systex | 89ae6e170231d9d4711a5614a21a0ef673a9c8cae012ce0eed752f4fd506e7ba

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Size 376KB
Sample260721-ehe8qafw7t
SHA256 89ae6e170231d9d4711a5614a21a0ef673a9c8cae012ce0eed752f4fd506e7ba
MD5 abffa4b0a88cf26da9f5292f8c14b7c5
SHA1 132f820f2989df044e5fc3276c1dd19fe185e2d3
SHA512 18d76dbe8e87ec49c13715874fa9d256b8542794eca9e0301dc32e74c362be07b0e18ac4450b10567569a8f70336966d0352e6ffeb2c6be2d55d30e2aa2261dd
SSDEEP 3072:5FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:5FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B3847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Extracted

Family

systex

http://xytets.com:2345/t.asp?os=wangba
http://xytets.com:2345/t.asp?os=home
http://xytets.com:2345/t.asp?ver=xxx&mac=0-0-0-0&os=vm

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4132	geywqojgbztrljge.exe
2992	geywqojgbztrljge.sys
4476	CreateProcess.exe
2480	ojgeywtomg.exe
716	CreateProcess.exe
3472	CreateProcess.exe
828	i_ojgeywtomg.exe
4964	yvtolgdbzt.sys
4904	CreateProcess.exe
3016	qligbytrlj.exe
3264	CreateProcess.exe
2660	CreateProcess.exe
992	i_qligbytrlj.exe
2652	vtnligayvq.sys
4428	CreateProcess.exe
4332	yvtnligayv.exe
4396	CreateProcess.exe
1216	CreateProcess.exe
2544	i_yvtnligayv.exe
2492	qnigaysqki.sys
5276	CreateProcess.exe
3744	qnlfdavtnl.exe
1132	CreateProcess.exe
2704	CreateProcess.exe
4060	i_qnlfdavtnl.exe
5860	ankfdxvpnh.sys
4764	CreateProcess.exe
5768	ifzxsnkfdx.exe
5920	CreateProcess.exe
2852	CreateProcess.exe
5764	i_ifzxsnkfdx.exe
4364	icausqkica.sys
2232	CreateProcess.exe
2064	xrpnkeczus.exe
5704	CreateProcess.exe
2272	CreateProcess.exe
4468	i_xrpnkeczus.exe
2656	khczxrpkhc.sys
4640	CreateProcess.exe
5928	mhezxupmhf.exe
4992	CreateProcess.exe
5032	CreateProcess.exe
4900	i_mhezxupmhf.exe
5620	mhezxrpjhc.sys
1928	CreateProcess.exe
1456	ebzxromkhb.exe
3168	CreateProcess.exe
2560	CreateProcess.exe
4208	i_ebzxromkhb.exe
5776	omjhezwjhb.sys
4980	CreateProcess.exe
2772	ebwtrljhbz.exe
4336	CreateProcess.exe
5872	CreateProcess.exe
5356	i_ebwtrljhbz.exe
2640	eywtomgebw.sys
5584	CreateProcess.exe
200	ztrlbvtolg.exe
5544	CreateProcess.exe
3292	CreateProcess.exe
2536	i_ztrlbvtolg.exe
4708	qoigaytqlj.sys
1924	CreateProcess.exe
5616	qoigbytrlj.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_509028313\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_730789313\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_173299425\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_814645740\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_730789313\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_173299425\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_814645740\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_814645740\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4320_814645740\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qligbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlfdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebzxromkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrlbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpnkeczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geywqojgbztrljge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ojgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtnligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebzxromkhb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	khfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ojgeywtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrojgayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifzxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mhezxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrlbvtolg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwuomhe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mhezxupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qligbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtnligayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlfdavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigbytrlj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifdavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_khfzxspkhc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrpjhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nkfcxvpnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrojgayvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywqnlfdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifzxsnkfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpnkeczus.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2524	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2872	ipconfig.exe
4700	ipconfig.exe
1528	ipconfig.exe
1888	ipconfig.exe
3772	ipconfig.exe
260	ipconfig.exe
3508	ipconfig.exe
2868	ipconfig.exe
2504	ipconfig.exe
2668	ipconfig.exe
5376	ipconfig.exe
2532	ipconfig.exe
4308	ipconfig.exe
4676	ipconfig.exe
3720	ipconfig.exe
1680	ipconfig.exe
4984	ipconfig.exe
2220	ipconfig.exe
5936	ipconfig.exe
260	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290797849127156"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{AE0DD134-E9DA-43B0-94CD-8027B8788C97}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe
4132	geywqojgbztrljge.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	828	i_ojgeywtomg.exe
Token: SeDebugPrivilege	992	i_qligbytrlj.exe
Token: SeDebugPrivilege	2544	i_yvtnligayv.exe
Token: SeDebugPrivilege	4060	i_qnlfdavtnl.exe
Token: SeDebugPrivilege	5764	i_ifzxsnkfdx.exe
Token: SeDebugPrivilege	4468	i_xrpnkeczus.exe
Token: SeDebugPrivilege	4900	i_mhezxupmhf.exe
Token: SeDebugPrivilege	4208	i_ebzxromkhb.exe
Token: SeDebugPrivilege	5356	i_ebwtrljhbz.exe
Token: SeDebugPrivilege	2536	i_ztrlbvtolg.exe
Token: SeDebugPrivilege	2012	i_qoigbytrlj.exe
Token: SeDebugPrivilege	6064	i_ifdavtnlfd.exe
Token: SeDebugPrivilege	3416	i_ifaysqkica.exe
Token: SeDebugPrivilege	1084	i_nkfcxvpnhf.exe
Token: SeDebugPrivilege	3648	i_khfzxspkhc.exe
Token: SeDebugPrivilege	5608	i_mkecwuomhe.exe
Token: SeDebugPrivilege	2236	i_ywtrpjhbzt.exe
Token: SeDebugPrivilege	4604	i_bwtomgeywr.exe
Token: SeDebugPrivilege	960	i_ytrojgayvt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4320	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 4132	3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	89
PID 3052 wrote to memory of 4632	3052	2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe	90
PID 4632 wrote to memory of 4320	4632	iexplore.exe	91
PID 4320 wrote to memory of 1004	4320	msedge.exe	92
PID 4320 wrote to memory of 3424	4320	msedge.exe	94
PID 4320 wrote to memory of 2524	4320	msedge.exe	95
PID 4320 wrote to memory of 3424	4320	msedge.exe	94
PID 4320 wrote to memory of 3424	4320	msedge.exe	94
PID 4320 wrote to memory of 3296	4320	msedge.exe	96
PID 4320 wrote to memory of 3296	4320	msedge.exe	96
PID 4320 wrote to memory of 1532	4320	msedge.exe	97
PID 4320 wrote to memory of 1532	4320	msedge.exe	97
PID 4320 wrote to memory of 708	4320	msedge.exe	98
PID 4320 wrote to memory of 1532	4320	msedge.exe	97
PID 4320 wrote to memory of 708	4320	msedge.exe	98
PID 4320 wrote to memory of 708	4320	msedge.exe	98
PID 4320 wrote to memory of 3384	4320	msedge.exe	99
PID 4320 wrote to memory of 3912	4320	msedge.exe	100
PID 4320 wrote to memory of 3384	4320	msedge.exe	99
PID 4320 wrote to memory of 3384	4320	msedge.exe	99
PID 4320 wrote to memory of 3912	4320	msedge.exe	100
PID 4320 wrote to memory of 3912	4320	msedge.exe	100
PID 4320 wrote to memory of 5172	4320	msedge.exe	102
PID 4320 wrote to memory of 5172	4320	msedge.exe	102
PID 4132 wrote to memory of 4476	4132	geywqojgbztrljge.exe	105
PID 4320 wrote to memory of 4856	4320	msedge.exe	108
PID 4320 wrote to memory of 3048	4320	msedge.exe	109
PID 4320 wrote to memory of 4856	4320	msedge.exe	108
PID 4320 wrote to memory of 3048	4320	msedge.exe	109
PID 2480 wrote to memory of 716	2480	ojgeywtomg.exe	110
PID 4320 wrote to memory of 4420	4320	msedge.exe	114
PID 4320 wrote to memory of 5752	4320	msedge.exe	115
PID 4320 wrote to memory of 5752	4320	msedge.exe	115
PID 4320 wrote to memory of 5176	4320	msedge.exe	116
PID 4320 wrote to memory of 5176	4320	msedge.exe	116
PID 4132 wrote to memory of 3472	4132	geywqojgbztrljge.exe	119
PID 4132 wrote to memory of 4904	4132	geywqojgbztrljge.exe	123
PID 3016 wrote to memory of 3264	3016	qligbytrlj.exe	125
PID 4132 wrote to memory of 2660	4132	geywqojgbztrljge.exe	128
PID 4132 wrote to memory of 4428	4132	geywqojgbztrljge.exe	132
PID 4332 wrote to memory of 4396	4332	yvtnligayv.exe	134
PID 4132 wrote to memory of 1216	4132	geywqojgbztrljge.exe	137
PID 4132 wrote to memory of 5276	4132	geywqojgbztrljge.exe	141
PID 3744 wrote to memory of 1132	3744	qnlfdavtnl.exe	143
PID 4132 wrote to memory of 2704	4132	geywqojgbztrljge.exe	147
PID 4320 wrote to memory of 2036	4320	msedge.exe	149
PID 4320 wrote to memory of 2452	4320	msedge.exe	150
PID 4320 wrote to memory of 3856	4320	msedge.exe	151
PID 4132 wrote to memory of 4764	4132	geywqojgbztrljge.exe	154
PID 5768 wrote to memory of 5920	5768	ifzxsnkfdx.exe	156
PID 4132 wrote to memory of 2852	4132	geywqojgbztrljge.exe	159
PID 4132 wrote to memory of 2232	4132	geywqojgbztrljge.exe	163
PID 2064 wrote to memory of 5704	2064	xrpnkeczus.exe	165
PID 4132 wrote to memory of 2272	4132	geywqojgbztrljge.exe	168
PID 4132 wrote to memory of 4640	4132	geywqojgbztrljge.exe	172
PID 5928 wrote to memory of 4992	5928	mhezxupmhf.exe	174
PID 4132 wrote to memory of 5032	4132	geywqojgbztrljge.exe	177
PID 4132 wrote to memory of 1928	4132	geywqojgbztrljge.exe	181
PID 1456 wrote to memory of 3168	1456	ebzxromkhb.exe	183
PID 4132 wrote to memory of 2560	4132	geywqojgbztrljge.exe	186
PID 4320 wrote to memory of 3364	4320	msedge.exe	188
PID 4320 wrote to memory of 3364	4320	msedge.exe	188
PID 4132 wrote to memory of 4980	4132	geywqojgbztrljge.exe	194
PID 2772 wrote to memory of 4336	2772	ebwtrljhbz.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_abffa4b0a88cf26da9f5292f8c14b7c5_amadey_darkgate_elex_rhadamanthys_smoke-loader_stealc_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Temp\geywqojgbztrljge.exe
  C:\Temp\geywqojgbztrljge.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ojgeywtomg.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4476
  - - C:\Temp\ojgeywtomg.exe
      C:\Temp\ojgeywtomg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:716
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ojgeywtomg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3472
  - - C:\Temp\i_ojgeywtomg.exe
      C:\Temp\i_ojgeywtomg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qligbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4904
  - - C:\Temp\qligbytrlj.exe
      C:\Temp\qligbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2872
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qligbytrlj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2660
  - - C:\Temp\i_qligbytrlj.exe
      C:\Temp\i_qligbytrlj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtnligayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\yvtnligayv.exe
      C:\Temp\yvtnligayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtnligayv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_yvtnligayv.exe
      C:\Temp\i_yvtnligayv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlfdavtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5276
  - - C:\Temp\qnlfdavtnl.exe
      C:\Temp\qnlfdavtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3744
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlfdavtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2704
  - - C:\Temp\i_qnlfdavtnl.exe
      C:\Temp\i_qnlfdavtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifzxsnkfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4764
  - - C:\Temp\ifzxsnkfdx.exe
      C:\Temp\ifzxsnkfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5768
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifzxsnkfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Temp\i_ifzxsnkfdx.exe
      C:\Temp\i_ifzxsnkfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpnkeczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2232
  - - C:\Temp\xrpnkeczus.exe
      C:\Temp\xrpnkeczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2064
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5376
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpnkeczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2272
  - - C:\Temp\i_xrpnkeczus.exe
      C:\Temp\i_xrpnkeczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mhezxupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4640
  - - C:\Temp\mhezxupmhf.exe
      C:\Temp\mhezxupmhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5928
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4992
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1528
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mhezxupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5032
  - - C:\Temp\i_mhezxupmhf.exe
      C:\Temp\i_mhezxupmhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4900
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebzxromkhb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1928
  - - C:\Temp\ebzxromkhb.exe
      C:\Temp\ebzxromkhb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1456
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3168
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebzxromkhb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2560
  - - C:\Temp\i_ebzxromkhb.exe
      C:\Temp\i_ebzxromkhb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4208
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtrljhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4980
  - - C:\Temp\ebwtrljhbz.exe
      C:\Temp\ebwtrljhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4336
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtrljhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5872
  - - C:\Temp\i_ebwtrljhbz.exe
      C:\Temp\i_ebwtrljhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrlbvtolg.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5584
  - - C:\Temp\ztrlbvtolg.exe
      C:\Temp\ztrlbvtolg.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:200
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrlbvtolg.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3292
  - - C:\Temp\i_ztrlbvtolg.exe
      C:\Temp\i_ztrlbvtolg.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigbytrlj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1924
  - - C:\Temp\qoigbytrlj.exe
      C:\Temp\qoigbytrlj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5616
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2040
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigbytrlj.exe ups_ins
    3⤵
    PID:1000
  - - C:\Temp\i_qoigbytrlj.exe
      C:\Temp\i_qoigbytrlj.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifdavtnlfd.exe ups_run
    3⤵
    PID:3372
  - - C:\Temp\ifdavtnlfd.exe
      C:\Temp\ifdavtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2028
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifdavtnlfd.exe ups_ins
    3⤵
    PID:3828
  - - C:\Temp\i_ifdavtnlfd.exe
      C:\Temp\i_ifdavtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6064
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifaysqkica.exe ups_run
    3⤵
    PID:1512
  - - C:\Temp\ifaysqkica.exe
      C:\Temp\ifaysqkica.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1696
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3772
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifaysqkica.exe ups_ins
    3⤵
    PID:1556
  - - C:\Temp\i_ifaysqkica.exe
      C:\Temp\i_ifaysqkica.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3416
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nkfcxvpnhf.exe ups_run
    3⤵
    PID:4784
  - - C:\Temp\nkfcxvpnhf.exe
      C:\Temp\nkfcxvpnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5936
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nkfcxvpnhf.exe ups_ins
    3⤵
    PID:4068
  - - C:\Temp\i_nkfcxvpnhf.exe
      C:\Temp\i_nkfcxvpnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\khfzxspkhc.exe ups_run
    3⤵
    PID:2400
  - - C:\Temp\khfzxspkhc.exe
      C:\Temp\khfzxspkhc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4736
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2224
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_khfzxspkhc.exe ups_ins
    3⤵
    PID:3140
  - - C:\Temp\i_khfzxspkhc.exe
      C:\Temp\i_khfzxspkhc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3648
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwuomhe.exe ups_run
    3⤵
    PID:1508
  - - C:\Temp\mkecwuomhe.exe
      C:\Temp\mkecwuomhe.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3772
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwuomhe.exe ups_ins
    3⤵
    PID:3656
  - - C:\Temp\i_mkecwuomhe.exe
      C:\Temp\i_mkecwuomhe.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrpjhbzt.exe ups_run
    3⤵
    PID:3796
  - - C:\Temp\ywtrpjhbzt.exe
      C:\Temp\ywtrpjhbzt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5940
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5728
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrpjhbzt.exe ups_ins
    3⤵
    PID:3236
  - - C:\Temp\i_ywtrpjhbzt.exe
      C:\Temp\i_ywtrpjhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtomgeywr.exe ups_run
    3⤵
    PID:3432
  - - C:\Temp\bwtomgeywr.exe
      C:\Temp\bwtomgeywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5836
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2868
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtomgeywr.exe ups_ins
    3⤵
    PID:5716
  - - C:\Temp\i_bwtomgeywr.exe
      C:\Temp\i_bwtomgeywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrojgayvt.exe ups_run
    3⤵
    PID:6064
  - - C:\Temp\ytrojgayvt.exe
      C:\Temp\ytrojgayvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:832
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5904
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrojgayvt.exe ups_ins
    3⤵
    PID:1732
  - - C:\Temp\i_ytrojgayvt.exe
      C:\Temp\i_ytrojgayvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywqnlfdyvq.exe ups_run
    3⤵
    PID:3704
  - - C:\Temp\ywqnlfdyvq.exe
      C:\Temp\ywqnlfdyvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5800
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:260
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffbb06ec188,0x7ffbb06ec194,0x7ffbb06ec1a0
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8329539128533047698,10322156986190030567,262144 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
      4⤵
      PID:3424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,14269197506162694521,1349053302232873132,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:11
      4⤵
      System Time Discovery
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2680,i,8830074391150031643,17094111611184842226,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:13
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12202791966229384540,888464557146817550,2097152 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:1532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,15513182379251873708,14414513601238730777,2097152 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,17091747954849854988,1886756340060317835,2097152 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:9
      4⤵
      PID:3384
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,8578433315765804983,12814043470358966157,2097152 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,9781156108965468648,1652930319271750718,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:5172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,2184579996083339187,16915618579615197228,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
      4⤵
      PID:4856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,9042178602252984349,8015117561993217054,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
      4⤵
      PID:3048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221528629000845997,1087424186571958193,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,13221528629000845997,1087424186571958193,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,17263626598435233259,16867544453730222891,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:5752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,16873681465326931732,206400823058674712,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
      4⤵
      PID:5176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,16154655908877352334,17933049555038343663,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
      4⤵
      PID:2036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,18322564398531531627,2649231089075927129,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=1500 /prefetch:14
      4⤵
      PID:2452
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,4227601522424671385,1358932103485941129,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:3856
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1580,i,9759531947196921041,6158139293067109990,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,17135966152269358558,9916990043451731768,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      PID:2692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=924,i,703307998206264118,9444889368779454698,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7007844320193813068,3621928782906366679,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=924 /prefetch:14
      4⤵
      PID:2776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5644,i,17459813950077469637,4356574649215677776,262144 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:10
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6338528566594425820,571787988140394051,524288 --field-trial-handle=2544,i,15981080897983545280,4870101425340992853,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
      4⤵
      PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2504

C:\Temp\geywqojgbztrljge.sys
C:\Temp\geywqojgbztrljge.sys
1⤵
- Executes dropped EXE
PID:2992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3676

C:\Temp\yvtolgdbzt.sys
C:\Temp\yvtolgdbzt.sys
1⤵
- Executes dropped EXE
PID:4964

C:\Temp\vtnligayvq.sys
C:\Temp\vtnligayvq.sys
1⤵
- Executes dropped EXE
PID:2652

C:\Temp\qnigaysqki.sys
C:\Temp\qnigaysqki.sys
1⤵
- Executes dropped EXE
PID:2492

C:\Temp\ankfdxvpnh.sys
C:\Temp\ankfdxvpnh.sys
1⤵
- Executes dropped EXE
PID:5860

C:\Temp\icausqkica.sys
C:\Temp\icausqkica.sys
1⤵
- Executes dropped EXE
PID:4364

C:\Temp\khczxrpkhc.sys
C:\Temp\khczxrpkhc.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Temp\mhezxrpjhc.sys
C:\Temp\mhezxrpjhc.sys
1⤵
- Executes dropped EXE
PID:5620

C:\Temp\omjhezwjhb.sys
C:\Temp\omjhezwjhb.sys
1⤵
- Executes dropped EXE
PID:5776

C:\Temp\eywtomgebw.sys
C:\Temp\eywtomgebw.sys
1⤵
- Executes dropped EXE
PID:2640

C:\Temp\qoigaytqlj.sys
C:\Temp\qoigaytqlj.sys
1⤵
- Executes dropped EXE
PID:4708

C:\Temp\lfdbvtnlfd.sys
C:\Temp\lfdbvtnlfd.sys
1⤵
PID:1136

C:\Temp\tqnifdxvsq.sys
C:\Temp\tqnifdxvsq.sys
1⤵
PID:4900

C:\Temp\pnkfdxvpnh.sys
C:\Temp\pnkfdxvpnh.sys
1⤵
PID:4228

C:\Temp\kecxupmkic.sys
C:\Temp\kecxupmkic.sys
1⤵
PID:2088

C:\Temp\kecwupmhec.sys
C:\Temp\kecwupmhec.sys
1⤵
PID:1432

C:\Temp\jhbzurpjhe.sys
C:\Temp\jhbzurpjhe.sys
1⤵
PID:4944

C:\Temp\bzwrojhbzt.sys
C:\Temp\bzwrojhbzt.sys
1⤵
PID:1436

C:\Temp\vtolgdbztq.sys
C:\Temp\vtolgdbztq.sys
1⤵
PID:2292

C:\Temp\yvtqoigdbv.sys
C:\Temp\yvtqoigdbv.sys
1⤵
PID:5012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ankfdxvpnh.sys

Path C:\Temp\ankfdxvpnh.sys
Size 293KB
SHA256 22865811663e1b3e332902522f2fc8783a967e25a0722c2c18dedbbcaece8b5f
MD5 ff677bd59e479d21de94058ff23807d9
SHA1 52dbb670da85cccdfd44f415123b8ddf935c5058
SHA512 0a5285e0ec7472bd1befe71e3536775e5b54ec9916c86c4bb1475c0f3faac6e4edd7e8e7274c6bf0b800cae33331cdeb17d128efc172276cf35a7760719ca5b4
SSDEEP 3072:0tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:0IJjiJcbI03GBc3ucY5DCSj
TLSH
T195545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbztrljge.exe

Path C:\Temp\geywqojgbztrljge.exe
Size 376KB
SHA256 61d9c9b6db90d8e4f53cb1dea0a52518da8de23c1d0e08c34fcf3e1814e1d27f
MD5 c175fefa867eb96882c93c679adf5e8c
SHA1 cc9c1acab2a2e5f524701d4cd02be7b7d13e9337
SHA512 5b3e4700c785e96e1185f037b84d308d48c13fb908a9e03aeee92ceca20ee3fe4df0d4e16e23109f3d32dc3861be1935f420ca56f6a887dcdabc27311134ea11
SSDEEP 3072:lFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:lFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B9847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geywqojgbztrljge.sys

Path C:\Temp\geywqojgbztrljge.sys
Size 293KB
SHA256 11b3ce9ef8e1f95cda2293575aef8c79dbe537865929186b59785288f3585aad
MD5 5ba13b1130869c300bd5fbd8faa486d6
SHA1 9723dfd4640421c3215166093d86825ab3683be7
SHA512 70546358ed5b9317d753a1f2db6440d98d7c2d4c155c53ca529df5b6f2b41c8ed0ba6c1080b0fb4d4a57c03a9043dd541084b79742d0ffb82d91bdc73a0f0235
SSDEEP 3072:/tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:/IJjiJcbI03GBc3ucY5DCSj
TLSH
T1D7545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ifzxsnkfdx.exe

Path C:\Temp\i_ifzxsnkfdx.exe
Size 376KB
SHA256 47c239b7d944281f38dc660a691810068dcc7abd23e074cd6fbde3e9e1e65d95
MD5 4de557a3ce3ec6323a9c5cdbd4ddd8c4
SHA1 5a19266a90e7e45db68e093ad7646850817ba4de
SHA512 b3bc119c77af478d876560d0f618fbe8b12f7b4e523b95024cdfb60528890ec508c2a296bbe11081df3886514af234b4dbb5cfffac05b450a877f824cd6ac32b
SSDEEP 3072:YFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19C847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ojgeywtomg.exe

Path C:\Temp\i_ojgeywtomg.exe
Size 376KB
SHA256 711fcf0cff50293e630690f7f007e1bf5211ed84f5f9f2d42ba84639e82c6fe7
MD5 ece0cdead52bc7831d93956980c3a784
SHA1 1604e7b81f87db8cd235fade4b7dbe7bddf45163
SHA512 4ee7e1adfa7617d83650891487d8c6ffe64ab8f3721ff1c368c5850d033ff1de0fe0a87addd5f8c99588e1066cd7c356cb0934630ba38354cce4c1e9f357b5ef
SSDEEP 3072:cFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:cFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qligbytrlj.exe

Path C:\Temp\i_qligbytrlj.exe
Size 376KB
SHA256 be224eab3de492101d2767d4e24fdccaa016c0eb768da888212023b1608a17a0
MD5 71aa91f5ae55f07f96cf43d0f04e5360
SHA1 de686ffab2b4ea7018a8d918caa3456de5d3ddea
SHA512 d56e817c93b3b8c74a16c8e3092607ce6a2974ac9f651b268cd27fb9cf5c86be997b6c6df7706863451b65d8fac197dee406855f09af23f7590a57b1266cd5fc
SSDEEP 3072:IFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:IFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T13D847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnlfdavtnl.exe

Path C:\Temp\i_qnlfdavtnl.exe
Size 376KB
SHA256 cfb5c8c6b2b7bd9147b9efb31d866fd0f44adc726a6c9495a6384bd29333ff1f
MD5 37e4c49f72bf40e0b76190d3ba407f99
SHA1 61587bcae65ce2ea011d47ea9dcfe5ebb2971924
SHA512 5f2e9802a9c219a5375edf28831b60a9533a041b268b2ce6fa92f501dc7dba0aad22ed7310a6162f9831ba57f43fc3b069f35bea83c56c09d6e66ba93cbbce1a
SSDEEP 3072:DFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T165847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvtnligayv.exe

Path C:\Temp\i_yvtnligayv.exe
Size 376KB
SHA256 f09cd53fe6106ab4698e413b94253acc27a3339b538fccb254531cc3bf283944
MD5 9fd159525a4b82306fc486de91642477
SHA1 85958ca64d1c012e732efe150cba8b4aac4031af
SHA512 6ff4a3852b0f4e67146a8b45bf3d9344700493be88179fe56ef018c80d8101af80e2ac500b0e40dcb8c3edf5ba886ad270647c150a606a8978b59f6e3c4c8801
SSDEEP 3072:tFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:tFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T173847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icausqkica.sys

Path C:\Temp\icausqkica.sys
Size 293KB
SHA256 d296b0ec71b60f81907d5365f4d0edd02fcecc0631d0769dff072ef86ac33d33
MD5 2c8904913a03dc4f818bed56ee21a458
SHA1 55e211fcc91923918f0911036d6a911d65ee1c3b
SHA512 fa89a712ea4a58000df9fc90e3ab9c3881e5741d9dcdb4e181fbb3ef256a013b35901e9aee38a9e20178d0295713ba54615b62d2e42537ac218afcc3cab8a72f
SSDEEP 3072:3tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:3IJjiJcbI03GBc3ucY5DCSj
TLSH
T1A8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifzxsnkfdx.exe

Path C:\Temp\ifzxsnkfdx.exe
Size 376KB
SHA256 16822f75936c9a329a2dbf3e5c4fd7fd83116296475c364b070306348045f8ae
MD5 53b9d4746fb636e1072a1d111e2dbbfc
SHA1 ce753816e9e35b16c513dc83d87541de75d91aac
SHA512 d3fdc408c7afeab4d00b81972eba0bb2338374aacd5d0bf124422e39be275450c3deecb64f0f81d0167f537b9237459f5ea5811967d05f3fc8ee4d75bb8f225a
SSDEEP 3072:KFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T103847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojgeywtomg.exe

Path C:\Temp\ojgeywtomg.exe
Size 376KB
SHA256 8cfebcfe8d5b0510fa5740bc2ce67937f8a6b6382d90433ca7181074086d6a84
MD5 d0c8495a7c1dd26dbe25276519240c04
SHA1 78d94f54961c654ccb4bdcf64004bd7d61e74679
SHA512 2a5cf6d8ba2ce749e2024ab4ff6fa4c5ebfb155583f602bf3b384adb8d2d02259d097c4b951f0f1fb29804d6243a81b6de8c1d2422b24a16fe5b0c16edfc2db7
SSDEEP 3072:jFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:jFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qligbytrlj.exe

Path C:\Temp\qligbytrlj.exe
Size 376KB
SHA256 4fdb2567dd8c475acf66ee3d78a76f1a9c2b81b52f1f18f0e8b6696b33889388
MD5 7c9fc9a88a16c380fcad5c7d5e434d48
SHA1 576df5fc2322d913d4656e0d80c9e6dc624a48e8
SHA512 a9d3731213d6cf3d4cf0818b265ea1d5b107b5bf5e4fc7d16e056c47f2ec0faa91c94ed3fbb3d99ddda0847182a4c98e17025c3f6fae616e0119eb5d247a8636
SSDEEP 3072:hFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:hFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T118847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigaysqki.sys

Path C:\Temp\qnigaysqki.sys
Size 293KB
SHA256 8e32d39c432c4f7ad8bd8c35f6e980f1750a71fdad0979b5e707ab310943a1a0
MD5 5a4fe995a5e4d7ba1a75b06837f589c3
SHA1 e33399ad6b0e2bf9f117b0ab264c6340788cbe95
SHA512 4ea781ec15b67422474a5b31dddeecf53d4d48f555575055aa5baea2213d847543ffc9889d0288930baed14030218adefc74260c8f02cd160e1084f5ad8040ca
SSDEEP 3072:BtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:BIJjiJcbI03GBc3ucY5DCSj
TLSH
T153545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnlfdavtnl.exe

Path C:\Temp\qnlfdavtnl.exe
Size 376KB
SHA256 36a5feefb88bc4f2ff9c2f29653bfb241c6b14c82267f8d72749fefbe136e0bf
MD5 cdafd498ad69e35947869b530bc9aa38
SHA1 d1846ac2ed00de22963506967bec048d01ad959f
SHA512 d7c4e84de6ad0d5fe4a05111851ea59f6e87df47b6178c6de111e55996f93ced5d2b86c2bc668a5441bf636255a1bffb2bded0544ed0b9965f3e6c6413543e01
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnligayvq.sys

Path C:\Temp\vtnligayvq.sys
Size 293KB
SHA256 94c71211094cdae8a1a9093d3880253d50c65033f8e7eee0b12ef5038fa60019
MD5 deea4ef4c104ddbd8a4a8261ac748a0a
SHA1 90421dbdafb4ff90223d4cf1f90ea81c3e9a4015
SHA512 ac7d98473881e0a955354b6bc17d70a7a81f720419efb29248541b66b50cd80b2abdd84dd673952bc727b6fa6d4eba37acfe7854eb58e3904e0519b46f551b01
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AF545B44AAA4B0F6D9D5043C00EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpnkeczus.exe

Path C:\Temp\xrpnkeczus.exe
Size 376KB
SHA256 7d730396874f5214e7992700218acce36bdcc2c5feea1d0c791825894f93acf4
MD5 b0dbf9033901059cf2db4c7084853da0
SHA1 8cb77f21be3ac178450e8ec13ce46633e0e9bed5
SHA512 0a9b57e68fac0d250f8b764f4ae7f56c4b0fa79559dbabe7599d193064bb34c1f350c0489d6dc39c6ab32d11260b3ed90d37eb1a655f6076da1703d98aa257ac
SSDEEP 3072:kFLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kFL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtnligayv.exe

Path C:\Temp\yvtnligayv.exe
Size 376KB
SHA256 da3084431c78ee0a0fd1a9fc9852d0fe1d1878429e6bb51d132030531908d5a0
MD5 64b2bc1c755d9384e1c42a75794105e6
SHA1 1013ebf7b65e6a57e5c88ca6f6e00000c640403d
SHA512 fd0dd1acd351baba563b5f5b8fd76844cea6a1c2b46af6375d64b4e389db5a1172a59c1c32d4204d5f654455b5a72d15ad839802b4053a3e633af132c3319d1c
SSDEEP 3072:3FLICbv4aaM/4y4tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:3FL1JeIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1B7847C00BA94F0F6D995043800EBAF36967EB4281726CBC7F354CE5DAA513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvtolgdbzt.sys

Path C:\Temp\yvtolgdbzt.sys
Size 293KB
SHA256 c43e44cc6810d7015e78d2c3f8a4f0b77bc03d6d2994c3c54ac3f0c9312bdcf5
MD5 f9606528d6f16b3cd2bffdc426df5a9c
SHA1 a69ed1cc0665d48ca5d49f8a96b9d26746ff92ef
SHA512 b4d93654cf39c0d72450113f9713231a7801f7c18c768ffc6faef0c64eaa49cfdc3b37d3ab61823a431a943c0310cc3a9d95e8236f5f49c2c94d8210feb2a543
SSDEEP 3072:UtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:UIJjiJcbI03GBc3ucY5DCSj
TLSH
T10F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 37567077991f2bfe6cd4dbc5e432df1090d8fb8df455c11d3fca0adaeceedd15
MD5 384b643c086a96c627a50600a721a92c
SHA1 cf1472326557a0ecd3af6016ca18f99776ee01e9
SHA512 7892e627c2017ffa7aceb9acb423b9ae432cc136678691273274c0d792d1793798e24f4dc8bddc33ce7d2f0a4c0aa1473b1a9ced9cd5ad8ace442770c7d72ebc
TLSH
T10C61607E432D05E2FB2845F249E194593AF4C05706271ED07C815FF294F9F2AB5E1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59abf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59abf6.TMP
Size 3KB
SHA256 35d726d1ff915a12cbfc78c0ba1771dd5146bdc684ca5ffc4aa0dda62434d882
MD5 8007ee246c8a775b11a479e4dc358f05
SHA1 dd9a0b44596ac5e147a5aa78fb10cad66c79af4d
SHA512 22c5f8c5700508775c8afe5c2f717bb83f2df34c5cee702d65c3785c1a340c7dbfb5a7d2bb5d31e8d5fe48f0246c73f07e59b42a5e297dc791bb7f15c762b5c0
TLSH
T15561607E432D05E2FB2845F249E1945939F4C05706271ED17C801FF294F5F2A75E1153
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f9e61445542435c35e4eef8bd2356cd4536bb9a11cd30e18abdbec684d61c086
MD5 3b119d07a35c4b0b76e08fb41c981543
SHA1 a45f05ee18375d038f5d2bd59a578208a93501cc
SHA512 3abd45719f9e5402539e5fa95276a4563c702d9773505ccbcaed13b253967360a1435663ba425e320fa1a9a85d2b2d3b18daf9ba40e0f860150c246b77eda15a
TLSH
T11A51BEF7C7E8866ECA0196F0AA187F1BCE1C0914832C3D5AC8E4AF1BA3E2471E14155F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fcf1a613d3cbe6dc73e6dde8e860dea8bd029b7d60aa7763a76267ade7464bbf
MD5 41708c8cd605efa1fc0968bb4aae3d9a
SHA1 5fb7b6f66946ca28a5c07989182621c969953f1d
SHA512 ecdc9b6d0e2a5a8c6fd782d185564d1e5e0fcf1ac933049836d7ba504ac63ac55e1f72d742686a44d3c8f14ed68339876e7df742f17cac982b25416832e90c51
SSDEEP 192:sxRWRGyM/jK1Ml8wC+/fvsov3x5Zin2dzoA8p9U/g6+WNCvY/YnN3hO+GnIgVsJ:sxRWE8+/fvsovhX0rW/57/kRONm
TLSH
T1CA62D906AA245D77CCDBD20DFA55BF53D6F81563E2941E48AAFC8E0C00E66DD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 de89327c572e21955c1d53f8b3aaf81fa78d16b9af1cd4f99b22e9221158fe13
MD5 cf90562a00d91f177eb16ceda19d6bd7
SHA1 c541942e1b0023627483cc633adecbba75ccc1fc
SHA512 7d87d2655b6b3e99ecd35340c1245dd90cbbfef5c483d369dc99f0089c33bb65cc4b16bd64281b73d3198afb70ac57a229580b59c323f9404d840959bdbbbbd1
SSDEEP 192:sxR5RGyM/jK1Ml8wC+/fvsev3x5Zin2dzoA8p9U/g6+WNCvY/YnN3hO+GnIgDlsJ:sxR5E8+/fvsevhX0rW/57/kRONS
TLSH
T16D62D80AAA245D778CDBD20DFA55BF53D6F81563E2941E48AAFC8E0C00E66DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cb68d329d875e4ad7c782fe281cf161a9d3126e06eb0cee7e59da5864f920ccc
MD5 89e2c8dabbdc72a2f8e82487dc8c14e2
SHA1 975dd947d1e0487468a28410a928e51deb575ce6
SHA512 2ffd778944d736caf5c9e822278ca158e6b2fd2e2825782eb3ce62c39ac00fa3c374558a024986d61b4f9ff0aec9ed73160de05f27eff5422c9228823ebc616d
SSDEEP 192:sxR5RGyM/jK1Ml8UQuC+/fvsevRx5Zin2dzoA8prU/g6+WNCvY/YnN2hO+GnIgDI:sxR5EqZ+/fvsevrX0rI/57/k8ONE
TLSH
T16962C71AAA245D778CDBD20DFA55BF53D2F81563A2941E48AAFC8F0C00E66DD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 8c4eae778a8a50957079b052910dba332ed5a6841b42a4dfa7e2195a15151afb
MD5 bf9b5e3deb75a826ba08ed91e1a6611d
SHA1 9bef72a1a505ccd5f7c0c4a68cc10fc2eb7d73b9
SHA512 c4af3b3d4070e3f49bece6b65719fca5c7b9026392e2bfc1fac9ea66dd98e5052d867bd11ed87bcaa0ed3188b631a79395fa83b6483647a5d81bf381c11f994c
SSDEEP 768:wGedNg7pLuL7X6WgoufDM8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaSOu4YTroSy8m/:wGedNsE7X6WgoufDMu1jaFSOVYgP/
TLSH
T124E2DB3B680CCB7E4F804EDCEC29BE9FADA801CB56D88D5447EA890C03C56EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b28ef82dc8a4323de678e359cad669a1d9ed0cbc689bb4c85831dd27c0eb381
MD5 45753003fc76a4c16c647bc3d81752f5
SHA1 158c5f11b174c8b641607ed7dabe8c86dbba239f
SHA512 a89297b4c3f705500001903fadae0c9c99c1658b68db5c9d07b6aa72e0de958cb26c58fa44bcb9a8ac3b7d150f4f52d1390eb8010f1f9f2574e4a6bb5c3c2c1e
SSDEEP 96:KR4H4Q414x4H4F414ZW4B4u40g454ZK44wg434Zc4/43424p414qH4L4U4R4l4TX:COjyuIQAhQVuu+zgsFGONcOHH2r6WwYc
TLSH
T19C910343343612403C7DA71881798C7AB2D17866311A796B3BAD51AB0F2AF07CDFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4b91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4b91.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ba8b71b75bb865bf7547b85e8d294e5e8723a462af3bba02d4671d526978b4f4
MD5 9e638ea69b2cb91681f2b26e3c62ccfd
SHA1 167200086d983e724b706e223476b287745fe8d5
SHA512 76c4d17d14fd3df1c506431c2d735600245775c008c2ac4d47c2a74b92cf2b47fb77651c4ed2afdb738cc64f09b5a975bacc8ced461568266b084760509df711
SSDEEP 768:xF1j+9z37wgLoAGZQ5O08oNzc4ReyIsPvMVcLCO7w/R:Q9z3ptc44bsXHCt/R
TLSH
T1DC1328F698D38977E8AD5787A73E2D4269FCD163B5885884B7C91E0CCC861BFC70A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fe4cde1cce4a29962a922769d639e55ef4ae3e12051734ecb25bc518d8f7069c
MD5 13478db84d5a27025f91078ef351874f
SHA1 987cdf7b20d16eee318bf54de2d546a0b8831d83
SHA512 d934e0d75f74fc0ef64e79f1ecee79b46ff9ba651967a76d140dccb26b683aeac72858fc01ed4b89fe7f07813d7541c37b6defb6687a8175a589cf900ebecbd8
SSDEEP 768:6rv+4UNbds3wKDZIO0QNzc4ReyIsXWeVH1S5D:6bsbS3Ltc44bsGEH1Y
TLSH
T14F03CF32E8688977ACF6A786B54B76533EF8512B82D81E94C5DE2F0C464B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 59d01f43a49f29c72d00db4d4bb0433d0d11b73ac297d0a77dfa51033a4007d2
MD5 4b26556ad5807e699451d92418c7a920
SHA1 7745683d61c3defcc529fb077b6e47cf4ac2036c
SHA512 eb2f278751ee51a5ddfb1a26f26586fc22af7a31639a7b4d1c79ad239a279ba15760cd8c89743492902c01828f8d2934295adb59937f10b983e8b0aaa307b495
SSDEEP 768:rj+9J3voAnDZIO08KNzc4ReyIsPvMVcLCO7w/R:+9J3wtc44bsXHCt/R
TLSH
T170F2CE36E8269D63ECE9A689F6173A837EF4203784C81E58D9DD6F0C04477DD071B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9c377a54878164d9e9081b745ac05b852b7a7f6a68602e45bffa4184fe4cded1
MD5 88b222960ed3bd1e3e9f88d1783bcb69
SHA1 e22d6cc29d950168bb695dacf7d30eb0acf48ed1
SHA512 df036b9d281ba868079292401344ab3a372ef43bead8709bbf88a906c82eea17e54a4c04fd558f8e3d79b6550ca3ee597ad4d71d5b7ffd9b281f6996f9df9d0f
SSDEEP 768:Hrv+4UNbdD3Oo9nDZIO08KNzc4ReyIsPvMVcLCO7w/N:Hbsbl3Qtc44bsXHCt/N
TLSH
T16B13BE32F8689D73ECEAA685F50B36837EF4206785C90E58D9DA1F0C054B6DE171B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d0de877443e88552e20e8b6e51724fe6cb8f3427ab2712b4b913e357267aefc9
MD5 4a61128562368350db20b2f7a30f19e6
SHA1 8170938c8f2717d10aefc5fb6ee09fc15f1b4e4d
SHA512 c7c415eda744603fb05a6546c7cecbbe16c37cfd67e520a3f3f44d8ef932232b7ce1386853b7a44b9a7869e345741d62107b11f3a8de2acb736d527dfc6ed85e
SSDEEP 768:0j+9J34oAnDZIO08KNzc4ReyIsPvMVcLCO7w/R:j9J3vtc44bsXHCt/R
TLSH
T177F2CE36E8269D63ECE9A689F61B3A837EF4203784C81E58D9DD6F0C05477DD071B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4320_1875411142\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 84a5abbe53315fa3e6eceeccb5232f4738bdd75c436b62d829101601ae51e413
MD5 206851dde44ec1fba165430d44da7330
SHA1 7aec391ce836e148bf2400c6ca80301d4038a6de
SHA512 56e41d98d4511bac2d8065b9b938af74dd64bc373ab8e9c82109b11dd6e8854f7e4844f1fc74f21ad8e6ed75cefa95d73f4065a9d405c54beaf550e6d2c875ca
TLSH
T17571008357B9D5F2C1DA5FF502835244F5BB22380B2330350B915946AA30A3A24B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1136-410-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1136-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1432-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1436-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1436-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2088-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2492-266-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2640-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2652-238-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2656-316-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2992-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4228-413-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4364-290-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4708-368-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4900-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-448-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4964-191-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5012-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5620-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5776-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5860-312-0x0000000000010000-0x00000000000AB000-memory.dmp

Download