa72e811e62623f41602881c2bd3df0e6e8624
SHA512 639380a7b01292f7a623f21c1704a8d2881766f492e9682397333f2206ed0165a2ecec3615e18e10de4a0a91bf1734896f5ef1f6c81d4449d3b00fff269da567
SSDEEP 3072:KViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A5847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywqoigayt.exe

Path C:\Temp\bvtnlgdywqoigayt.exe
Size 376KB
SHA256 04472a13ea5dc080478a45aad5e6fabcc70b6383be93a1ce61289934dbd5d96a
MD5 7135ef58f94d7df61612a3370d51b510
SHA1 e421774f678a8dbd1c2ef4f2928ac49fe6dbab43
SHA512 6dcd58c2d69f6f0c6be2ea7bb019d6980a449e6eb4aafa99378d4077c92161a5ad7d0db4adf56ed6d0056f32bff23fd119562b5fe10f56ac4826aaca25fe6efa
SSDEEP 3072:SViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T174847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bvtnlgdywqoigayt.sys

Path C:\Temp\bvtnlgdywqoigayt.sys
Size 293KB
SHA256 4082f75f666a434cfa5b78c0bcd03980ad3f16bb8363b5d0b94803d269d2c566
MD5 7aa770f4668f9cad7dd9847ab43347d6
SHA1 34cca3de08c00f7fa531bf2ba57030e1054e2ebd
SHA512 9793413140225e0b9e81a99bef7f24f28234b8bb4629dd741ceec816bbab3077248f440cbe4715807cdf03af4908e43ced8fac66118764f484dfad695c1e29df
SSDEEP 3072:PtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:PIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

causmkfcwu.exe

Path C:\Temp\causmkfcwu.exe
Size 376KB
SHA256 1636a29ee33bccec87ee9da877968e2aa71b051ed5bddd2204a656b7f96f4831
MD5 c069f6e8259641d92d9fe01ba22b96e8
SHA1 67b150dfccd270ecf5e238a831a0ef9009913397
SHA512 bbd6d04ce140be221f5d0f2823fb54ff0da6a349674ba16955ca271195884896624c4edf173c7d95e1a1c03f5ba7f411dc07575436c6f191f65c49167d8f5cc8
SSDEEP 3072:IViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebzurmjhbz.exe

Path C:\Temp\ebzurmjhbz.exe
Size 376KB
SHA256 44bc24ec240603e3b6d2c5b630b4865d6fd7aa4a548e69bd0f3ab542ccd6706e
MD5 5b53253d6522524d62945cc701189c10
SHA1 c4480c3c1a8b730f062c1b4f29a9687855cd6824
SHA512 ca96d94b78454c45f62f2a106fb9914e92ca64e89b209987bd0fca8711b4ee14a12ea9b1bc79b5a7e15d1c5bb238ea586a3b704d423331674c0dd350b44c1bdc
SSDEEP 3072:5ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13F847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwurmjebz.sys

Path C:\Temp\ecwurmjebz.sys
Size 293KB
SHA256 13fd6ad22ef24edb874b139e161d05bfd4fb66f7da15ac0b2b210c3b78a1adab
MD5 361f103bdcdaf510edf1182a870961fc
SHA1 4fd433ce174336ba32da7efe0497bdbd7bbdb066
SHA512 33360ac40c98f87aff3ede4ed50307c01a468f59ae45765f1fdcfedb7b9ad41e6fdad84e13ad92120233d2e42b960fa99f1007e6ca88a1d7233a09c79841bff0
SSDEEP 3072:ltKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:lIJjiJcbI03GBc3ucY5DCSj
TLSH
T124545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfcxvpnhfa.sys

Path C:\Temp\hfcxvpnhfa.sys
Size 293KB
SHA256 801464eeb60d7d8da3d2a421dd3730afd49791ade0f9b960c5402729f5d744b8
MD5 2372ea21c4b82eb397366aa90558470b
SHA1 464619cb6e833c0a752a04b35b44d58e69ba4c81
SHA512 4a26ccf41d8299697eaee39f2294156097b0de2dff000f9c31a149e9dc97c2735be9e5f5ce22ff89910b09697b9de75ed3236b8cb00e7e87670dc036ea4152b8
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T111545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ayvqolgdbv.exe

Path C:\Temp\i_ayvqolgdbv.exe
Size 376KB
SHA256 aa4ce5d08f87d5021046a75d52b8dbcfe2b2fc4232ca0e47073a14c892b18ab3
MD5 5852823ddcf1acc60931dd8b9dac661c
SHA1 92eb6cb09a5644c75e28a604d583371a30d60ff8
SHA512 a49154bd223170002505085cb20df941ad5205716b8dff3fe2dd6cb48a255448102397b37b8f0a4d9d6f260e8ae130d765aeff131ad73f5791b5f1fc0b146ffe
SSDEEP 3072:0ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T145847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_causmkfcwu.exe

Path C:\Temp\i_causmkfcwu.exe
Size 376KB
SHA256 375cbfebf12eab4d7888ac762decd31933757b6f074df18d7b9190e81ce37384
MD5 131ba49c157e4da92b36806a1f187abb
SHA1 3f7fa2a85795960ce9165a70f9828767f02ef734
SHA512 8ec6689a23588d67a0d9ce09cc5c92c32108711ac55009ae565520c0b4657a5ec40ebd439f6c19a47bcb2be3b48cdfed7cb76dd331e40a413d290977fda41497
SSDEEP 3072:AViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_kicauspnkf.exe

Path C:\Temp\i_kicauspnkf.exe
Size 376KB
SHA256 c8eefd94c34576253aba0850d5ee59b94209636a8a599a90f9a96de486867eb8
MD5 324b9c4255ac00e24facd6d482b32383
SHA1 0c2d0d1014f0fcc6b537c66d68212aeaa2c42e5e
SHA512 940647845bed8920c8461a0c403e38e3c9d8aafa10de1d73a8bd6d1d4a4378967741c9b7423246aa88e99e2bb8097669fa691f258ebf6928d18104bc73012a49
SSDEEP 3072:fViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:fViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_mhecxupmke.exe

Path C:\Temp\i_mhecxupmke.exe
Size 376KB
SHA256 0684c55ab710fe3fe3d936370f376d5afeae40554c4df49de59f734e2f67b4bb
MD5 b34c69554ebbb683aa5d2aa08bd5e4f9
SHA1 291950ccb5214a262ae650aafa10349fcf0dba13
SHA512 5e5f7ab150a317ce5a56ec7058680f6e803a90ba3c073ed5d7cef4542faccb758c29bfbfe7aca652b9c3249131abfb1aaa2431f8f933c2e14fd76102d04fc4a7
SSDEEP 3072:hViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:hViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_sqkfayvqni.exe

Path C:\Temp\i_sqkfayvqni.exe
Size 376KB
SHA256 bbd63801fc16dd9bf6cd645a1ac6876b6961d59765c908ab018199438e797408
MD5 0d8e96f96fc69157fe57382ece6b0288
SHA1 718f7363d7c0f95bb31dac5063020cfe7fd8da0f
SHA512 e65fc0fe68126ce0a338e1f3fd35901112a84c929f1ced3512c518bdfcb5aa3a568308ccbafced632c070b9bab68ccd2ca347fb884b13892ca446359335f4002
SSDEEP 3072:bViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:bViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T134847C04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kfcausnkfc.sys

Path C:\Temp\kfcausnkfc.sys
Size 293KB
SHA256 337c1a50e3d8b818e968cad7adb67458ccc57ca9270ad5982d04880acd346406
MD5 0c8eb22e990b9b9a9a2b7379d18383e1
SHA1 09078f7c5781800e42bc662b9d0e9798e777142f
SHA512 6524ff2c6f09abcdf9ca971e03998ec9ecbaf0523ea085fa734091eaafc90b53f8ff2b413eceb3c2777ede5b55f04b54469b79a08193742ed4c3ab0e633f60a7
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T13C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicauspnkf.exe

Path C:\Temp\kicauspnkf.exe
Size 376KB
SHA256 59393e4209f2b1d36b2391d23c29d016dae1d8a60d4197b9de9c466a37d91ac1
MD5 c71a561a073ffb5f4136e5a96cd5298b
SHA1 114a04764c908acb76cda3c294308e44b60ca05a
SHA512 02c2bb166ef383736661275212fdb9bf0899d9bcc9305539dcd594b96230b7e6231b4ed89a8dc7499866e191733e9ef74d53a0faa94e56b480eb0259d1fe5296
SSDEEP 3072:YViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mhecxupmke.exe

Path C:\Temp\mhecxupmke.exe
Size 376KB
SHA256 a91cc0694fa6203e52929fc49bdca5af7f11a8851264be3f5d4e1f727dea98eb
MD5 3b3166f1151ae534f87e9d3a1645244f
SHA1 ede1937dfc6b2ea0226bc93f754768c732713948
SHA512 87b4c4e3867c45839ca0b1bd9dd6adbcd8815460f2114a2776678d16ee077a3b365a5b2fecbb5e64751ed92f0b782b644a9c8722889e45bad87a8284d4610d5e
SSDEEP 3072:+ViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+ViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mkecxusmke.sys

Path C:\Temp\mkecxusmke.sys
Size 293KB
SHA256 5cd76d1106e2c3b6b9736946eb3873bd5f34ffe565595e1ec71d9bbba950602f
MD5 9e230123601288128470e61364d22f1c
SHA1 66a115c43659d2e84492b5fa03b081a64a333b8a
SHA512 f1554726842691113ed3f3ce274f907cb146b0a3e1b75db88a36912f6020be22a3a3fb42836d402743021e58d1bb951892021f85aa35767e5cbcf1ddfc29e338
SSDEEP 3072:7tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:7IJjiJcbI03GBc3ucY5DCSj
TLSH
T163545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqkfayvqni.exe

Path C:\Temp\sqkfayvqni.exe
Size 376KB
SHA256 1c18a75816983b7d6eaf3e80afd553a5fef9c0fc0222d26611cbbd5db38f050f
MD5 46d0bdd4c72be2f6d068a971d9388c1e
SHA1 58e0f1983a235e3d26856f8635a3ee086e8b747f
SHA512 ebb1a359986d58f3837255fbd3c2ac5e90fd430dc1f8784ccd48706942e93422aae1909914eaf4940c52a3106397e14844222369e881ac565a50d04c81896005
SSDEEP 3072:OViLcu7gaMr4ymKtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:OViLcYcVIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C9847B04BAA4F0B6D995047800EBAF36967EB4281726CBC7F354CE5D9A113C3A93479F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdavtn.sys

Path C:\Temp\vtnlfdavtn.sys
Size 293KB
SHA256 c708219adc21cef1b5e4612fcb1fce84613bdab6d34bd4dde23dc492053a8a0c
MD5 e30c32fec07d1e719a1f8b4688389cc5
SHA1 2f7007af2bcbc425a0f3895fc2d759f288856a4a
SHA512 ee1616e27f5e4ca1acf180b2322796e789452c770105a3977acf4d27d71668f4b984f0ed0c1a61808ea7166d6f089079c224b33840f5a064fb00cc93d1edb4a0
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T13D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f9b05f2babc31be55b39bab160f1071c0f4eb9ea263fb720005c6d04bb77298f
MD5 8615cdad08e5bce0f7d2a292ad7bd71c
SHA1 f67fa73ad9857093980ba8a958fd3fe2f446c014
SHA512 7e6464f7a56bd9f2499ae13737ae19c8a5c235c71e353119aedf83b9cff6275049848b7604ce4584b3bc17afad803f4c37c6d18b6223ac9d0b72a10d0a2ca5d9
TLSH
T138512C1DA33614D2E3240772BDD394883FF5CC9A08075E1BA4419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e6eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59e6eb.TMP
Size 2KB
SHA256 9d62cad445df48e853aa93be40f1b82476ea7035709f307874af23457d7f1ce0
MD5 9bdd99f3c2c8a0614b1d8b9f825d56ee
SHA1 dc8ba52fb34505b5696b5747109aabbe6bb6e3ca
SHA512 3587b6539d21673153890754ddee32d10a60911fb2db5c5fd36e9a95afdd52d0ba65c5f2d07c6b2d7a00b2db814de4d5ab3e1190863eefdd844256054ac26e46
TLSH
T169511D1DA37514D6E3240772BDD394883FF5CC9A08075E1BA4419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b4a92382c6a88faf977aaf20f47d9b81f98d23f96a500db7206ddbed82accad2
MD5 acfa6f57c2f86076acb44692eb5cea63
SHA1 e43eb9d3e794cfb01d4cdf60abdac71d1c02aa93
SHA512 4d5b8add6e31b9c38f921ae28699675a0c6383d9c3d3265750fd5bf2e7c41a7d2089ec07c8c0edd0fcd83654d436ce35e3fccffac3c63391e01e13e96e213458
TLSH
T1B941CEF3C3E4866DC91196F0AA187E1BCE1D0915432C3D6AC9E4AF1B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5a9a2a5a90a8b76c3950a78c8dfe35200725289b6069e450ab829023f210b959
MD5 04b25722520116168473663bdfebc818
SHA1 ff42b3618bbc97bfe0f3d42bf49e51433fea70a8
SHA512 2f6701d7c9b48a68d864d514b0b0793be726e28975b2a8d3eb69f154c4ce8f52ed4361488bf4d83522ec352289bdf6a9039f5c5dfa2d1dbe631d63404a515fb3
SSDEEP 192:sxRqRNyM/jK1Ml8wCi/fwsCOHnZsuDqzoA8p9R/g6+WNCnX/Yn13hAGhIgtJ:sxRqd8i/fwsJHZfz3/5+/MRZ3
TLSH
T10762E7166A245D7BDCDBD20DFA55BF93D6F91563E2901E44ABFC8A0C00E6ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 769656e2a952652efea029e90829e2a326e9bd4ea6a1ab8490c7c642ff3b1036
MD5 d13773e312ef5662433b50390b862825
SHA1 cbda1ac342b995c41f2126cf098986117667c8e0
SHA512 27e0c9abaceb35c0b5c04da39eb131c316d167d0f6039cb70c4bda8937cb67ff161fdf99bfa1fcdf7cd25f3a1053dd1ffd964362ee7762efa122055aad4e6a51
SSDEEP 192:sxRBRNyM/jK1Ml8wCi/fwstOHnZsuDqzoA8p9R/g6+WNCnX/Yn13hAGhIgDEJ:sxRBd8i/fwsMHZfz3/5+/MRZ0
TLSH
T1A762E9166A245D7BDCDFD20DFA55BF93D6F91562E2901E44ABFC8A0C00E6ADC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f1238b1b4d6ac4bc5b490bf98577b7d788e06640cf639d938f6cdd81433ca205
MD5 a72b1ab647042f5e26851fb6dfaf001e
SHA1 ffecbaf74272b401ba76783af36e1ab2caca7d73
SHA512 8aa8686ef2977042d40dd8fe80adc37da0aa1fb8beae0174801a062a8df2317f66aa27603daa64fa08a22e97beda984194cabfda0166597edc327dd34dea4afe
SSDEEP 192:sxRBRNyM/jK1Ml8UQFCi/fwstOtnZsuDqzoA8prR/g6+WNCnX/Yn1HhAGhIgDqJ:sxRBdqUi/fwsMtZfz9/5+/MBZS
TLSH
T18762E9166A245D7BDCDBD209FA51BF93D6F91572A2901E44ABFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 aefd6157dd1ff155a50cc7205c048e54f059505e6495e247da15cbd4e9c87d1d
MD5 372bb03b76a7b512fab7a83acc31bcf2
SHA1 0c439dbe2b0fe68012539de9ec7a041b0f39500a
SHA512 f8d88e25104a1f4bfced352f80affed645abef3e896c42528c170a3917fd4767cf1f5a6d835d7515728d9956716a0ef0ac8c77ea15e63c22964e45af658027da
SSDEEP 768:wGedPg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsbhu4YtroSFl8w:wGedPsE7X6WgoufDMu1jafbhVYGu/
TLSH
T1CEE2FB3B680CCB7E4F844EDCEC29BE9F6DA801CB5AD8895447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 279d820a6b91afe5820f9580997258befeb8b9fac8eac15b6fde8b615c38db49
MD5 542ae7dea1c38d6a48459d247d4ed8ab
SHA1 9d0a8fbc6592a18cb5d5a0026cfc405d83f1f7bf
SHA512 3e87a9258862eb6cb7359b6938cedf980f67a37803d0aaa71b215974e69e8a92356a89eabbee3b896bcc0f67e6cf270892051b5e4ef52866363c121c3ea16e3d
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvebNSKu0+:CoZs4q26neDsgU1gC/wgziItHU1gkeCu
TLSH
T191914041313B0284387D6A1C84E8895BD7C27873746CB8AB7BE901A54F67E025EFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a87fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a87fe.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 241bc8680e31568d6330614330dcf0649ae08871bdbd9d3138c527e09ecbf5f4
MD5 45708bd9632592df9254e6bcfacd7a60
SHA1 d72566ce9f531bef0bccb6ea81a0801d2e726bfd
SHA512 ce5b1043a84833ef5f3a4c0ab8b56adf72d8a0f64930a59a8e5ea248927c71b69a79c08b15783f5ed04e1b7aad6484ba4a92ef45f8192e606ae449d0b439c50f
SSDEEP 768:bF1j+9h3iwg8rl4wZQ5O0Z/UNzc4ReyIsPmG44Z71PT:69h3jDtc44bseG44B17
TLSH
T1321306F698E78976ECAE4783A33E2D42ADFCC16774845994B7885E0CCC421BFC70A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a7642570f537a207020076114dc52cc0f24ddf1313b15e552ecf81f491b799ce
MD5 387483562d0f67554e77fc7c3f866512
SHA1 6416d6dae173fea507b61099f474b4953640d67f
SHA512 9924ffb7a88faed4fea381ba9cb68968c7be582cc30c4f3a4798d49220cbdda70b2b5ef8ecdba7c043a8d331f37ab1b9133ddea2cb0de2424c21ff03203175c6
SSDEEP 768:wj+9V3FrlIhDZIO0Z/XNzc4ReyIsPmG44Z71PT:P9V3djtc44bseG44B17
TLSH
T1CCF2CF31F9369C67ACEA9344B21B3692BDF4523784C42E94C9DC6F0C05436AD1B6F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 79c098496c963b34824cc7465670fb11c94b4716b5b55345d8ac53038d7180ac
MD5 da38215f12af949549fdec92d27f478b
SHA1 837b5785ad73b565e31196649e357051a15444cc
SHA512 34bce7d22025ff05905f5454be25b96f3489244893383ffcd2ca85430174beaec05df2796ba9579fc1374e93e99ab34d01134f50ec7056a44516e45841418862
SSDEEP 768:rj+9V3ErlIhDZIO0Z/XNzc4ReyIsPmG44Z71PT:+9V3gjtc44bseG44B17
TLSH
T149F2CF32F9369C67ACEA5344B21B3692BEF4523784C42E94C9DC6F0C05436AD1B6F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e27d625b780717e84e4c43438380f91b3f8c5ac79747427ad4017f151f4632f3
MD5 3c406a6367f653d8f07c972d7d876f6d
SHA1 c417170f3634bd47c735d9e3652bdf4f8071e506
SHA512 314afc4b773a52107198bde95bcfa2b02c934a2025e8cccfd16805a81f24c571e8fe62c49e41437599832e7f1faede7add5559603cbbae137985f5d73ded5387
SSDEEP 768:6rv+4UNbds3NkDZIO0ZaNzc4ReyIsXUeVH1S5D:6bsbS36tc44bskEH1Y
TLSH
T15503CF32E8788A37ACF66785B14B76533EF8512782C81B90C5DE6F0C4A4B5DD131B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 68291190be383ca2937485e0db9b37684ab0f6731ab4df99eb7771636fd2527f
MD5 1ccbe13ec2977161036a35595a916bc7
SHA1 3ab553f40ec1149e91432bce7a176a57aa13941a
SHA512 883072b4f60af552e6c16dc8dd12e073bace3a98e1be6290bf7a5fd1cf6859477cd2d8eea12b1df16e806a26fda87ffcea99f4950f518091cb8942667b52ccd0
SSDEEP 768:2rv+4UNbd33Tr9IhDZIO0Z/XNzc4ReyIsPmG44Z71Pe:2bsbx3/rtc44bseG44B1W
TLSH
T10C13BE32F9389C67ACEA6244B10B36937EF8122785C41F94CAD95F4C05475EE272FA27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

51f2a601-6d98-41e3-96fe-399c0dadb7cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\51f2a601-6d98-41e3-96fe-399c0dadb7cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3580_1507069353\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1b87691ed5ab75c4abf9d436635bd0d17f68c208831e9d2ee9ae477045eed34f
MD5 31ec2f343735b541960b6d273b31dd14
SHA1 7784dad6633c023812b02fee3b7a355bf014d2fd
SHA512 dfb1636c04148343d98af82882eb7ae77b4c936a3a2f37b641ead689fa2ed17308e269815093dc9611b4b54bed552284fda36bbb61e70ddfa988cdd01b87f728
TLSH
T11371278357A8D5B3C1DE9FF002835644F6FB127C0B6330240B61558BA770E3654B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-480-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/560-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/560-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1532-509-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3160-419-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3160-389-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3440-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3460-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3460-275-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4124-443-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4212-333-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4300-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4564-199-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4644-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4760-377-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4804-458-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-447-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4828-461-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4972-274-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5304-329-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5348-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5720-300-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5912-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download