systex | b6919ef451ce645242eea1e87643453c96992035afb23ac5066e759852a59f35

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample260816-dwc5vaydld
SHA256 b6919ef451ce645242eea1e87643453c96992035afb23ac5066e759852a59f35
MD5 fd6dedbe6fb1a9c6886b86e98cb1e135
SHA1 af47976be59c841e759151e0246314b0ef857961
SHA512 de2c28396b35d0c326953c8223cbacb5e50c11ddff64b981e5dc205f24b1e432f3933bbd90c1be5cd7bafe9790b0bad0214fa977891f1b32742843d9cb5de618
SSDEEP 3072:buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:buxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4800	cwuomgezwrpjhecw.exe
1108	cwuomgezwrpjhecw.sys
2604	CreateProcess.exe
5276	hezxrojhzu.exe
552	CreateProcess.exe
764	CreateProcess.exe
2828	i_hezxrojhzu.exe
464	ebwurmjebz.sys
696	CreateProcess.exe
2740	tomjebwtrl.exe
2056	CreateProcess.exe
4064	CreateProcess.exe
4944	i_tomjebwtrl.exe
3428	olgebwtomg.sys
5984	CreateProcess.exe
5248	ljgbztrljd.exe
5228	CreateProcess.exe
3908	CreateProcess.exe
5464	i_ljgbztrljd.exe
5788	gbvtqliday.sys
1976	CreateProcess.exe
4284	jgayvqnlgd.exe
700	CreateProcess.exe
956	CreateProcess.exe
1712	i_jgayvqnlgd.exe
252	gaysqkidav.sys
4356	CreateProcess.exe
4964	vsqkicavsn.exe
3208	CreateProcess.exe
1260	CreateProcess.exe
4736	i_vsqkicavsn.exe
1144	gaysqnlfdx.sys
5240	CreateProcess.exe
5176	vsnicavsnk.exe
1708	CreateProcess.exe
1868	CreateProcess.exe
3480	i_vsnicavsnk.exe
3816	fcausnkfdx.sys
6044	CreateProcess.exe
2660	faxsqkicau.exe
5092	CreateProcess.exe
2268	CreateProcess.exe
5564	i_faxsqkicau.exe
2380	hfzxspkhca.sys
5972	CreateProcess.exe
5320	fcwuspkhfz.exe
1792	CreateProcess.exe
4760	CreateProcess.exe
252	i_fcwuspkhfz.exe
2292	frpjhczurp.sys
4788	CreateProcess.exe
5556	rmjeczurmk.exe
3624	CreateProcess.exe
1912	CreateProcess.exe
4656	i_rmjeczurmk.exe
2496	omgezwuomh.sys
4088	CreateProcess.exe
784	ebztrljhbz.exe
3684	CreateProcess.exe
5648	CreateProcess.exe
5756	i_ebztrljhbz.exe
3408	mjhbztrljd.sys
5548	CreateProcess.exe
6012	ljebwtrlje.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_191760941\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_191760941\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_542494349\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_542494349\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_542494349\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_2043258127\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_2043258127\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_542494349\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3156_956154728\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hezxrojhzu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pmkeczurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pmkeczurpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tomjebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fcwuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjeczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxupkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qfaxspnlfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsnicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqkicavsn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsnicavsnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gebwuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tomjebwtrl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxsqkicau.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ligdywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qfaxspnlfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sqkicaxvnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cwuomgezwrpjhecw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljgbztrljd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxupkhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomkhcz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdbvtoigb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ligdywtnlg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_sqkicaxvnk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrljhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtrlje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kidavtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgayvqnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgayvqnlgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fcwuspkhfz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjeczurmk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hezxrojhzu.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2124	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4388	ipconfig.exe
2988	ipconfig.exe
4840	ipconfig.exe
1288	ipconfig.exe
3228	ipconfig.exe
460	ipconfig.exe
3076	ipconfig.exe
2508	ipconfig.exe
1244	ipconfig.exe
5560	ipconfig.exe
1876	ipconfig.exe
3336	ipconfig.exe
3160	ipconfig.exe
1924	ipconfig.exe
5640	ipconfig.exe
2732	ipconfig.exe
4944	ipconfig.exe
4540	ipconfig.exe
4452	ipconfig.exe
952	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313240791945014"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{FE6A8B2A-DEAD-43F0-A2D9-D1E91A1A8DF2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe
4800	cwuomgezwrpjhecw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe
3156	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2828	i_hezxrojhzu.exe
Token: SeDebugPrivilege	4944	i_tomjebwtrl.exe
Token: SeDebugPrivilege	5464	i_ljgbztrljd.exe
Token: SeDebugPrivilege	1712	i_jgayvqnlgd.exe
Token: SeDebugPrivilege	4736	i_vsqkicavsn.exe
Token: SeDebugPrivilege	3480	i_vsnicavsnk.exe
Token: SeDebugPrivilege	5564	i_faxsqkicau.exe
Token: SeDebugPrivilege	252	i_fcwuspkhfz.exe
Token: SeDebugPrivilege	4656	i_rmjeczurmk.exe
Token: SeDebugPrivilege	5756	i_ebztrljhbz.exe
Token: SeDebugPrivilege	2292	i_ljebwtrlje.exe
Token: SeDebugPrivilege	5840	i_ligdywtnlg.exe
Token: SeDebugPrivilege	3776	i_kidavtnlfd.exe
Token: SeDebugPrivilege	4516	i_qfaxspnlfc.exe
Token: SeDebugPrivilege	5400	i_sqkicaxvnk.exe
Token: SeDebugPrivilege	3496	i_cxupkhczus.exe
Token: SeDebugPrivilege	2608	i_pmkeczurpm.exe
Token: SeDebugPrivilege	1524	i_ecwuomkhcz.exe
Token: SeDebugPrivilege	1896	i_gebwuomgez.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 4800	5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5156 wrote to memory of 5452	5156	2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 5452 wrote to memory of 3156	5452	iexplore.exe	91
PID 3156 wrote to memory of 4684	3156	msedge.exe	92
PID 3156 wrote to memory of 4364	3156	msedge.exe	93
PID 3156 wrote to memory of 2124	3156	msedge.exe	94
PID 3156 wrote to memory of 4364	3156	msedge.exe	93
PID 3156 wrote to memory of 4364	3156	msedge.exe	93
PID 3156 wrote to memory of 5868	3156	msedge.exe	95
PID 3156 wrote to memory of 5868	3156	msedge.exe	95
PID 3156 wrote to memory of 5356	3156	msedge.exe	97
PID 3156 wrote to memory of 5356	3156	msedge.exe	97
PID 3156 wrote to memory of 5348	3156	msedge.exe	98
PID 3156 wrote to memory of 5356	3156	msedge.exe	97
PID 3156 wrote to memory of 5348	3156	msedge.exe	98
PID 3156 wrote to memory of 5348	3156	msedge.exe	98
PID 3156 wrote to memory of 1576	3156	msedge.exe	99
PID 3156 wrote to memory of 1576	3156	msedge.exe	99
PID 3156 wrote to memory of 1576	3156	msedge.exe	99
PID 3156 wrote to memory of 1636	3156	msedge.exe	100
PID 3156 wrote to memory of 1636	3156	msedge.exe	100
PID 3156 wrote to memory of 1636	3156	msedge.exe	100
PID 3156 wrote to memory of 4196	3156	msedge.exe	101
PID 3156 wrote to memory of 4196	3156	msedge.exe	101
PID 3156 wrote to memory of 4196	3156	msedge.exe	101
PID 3156 wrote to memory of 3964	3156	msedge.exe	103
PID 3156 wrote to memory of 3964	3156	msedge.exe	103
PID 3156 wrote to memory of 4116	3156	msedge.exe	105
PID 3156 wrote to memory of 4116	3156	msedge.exe	105
PID 3156 wrote to memory of 4116	3156	msedge.exe	105
PID 4800 wrote to memory of 2604	4800	cwuomgezwrpjhecw.exe	107
PID 3156 wrote to memory of 5816	3156	msedge.exe	110
PID 3156 wrote to memory of 2280	3156	msedge.exe	109
PID 3156 wrote to memory of 5816	3156	msedge.exe	110
PID 3156 wrote to memory of 2280	3156	msedge.exe	109
PID 5276 wrote to memory of 552	5276	hezxrojhzu.exe	112
PID 3156 wrote to memory of 4356	3156	msedge.exe	116
PID 3156 wrote to memory of 2508	3156	msedge.exe	117
PID 3156 wrote to memory of 2508	3156	msedge.exe	117
PID 3156 wrote to memory of 1220	3156	msedge.exe	119
PID 3156 wrote to memory of 1220	3156	msedge.exe	119
PID 4800 wrote to memory of 764	4800	cwuomgezwrpjhecw.exe	121
PID 4800 wrote to memory of 696	4800	cwuomgezwrpjhecw.exe	125
PID 2740 wrote to memory of 2056	2740	tomjebwtrl.exe	127
PID 4800 wrote to memory of 4064	4800	cwuomgezwrpjhecw.exe	130
PID 4800 wrote to memory of 5984	4800	cwuomgezwrpjhecw.exe	134
PID 5248 wrote to memory of 5228	5248	ljgbztrljd.exe	136
PID 4800 wrote to memory of 3908	4800	cwuomgezwrpjhecw.exe	139
PID 4800 wrote to memory of 1976	4800	cwuomgezwrpjhecw.exe	144
PID 4284 wrote to memory of 700	4284	jgayvqnlgd.exe	146
PID 4800 wrote to memory of 956	4800	cwuomgezwrpjhecw.exe	149
PID 3156 wrote to memory of 1512	3156	msedge.exe	151
PID 3156 wrote to memory of 5964	3156	msedge.exe	152
PID 3156 wrote to memory of 5836	3156	msedge.exe	153
PID 4800 wrote to memory of 4356	4800	cwuomgezwrpjhecw.exe	156
PID 4964 wrote to memory of 3208	4964	vsqkicavsn.exe	158
PID 4800 wrote to memory of 1260	4800	cwuomgezwrpjhecw.exe	161
PID 4800 wrote to memory of 5240	4800	cwuomgezwrpjhecw.exe	165
PID 5176 wrote to memory of 1708	5176	vsnicavsnk.exe	167
PID 4800 wrote to memory of 1868	4800	cwuomgezwrpjhecw.exe	170
PID 4800 wrote to memory of 6044	4800	cwuomgezwrpjhecw.exe	174
PID 2660 wrote to memory of 5092	2660	faxsqkicau.exe	176
PID 4800 wrote to memory of 2268	4800	cwuomgezwrpjhecw.exe	179
PID 4800 wrote to memory of 5972	4800	cwuomgezwrpjhecw.exe	183

C:\Users\Admin\AppData\Local\Temp\2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fd6dedbe6fb1a9c6886b86e98cb1e135_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Temp\cwuomgezwrpjhecw.exe
  C:\Temp\cwuomgezwrpjhecw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hezxrojhzu.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2604
  - - C:\Temp\hezxrojhzu.exe
      C:\Temp\hezxrojhzu.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5276
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:552
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hezxrojhzu.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:764
  - - C:\Temp\i_hezxrojhzu.exe
      C:\Temp\i_hezxrojhzu.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tomjebwtrl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:696
  - - C:\Temp\tomjebwtrl.exe
      C:\Temp\tomjebwtrl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2056
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tomjebwtrl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4064
  - - C:\Temp\i_tomjebwtrl.exe
      C:\Temp\i_tomjebwtrl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljgbztrljd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5984
  - - C:\Temp\ljgbztrljd.exe
      C:\Temp\ljgbztrljd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljgbztrljd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3908
  - - C:\Temp\i_ljgbztrljd.exe
      C:\Temp\i_ljgbztrljd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5464
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgayvqnlgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1976
  - - C:\Temp\jgayvqnlgd.exe
      C:\Temp\jgayvqnlgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:700
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1924
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgayvqnlgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:956
  - - C:\Temp\i_jgayvqnlgd.exe
      C:\Temp\i_jgayvqnlgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqkicavsn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4356
  - - C:\Temp\vsqkicavsn.exe
      C:\Temp\vsqkicavsn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqkicavsn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1260
  - - C:\Temp\i_vsqkicavsn.exe
      C:\Temp\i_vsqkicavsn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsnicavsnk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5240
  - - C:\Temp\vsnicavsnk.exe
      C:\Temp\vsnicavsnk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5176
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2508
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsnicavsnk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1868
  - - C:\Temp\i_vsnicavsnk.exe
      C:\Temp\i_vsnicavsnk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxsqkicau.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6044
  - - C:\Temp\faxsqkicau.exe
      C:\Temp\faxsqkicau.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5092
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1244
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxsqkicau.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Temp\i_faxsqkicau.exe
      C:\Temp\i_faxsqkicau.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fcwuspkhfz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5972
  - - C:\Temp\fcwuspkhfz.exe
      C:\Temp\fcwuspkhfz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5320
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fcwuspkhfz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4760
  - - C:\Temp\i_fcwuspkhfz.exe
      C:\Temp\i_fcwuspkhfz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:252
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjeczurmk.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\rmjeczurmk.exe
      C:\Temp\rmjeczurmk.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5556
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1288
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjeczurmk.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1912
  - - C:\Temp\i_rmjeczurmk.exe
      C:\Temp\i_rmjeczurmk.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrljhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4088
  - - C:\Temp\ebztrljhbz.exe
      C:\Temp\ebztrljhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3684
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrljhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5648
  - - C:\Temp\i_ebztrljhbz.exe
      C:\Temp\i_ebztrljhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtrlje.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5548
  - - C:\Temp\ljebwtrlje.exe
      C:\Temp\ljebwtrlje.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6012
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2708
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2732
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtrlje.exe ups_ins
    3⤵
    PID:1804
  - - C:\Temp\i_ljebwtrlje.exe
      C:\Temp\i_ljebwtrlje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ligdywtnlg.exe ups_run
    3⤵
    PID:3836
  - - C:\Temp\ligdywtnlg.exe
      C:\Temp\ligdywtnlg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ligdywtnlg.exe ups_ins
    3⤵
    PID:4508
  - - C:\Temp\i_ligdywtnlg.exe
      C:\Temp\i_ligdywtnlg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kidavtnlfd.exe ups_run
    3⤵
    PID:1468
  - - C:\Temp\kidavtnlfd.exe
      C:\Temp\kidavtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1132
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kidavtnlfd.exe ups_ins
    3⤵
    PID:756
  - - C:\Temp\i_kidavtnlfd.exe
      C:\Temp\i_kidavtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3776
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qfaxspnlfc.exe ups_run
    3⤵
    PID:2984
  - - C:\Temp\qfaxspnlfc.exe
      C:\Temp\qfaxspnlfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3008
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2292
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qfaxspnlfc.exe ups_ins
    3⤵
    PID:5708
  - - C:\Temp\i_qfaxspnlfc.exe
      C:\Temp\i_qfaxspnlfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4516
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\sqkicaxvnk.exe ups_run
    3⤵
    PID:5760
  - - C:\Temp\sqkicaxvnk.exe
      C:\Temp\sqkicaxvnk.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2884
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_sqkicaxvnk.exe ups_ins
    3⤵
    PID:5840
  - - C:\Temp\i_sqkicaxvnk.exe
      C:\Temp\i_sqkicaxvnk.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxupkhczus.exe ups_run
    3⤵
    PID:4596
  - - C:\Temp\cxupkhczus.exe
      C:\Temp\cxupkhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxupkhczus.exe ups_ins
    3⤵
    PID:5088
  - - C:\Temp\i_cxupkhczus.exe
      C:\Temp\i_cxupkhczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3496
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pmkeczurpm.exe ups_run
    3⤵
    PID:5392
  - - C:\Temp\pmkeczurpm.exe
      C:\Temp\pmkeczurpm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pmkeczurpm.exe ups_ins
    3⤵
    PID:3316
  - - C:\Temp\i_pmkeczurpm.exe
      C:\Temp\i_pmkeczurpm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2608
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomkhcz.exe ups_run
    3⤵
    PID:1704
  - - C:\Temp\ecwuomkhcz.exe
      C:\Temp\ecwuomkhcz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:460
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomkhcz.exe ups_ins
    3⤵
    PID:3160
  - - C:\Temp\i_ecwuomkhcz.exe
      C:\Temp\i_ecwuomkhcz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1524
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gebwuomgez.exe ups_run
    3⤵
    PID:4548
  - - C:\Temp\gebwuomgez.exe
      C:\Temp\gebwuomgez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3548
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4888
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gebwuomgez.exe ups_ins
    3⤵
    PID:5964
  - - C:\Temp\i_gebwuomgez.exe
      C:\Temp\i_gebwuomgez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdbvtoigb.exe ups_run
    3⤵
    PID:3312
  - - C:\Temp\lgdbvtoigb.exe
      C:\Temp\lgdbvtoigb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3076
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:5452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ffa18a3c188,0x7ffa18a3c194,0x7ffa18a3c1a0
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,13204169500897595805,463277166101328888,262144 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:2
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,9368940379050744219,16276872640610217676,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:11
      4⤵
      System Time Discovery
      PID:2124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,8813429565035337170,12625444694887831515,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:13
      4⤵
      PID:5868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,11536618891797079560,5876535794303317664,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:5356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,12685677455633976374,3487988791002284929,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,4144355701976629598,1068668486407613572,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,4209010656141899596,2983841001609349983,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:9
      4⤵
      PID:1636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3880,i,1703908472633581727,11316558303665754881,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6795487753976787750,14181034904050496472,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3736,i,16354846616568596297,2821121890892600543,2097152 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:4116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,9469414903892128250,13471372085771444922,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,13711630887058421497,5329988220562682978,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18014314224698635220,13844142105308602612,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,18014314224698635220,13844142105308602612,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:4356
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7382230868426011559,10142144914420084929,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,15044474690831795345,9673280754680113505,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:1220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,3916958857562057118,2193001062592236795,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:14
      4⤵
      PID:1512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,11826568834067666145,7992466541566351854,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
      4⤵
      PID:5964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,17153999385964132143,2679007629389849599,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,17224403777699816084,13722172537017258632,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,1607127245878691866,12699668967724000014,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
      4⤵
      PID:4388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,6586908766295049856,2427589856068926217,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:14
      4⤵
      PID:4472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,13128043893824346850,14187645941423587445,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5680,i,16460768354336375371,16810178786210446003,262144 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:10
      4⤵
      PID:5908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,12965864356961349085,6957446168681230785,524288 --field-trial-handle=3004,i,12526959136146122247,2109060906496553870,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:14
      4⤵
      PID:328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5332

C:\Temp\cwuomgezwrpjhecw.sys
C:\Temp\cwuomgezwrpjhecw.sys
1⤵
- Executes dropped EXE
PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5088

C:\Temp\ebwurmjebz.sys
C:\Temp\ebwurmjebz.sys
1⤵
- Executes dropped EXE
PID:464

C:\Temp\olgebwtomg.sys
C:\Temp\olgebwtomg.sys
1⤵
- Executes dropped EXE
PID:3428

C:\Temp\gbvtqliday.sys
C:\Temp\gbvtqliday.sys
1⤵
- Executes dropped EXE
PID:5788

C:\Temp\gaysqkidav.sys
C:\Temp\gaysqkidav.sys
1⤵
- Executes dropped EXE
PID:252

C:\Temp\gaysqnlfdx.sys
C:\Temp\gaysqnlfdx.sys
1⤵
- Executes dropped EXE
PID:1144

C:\Temp\fcausnkfdx.sys
C:\Temp\fcausnkfdx.sys
1⤵
- Executes dropped EXE
PID:3816

C:\Temp\hfzxspkhca.sys
C:\Temp\hfzxspkhca.sys
1⤵
- Executes dropped EXE
PID:2380

C:\Temp\frpjhczurp.sys
C:\Temp\frpjhczurp.sys
1⤵
- Executes dropped EXE
PID:2292

C:\Temp\omgezwuomh.sys
C:\Temp\omgezwuomh.sys
1⤵
- Executes dropped EXE
PID:2496

C:\Temp\mjhbztrljd.sys
C:\Temp\mjhbztrljd.sys
1⤵
- Executes dropped EXE
PID:3408

C:\Temp\olgeywtolg.sys
C:\Temp\olgeywtolg.sys
1⤵
PID:5528

C:\Temp\lidavsnlid.sys
C:\Temp\lidavsnlid.sys
1⤵
PID:4732

C:\Temp\sqnigayvqn.sys
C:\Temp\sqnigayvqn.sys
1⤵
PID:4836

C:\Temp\qkifaxvsnk.sys
C:\Temp\qkifaxvsnk.sys
1⤵
PID:2892

C:\Temp\zxspkhcaus.sys
C:\Temp\zxspkhcaus.sys
1⤵
PID:2612

C:\Temp\causmkecau.sys
C:\Temp\causmkecau.sys
1⤵
PID:1108

C:\Temp\bzurpjhbzu.sys
C:\Temp\bzurpjhbzu.sys
1⤵
PID:1884

C:\Temp\jgezwrpjhb.sys
C:\Temp\jgezwrpjhb.sys
1⤵
PID:1220

C:\Temp\gdbvtqoigb.sys
C:\Temp\gdbvtqoigb.sys
1⤵
PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cwuomgezwrpjhecw.exe

Path C:\Temp\cwuomgezwrpjhecw.exe
Size 389KB
SHA256 47cb1063ec64fd0b808b3a53118308842b0d315677a889dd36ab99f48a6afbdb
MD5 38d83700084b1b48602cf464c2a12889
SHA1 ef139ca5cc7d2ecd2933a6f10f91f11f4d547f9a
SHA512 de151969be6af5eb671635fe15384c4b8de8fa1939d821764244a19636242a59428a70e6dd0553d0bd6a78c67485f95a7f6420792c1d670a48b214809b4bda82
SSDEEP 3072:Auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T19F847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cwuomgezwrpjhecw.sys

Path C:\Temp\cwuomgezwrpjhecw.sys
Size 293KB
SHA256 75f6a5dd1e1fcae2bc03e5c51f35b53157cca50d2b99cfca750328a5e340ad73
MD5 76c1716441121b7e558e02ff185cb84d
SHA1 ef0cf9b63c3abe416bcdc733d11d739a0c266745
SHA512 4d3a4c268f7985facfb5825a3a249c7a52754e4e50bf0e74f98058012e5f5e1533bd58cecc4df44a85c779720e439be3e0bf4825dd629aab741927957b52fd5f
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T16D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebwurmjebz.sys

Path C:\Temp\ebwurmjebz.sys
Size 293KB
SHA256 a4fb427a02bc6f7804496d91c739c03bb5e9aaa2bc0ac5fff8d00459bcb3ac31
MD5 166e796a909d3a1ec065bf5081be54a0
SHA1 3c4e06ed18bc8ef3c0efa32cb2071b2071950145
SHA512 8c826a7d1fff00163307d0f2b51c1ead03c93990ed946a88c1af887cce49c544f68bd64b612e57a097d6c955b76e97b048a5eb4ebe768685fd1c4c642b30c7ec
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T104545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqkidav.sys

Path C:\Temp\gaysqkidav.sys
Size 293KB
SHA256 6115fd9ffcdfc460ecc2e19aac83efec68eadfebef2c3b26d4ad0a609b67c46a
MD5 52904f665e045211a82e6a9e4d920bfa
SHA1 d6196be8f714781cf42fae0feea5bf0541717768
SHA512 01795e1a308374b931d4590c1c6e7b5d52512177afa8f3a48567d0280af307228c8dee4267611b14ee2bad78b66e9cb8cbb60e761630e9a416436befc595c28f
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T155545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqnlfdx.sys

Path C:\Temp\gaysqnlfdx.sys
Size 293KB
SHA256 f4cd1dcc89678a79d6c126323f11fc6d42fb5cbcf62864583322616459a49de3
MD5 bfd3e55e7784e351827d19b869a2468f
SHA1 c3eb5ff783d0d171f524f21286fece3b0cfe10f5
SHA512 84c36f2aaf11717097f832814e6185c58a6bb762b4408b62e63713b2091bde743a3375d50aef7d3cbd9c540b99454b352b550595f724e58fe3e2c35503af3395
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T158545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbvtqliday.sys

Path C:\Temp\gbvtqliday.sys
Size 293KB
SHA256 48c381dd2e0f673cdf99ae4f3630eebe2199ae40d9bbb42d676be11f51007222
MD5 7de114482f355490051d62f67018c4db
SHA1 54d394d980f9ac1e00553e5c80b2470b94942083
SHA512 44e1e6df9d004832f62843c98f1ac9fba1962e3b80a6bb2bef447ca384498c70de3cdaf155e86385ecaa0395d7934e29919ba87e686a523c26fe57926aefe000
SSDEEP 3072:DtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:DIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hezxrojhzu.exe

Path C:\Temp\hezxrojhzu.exe
Size 389KB
SHA256 17eca239e7d0073af11a860bc6aa606669abe1f8532d6f9de9f0223f85d5c692
MD5 8ee42540d96779197201a9f61ef426cb
SHA1 d3507bd3a163e52c624743964a97074034ae5fb7
SHA512 112ca555fafeeccc29c3df7108a8f33328a478019e267df3af253ba82b7bf8e536bda6d3e1a4c97199597ff7bd6a1d4cd2cb87e6db27e9ab1cac8abf1edd0c94
SSDEEP 3072:Quxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:QuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T158847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hezxrojhzu.exe

Path C:\Temp\i_hezxrojhzu.exe
Size 389KB
SHA256 09e01c82debdd2656690e9a75b26a6f9a060e19b9d008950a4d562f8bf3a4e78
MD5 41bd1dd967d9719f58f2b5e67d32576e
SHA1 ce95a2382745a176a22a5bd03671b6d88b60c354
SHA512 bc4c148065620b2cd05c1be375f20a0371ca6b5e3d72fcfb1a6aa00dc6a22107416951fb461e62e2650b4d1ccebfc10780953bfc0dbd950116caaec2bbc8729c
SSDEEP 3072:vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:vuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jgayvqnlgd.exe

Path C:\Temp\i_jgayvqnlgd.exe
Size 389KB
SHA256 05318234d84d539c96be98c4fd5678b43c5bfd21a6cab5a22fae5ad4a1968136
MD5 8e89b483ade1c0040ea4b7418131d63e
SHA1 1ef2e0c18da1d2e660f5285788b28249d5abe83b
SHA512 d1d3f024e582429828589e24524fd30254792e71ded318edc211f2f474472b479ef5f8888323ac1fec549195bee39d2fc89c379a988fe76369fc098a902dfdfa
SSDEEP 3072:Buxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljgbztrljd.exe

Path C:\Temp\i_ljgbztrljd.exe
Size 389KB
SHA256 215711393c936b099f13f88f601de2f88dfcf66e1e59acdabf632f64567beb99
MD5 4a018bb1bca8893604289d4481c01a17
SHA1 e6ae0d9e35a5e3250dc565f62dbdede64c5a4bfd
SHA512 8fb097e7393befa1a026e335191af57f1a45db90f342a19898fd1485c1c430bc911baa2c2cfbe38fb703e5fd61259bf6d2bdac55e68b357a20c263552a93fcbf
SSDEEP 3072:ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ruxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tomjebwtrl.exe

Path C:\Temp\i_tomjebwtrl.exe
Size 389KB
SHA256 206c4d2748009fdca66927ec12b71960511cec5534148e4c46e52e0f06b6f703
MD5 b109e7fb9d9a87418de0a16953e27b7c
SHA1 2db698b7ef921c16960c252ac8121f329b94a782
SHA512 b47079b2c7b6ee3668f02758220f02d19b622f451dd889f2e8f847407518b65c39313cdd4f90f52dbc1bbf612816b3883505f66d1d9b997da072a4dd4b188cd0
SSDEEP 3072:Huxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:HuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vsqkicavsn.exe

Path C:\Temp\i_vsqkicavsn.exe
Size 389KB
SHA256 757c34522935a0ff27f01e29e76b7170e274e592be6844996d215bfb597c7a32
MD5 fb1c76047fcf3eededd4e4c2e50d43bc
SHA1 6cfa1b8bf926db7e4e2120c343a5421cc9d6e86e
SHA512 8f2137ec8036f77b3dff42912f8538fbe4dafdc4cbe4385e262ae67f4a9c1af8b8e825b9028f67bf526e30ee88bf1d10d9b57155c261d52829803f2ff2c914e0
SSDEEP 3072:auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:auxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jgayvqnlgd.exe

Path C:\Temp\jgayvqnlgd.exe
Size 389KB
SHA256 8fb12a7356481d7f44a460af9d144f70d5ebc7a970685b03e751d30580ba980c
MD5 391f9c20352538ad982e6267a10d2b39
SHA1 68458f798d04af0a9c5a4693570a102a2278f839
SHA512 59a6d6a0ab521498fee53dfa7e90f7e891baf34d099b55ea9f39fb79ef169925002ac74f1766f5e33f79d2c2ed4588195807cff989a296ab5a252c7b35fc5e9b
SSDEEP 3072:Nuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:NuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljgbztrljd.exe

Path C:\Temp\ljgbztrljd.exe
Size 389KB
SHA256 238c465a27d99344c334234928e5af6545ca03cf41312f823861fb6b28e6ab6f
MD5 ee6bf3db1f4f0fc16387138b455c1aec
SHA1 b5e231278fb5632e6e308c9a9629937a87d2b769
SHA512 da3be00ce134a4e8b46d90b6e5b63135fd6d36bd00d317e904ab51d6c980b86055525c484d5fcc2103ab10b57ca1fe8ad117fb91fa2c9d812bccc09807a1e089
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

olgebwtomg.sys

Path C:\Temp\olgebwtomg.sys
Size 293KB
SHA256 2754f7443ff0edf6fc6076e8351e8b5d2dd7746ed687774fd80fe1fdfa4560ad
MD5 9bfdd032f5196e17b442d764dd33bc8a
SHA1 aa2a1ed06d4c1865d1a1f8b457398573e1442ac3
SHA512 49c86870e0a35633c1c2ded12c4b71c3d117cab7026e4503c2352778f82913ce514255ab10119c0c65f4c37a445db8554bb9bc28bb49cbf00a328866efe051e0
SSDEEP 3072:WtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:WIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tomjebwtrl.exe

Path C:\Temp\tomjebwtrl.exe
Size 389KB
SHA256 1c988f15fc50721647fb9305875fd5155f11b961b7c394d9045fbf6f04091c44
MD5 f834f5f25c583db01d4e06354a284a80
SHA1 5df19f72111edbcd7b6e9011a18aabccac2d4a8b
SHA512 773771842485f4f1eb5e55cfee8e4c4d1b9992ee9f9a7d4ab551fee5952e2f6a08687a9e2b25bcf6d924d95b16f078044e1c3d2d1e839c65a63d8195d99495db
SSDEEP 3072:Vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsnicavsnk.exe

Path C:\Temp\vsnicavsnk.exe
Size 389KB
SHA256 0d3936c3a2159fa689f885c9878e7a92393b97b982ba4b7da31be3c4a8bf148b
MD5 629722f8d52fa85b1503d2cf3b298242
SHA1 da1b5ee7bf0bd556095f7a1d687c636828991d92
SHA512 7e10397f9d6e91dce59cd91b6a753fcf89fae0bb89d4e7112cef23ed57093b1c23a40104e021c06237cd810a952d8dead0c1c046d5d494ca0922e679b4f14f5e
SSDEEP 3072:puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:puxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T10C847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsqkicavsn.exe

Path C:\Temp\vsqkicavsn.exe
Size 389KB
SHA256 bf3a00d410893ee9c4d0a19ad95e2fb9a4d12bafd5d58704b861b8d566ec4fc0
MD5 bf77de55763c54eb1adb8160649e9943
SHA1 ff1ca67d87a8620326466b2da68bf80dbf179447
SHA512 d98c9f963b48f5164952992200bb7af3d73b666f033283a2617b198835dba80f631dc15e5d20244ba22f18c817095a58773a8d3967d27e6d08f9440a02169590
SSDEEP 3072:duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T116847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 fc764e03e80e3d4c30545243e992a9dcc257c6e4178aa433d788f965a2ae6679
MD5 d62469f0ea4ad42011809c1928b8916f
SHA1 b88079d19de8706ae4dc680e4847a50bcc805b90
SHA512 fbfc12d5f9196bca0c2f8011cdb2bcef3e2a5baa05baf60b3d0107137d9d0d2361e4e8a6d1cebdd5e549895ebceebcf2ddeb3306f073d17f8bac2d4c4ecb2e35
TLSH
T1B951958B1FA309FBE761E7BF7EE1A4E9727086B944171E085DCC21B8F406B865010338
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598311.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598311.TMP
Size 2KB
SHA256 b17d1ae7db21ea216eba486cf3d82c00b7c6084f42b7c4887aedeb8c60bc621f
MD5 4fcad38b32f7a5de21e169b3e87d6bff
SHA1 aaebc9cb228cbd237cee48b6297d4835da815e85
SHA512 0c8081d3661e1e08ca5fc97556576db457859bc5fedf87eed50b2663a43629c77cb65e0899056777bb59ad143cb2968e8e207e5a8dc5488faca970522895cec8
TLSH
T1CA51958B1FA309FBE761E7BE7EE1A4E9727486B944171E084DCC21B8F405B861010338
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a8637c9-9861-4688-a0b9-7bd39a465ed7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8a8637c9-9861-4688-a0b9-7bd39a465ed7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 97a3701885f94aa7aa1193341915620b656eb3ab07a4ebf6d3c37ec95c64d4c3
MD5 f830e7d3dd2e40955e370429751a46d2
SHA1 8260add6cfde235008b2628d65238e06dc4db7f5
SHA512 db0609f3ada1b07924e348eebea13d8a89f1c9e602f37dfa59ecfb2cb468433ca52d23b7aafe9efa4ed86424c80816cebf0acea9a6852a0a41c16c8c4c028b3f
TLSH
T12A41DEF3C3F4857E890196F0AA18AE1BCE2D0515432C7C6AC9E4AE2793E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 41a3c43f95ecf354e373a786b0bc6db3748ffb892fe9e4b1db58a1719714908d
MD5 256ef8b5e4327fced193108b0dd1f28b
SHA1 147319b6eebcb944fda462f3cbcc4645fd8d3b67
SHA512 6645ed075ce0705de881b22c56969ee880ddc3044d305a24f9f3c5e97cc49b6d85bfa03bb0ae4f7840f25d9f84cac5bf64288698377e63537976445340982403
SSDEEP 192:sxRKO8RRCXm/fn+ssGaSrZgDbybhzoA8p9F/g6+WNC96/YE/x3TGsQhIgVfJ:sxRKPq2/f+ssGbFY3v/5x/Jv6D
TLSH
T17B42E8156D28A83B5CCBE21DFB55BF63D3F96032A0951E48AAFC861C04E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 707481d7acda38b38b97d85bbed00579007311cdd9b9eb9df8d3568b8006c66c
MD5 d542e1373796986f4af442d8aae0f90c
SHA1 4fb0c040d0cdc0d1c65734de7ad6f81ce2196689
SHA512 8d669f4554d1a3fd891ee2724f449c2fa68a733f9f13704b895e7f6f0bd45232fdf1f55cd0f63021da3a0ac2e8033a7718724af02c17b7a8214cb748a1c910a6
SSDEEP 192:sxRKr8RRCXm/fn+s5GaSrZgDbybhzoA8p9F/g6+WNC96/YE/x3TGsQhIgDVfJ:sxRKQq2/f+s5GbFY3v/5x/Jv63
TLSH
T1CD42E815AD28A93B5CCBE21DFB55BF63D3F96032A0951E48AAFC861C04E76DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b6d171466f74d243684fbaf8776501873c46d438f68870a5202bbc3f4310c37
MD5 563ceeee590283719b4baa50e1d8a3ff
SHA1 fc287a4cc3904af51e97037e2844e550e53fa8e2
SHA512 5909836d0b289cd7ffe6936420f15ff956774eee1643a978b8e5c031626a999e93674ffa922dffe2862a3aee71d2392e3371d973b206481678c75d812eea348a
SSDEEP 192:sxRKr8RRCXm/fn+s5GbSrZgDbybhzoA8p9F/g6+WNC96/YE+t3TGsQhIgDvfJ:sxRKQq2/f+s5GeFY3v/5x/4v69
TLSH
T1F542D9156D28A97B5CC7E21DFB55BF63D3F96032A0951E48ABFC861C00E76DE221740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 50514b5c7e2dc4f23f18b1594fbacbeac83a7cb925472a90d7f5a7cc7d449b47
MD5 f1b4f9ef1453af094fdfa0721cb71c5a
SHA1 7bcf2b4426b3fa14c86cbb0c0062ce2bdb756f67
SHA512 c889553a9c07758fda3216fcab29434832051d9ec3c24aedb52fc7d573431bf0a6ac3fb056077c54843b75e96483bc9a298e2b363b2061e084f346ed1c22782c
SSDEEP 768:40Dk6DJQD8WF7pLuL7N0DbWgQ6DjfIQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYL:40Dk6DJQD8WTE7N0DbWgQ6DjfIQDFu1C
TLSH
T1F7D2EA7B640CCB7F4F804ADDAD197A9E6D6802CB96D8C98047FA891C02C7BEF51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a1443edecfd34da36443f7f3965613d50f8b433aca5d092bbba51bf93ad3af1d
MD5 6108891cbf60d6e3104516326980467e
SHA1 6174b57f125508878653a569461823b68bc3e821
SHA512 7ad2e60cc2f31582e1b0b72af189ff4ad0d6f3604564a1f428522d0feeba9604d76a6c4908637169f77278e1bb2e7880dbab3267cab4e43051790704757724a2
SSDEEP 96:KRl9lKlDl3ltlHlblPWlDlYlGgl/lPK4leglhlPclFl9lwlToZs4q26gWeDzgggm:Cl9lKlDl3ltlHlblulDlYl3l/l1leglm
TLSH
T11F917651367B57803C3EA55881BCCD2BE68370A63468A83B77E811769F67E125CFE4C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1e28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1e28.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 02db70d1e41ee5bdc1c98df0621691170526785939931b5272bdb2dac23bcc88
MD5 fd65f36f2249f08e42ee6650ac60acc0
SHA1 8b153d1df0236c751d99f16c31ed819f04313c9c
SHA512 bbcef8525a0cb4619d6bdf9ef638477f0403723559358aa156a06338c5efe5d85d4601884675048dfc58faa2807b8b10e5da2335c626ece2639e689f8f6b4c22
SSDEEP 768:N+3DxvWlKDTd+ZUtpneX6+qTko0u229a4vsTIPi9PrtJ:N+3Vv8+2vVTVKa4lPMtJ
TLSH
T1EDF2C070FC659C6359FAE784B25B37876EB51173D6C81A449AEDEA0C054326C2B0F83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 919e4feab9c408efcecd77cea016eedf70844040ee0de9e9bbfd564f679e3cae
MD5 a1d6fececad1c9cac0fb96347f39b504
SHA1 eb95536c4b08d1ee836c939aa1849ba505fbf93a
SHA512 db8f91b732ffad0f910268acf92690a9214ff44271e87f1e02ec024f71f31d403be6fe17ff0fefce892ba444d44eb336530bec12d2a03f4fed04faa7583c9203
SSDEEP 768:oFQn3Wwg3xvWzhnZUtp7eX6+qTko0u229a4vsTIPi9PrtJ:Ln3Yvw+qvVTVKa4lPMtJ
TLSH
T1322339F198D38977D8AE9783633D2E469DBCD163B5885584BBD89D0CCC821BFC70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3915051ffba937f96ffe453bdc398a7b1c401ae19da332e2d8962a6423a55f4c
MD5 c56bf5ecaec204d7068fa295c7892846
SHA1 dc9a9336e7a43fc2bc8adec4b97b26d72ab4dc47
SHA512 e65476b14211684ccf9e0bb09685eae6a3641ead8ed07d853955a7463b8922bd0867f847c09bbea7628ec3a6ca683b4c86160f1958d4faa4532b49361614fe3c
SSDEEP 768:prv+4UNbdG30EpDTd+ZUtAeX6+qTko0u229a4vsDOeVH1SdW:pbsbU3e8vVTVKa4fEH1h
TLSH
T1ED03BF32E8648A778DE79784714B75473FB95163C7C80B80D8ED6B0D069B5AC270BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 88f8d7f2110f9ecfe76b9eeea3a63901465e1c02ca3946520537a6592956b0da
MD5 6cf9544b1aa9aa8b30ae9558487422c7
SHA1 349b50992149a7aebc1187ed2a4f34f616df0fad
SHA512 74571e0a7c14e686f2f6a51322333f34cb6bff7520f68d0e989a787b360ef62a6cef58112d9f6d045514c4a02f6b5a9fcd57436360e07851c4f21907f7317618
SSDEEP 768:Y+3CxvW8KDTd+ZUtpPeX6+qTko0u229a4vsTIPi9PrtJ:Y+3qv7+OvVTVKa4lPMtJ
TLSH
T1CBF2CF70FC659C6358FAEB84B25B36876EF51173D6C81A449AEDDA0C054726C2B0F83B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 db3d2986fac63bcf22c2ebd1ac3daebe59221b9a751eca1998ffda798ac08c45
MD5 56aeda5e8735d2ccde224a6f4b9de969
SHA1 77502670719970bf975188792cd0755b29ab60d1
SHA512 dc0b82bd41f3e8b0abb2dfc2e5d5ea3a32fce6723bc2700764aad8d6882d7a30b1d0f81fc76f88608e4b4707223896533c25d7f5d6438649797b23e2a542e9e2
SSDEEP 768:Rrv+4UNbdG3AfIDTd+ZUtp5eX6+qTko0u229a4vsSIeVH1SdW:RbsbU3Q+4vVTVKa4aEH1h
TLSH
T19B03BF32E8699D7349E6D684714B764B2FB92173CAC40B44D9EDAB4C064B19C2B0FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

3371fc8e-bc3e-421a-b6c9-64b13b06431e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3371fc8e-bc3e-421a-b6c9-64b13b06431e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3156_828997751\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 167a6afeaea91fb82e151086407221fbcf8eec037f1bdadded4079e567eb8a7f
MD5 1170310534be59607d0b02d790d4baa1
SHA1 8f1e60d1e4113a854d0894dafc0cc92e122bacad
SHA512 881cf6e2a281da2b2ac38813e5f634bf93bcf2b1fa6158c561d7fcc1904c9315cc4ae108b3c8e0013f99e32b6c0d5309bec0e79878ac5185e0ac61c96f89fd34
TLSH
T1F371238357B9CAF3C1DA5FF402835248F5FB22384B2370310B555586AB30A7E28B9F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/252-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/464-180-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-213-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-464-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1108-58-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1144-293-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1220-467-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1884-462-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-347-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2292-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2380-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2496-330-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2612-436-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2892-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3408-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-229-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3428-265-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3816-307-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4356-218-0x00000146106A0000-0x00000146108E1000-memory.dmp

Download

memory/4732-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4732-422-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4836-404-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5528-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5756-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5788-257-0x0000000000010000-0x00000000000AB000-memory.dmp

Download