systex | d9638c14755aefa3d76594162ebcd9b1450c42cd73d214c4748d382affc4367c

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260930-kfxmwasfmd
SHA256 d9638c14755aefa3d76594162ebcd9b1450c42cd73d214c4748d382affc4367c
MD5 b162cc86ab995f4ff6f3bdd07ec8b218
SHA1 3a2fe7dc6570b05b620b826e10ff1b6468267b4f
SHA512 6d8d5339c3d121a0940fbcafc18343a070f9b268795fa4aaee1ac49611813d181727cb8defa965e38b20195483d571b7e3f6edd7394776e6c9c846ec17f0351a
SSDEEP 3072:vbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4916	xrpjhczurpmhezwu.exe
4156	xrpjhczurpmhezwu.sys
2000	CreateProcess.exe
3948	czxrpjhfzx.exe
4980	CreateProcess.exe
4268	CreateProcess.exe
1828	i_czxrpjhfzx.exe
2052	omjecwuomh.sys
2372	CreateProcess.exe
2624	jhbzuomgez.exe
4372	CreateProcess.exe
3732	CreateProcess.exe
3040	i_jhbzuomgez.exe
5988	trljhbztrl.sys
4400	CreateProcess.exe
4252	jebwtolgey.exe
1104	CreateProcess.exe
4136	CreateProcess.exe
760	i_jebwtolgey.exe
4724	ytqomgeywt.sys
5056	CreateProcess.exe
4420	ytrljgdbvt.exe
1192	CreateProcess.exe
3588	CreateProcess.exe
4908	i_ytrljgdbvt.exe
5096	bvtqligdyw.sys
2896	CreateProcess.exe
4580	vtnlfdyvqn.exe
3256	CreateProcess.exe
5472	CreateProcess.exe
2220	i_vtnlfdyvqn.exe
3764	tnlfdyvqni.sys
5528	CreateProcess.exe
4312	lfdxvsnkig.exe
4188	CreateProcess.exe
1216	CreateProcess.exe
2328	i_lfdxvsnkig.exe
3360	fdavsnlfdx.sys
3524	CreateProcess.exe
2484	qnhfzxspnh.exe
2384	CreateProcess.exe
4728	CreateProcess.exe
3856	i_qnhfzxspnh.exe
1620	kicausnkfc.sys
2168	CreateProcess.exe
3260	axsqkicaus.exe
4908	CreateProcess.exe
2528	CreateProcess.exe
5272	i_axsqkicaus.exe
3676	hczxrpkhcz.sys
4748	CreateProcess.exe
1220	zxrpjhczus.exe
2648	CreateProcess.exe
4896	CreateProcess.exe
2052	i_zxrpjhczus.exe
5160	mjecwuomge.sys
4876	CreateProcess.exe
6124	ecwuomhezx.exe
4628	CreateProcess.exe
4288	CreateProcess.exe
404	i_ecwuomhezx.exe
3228	uomgecwuge.sys
4296	CreateProcess.exe
3676	bztrljhbzt.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1853290046\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1065547781\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1077306775\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1077306775\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1065547781\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_513698800\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_513698800\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1077306775\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1260_1077306775\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lgdywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ytrljgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lfdxvsnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rlbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnkidavtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkicaxv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnhfzxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xupnhfzxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lgdywqoige.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwuomgeywr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhczurpmhezwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpjhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhbzuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jebwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnhfzxspnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomhezx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ytrljgdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lfdxvsnkig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhbzuomgez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jebwtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rlbvtolgey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqkicaus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urmkecwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqn.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1456	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4580	ipconfig.exe
3676	ipconfig.exe
6120	ipconfig.exe
1520	ipconfig.exe
4380	ipconfig.exe
200	ipconfig.exe
2980	ipconfig.exe
3736	ipconfig.exe
960	ipconfig.exe
4452	ipconfig.exe
4380	ipconfig.exe
2540	ipconfig.exe
1652	ipconfig.exe
788	ipconfig.exe
2688	ipconfig.exe
2384	ipconfig.exe
3000	ipconfig.exe
6120	ipconfig.exe
6060	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1262770251-41185387-1005173349-1000\{D7CD2E81-FBA3-40DC-ADD6-7C041FD94A76}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
4916	xrpjhczurpmhezwu.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	i_czxrpjhfzx.exe
Token: SeDebugPrivilege	3040	i_jhbzuomgez.exe
Token: SeDebugPrivilege	760	i_jebwtolgey.exe
Token: SeDebugPrivilege	4908	i_ytrljgdbvt.exe
Token: SeDebugPrivilege	2220	i_vtnlfdyvqn.exe
Token: SeDebugPrivilege	2328	i_lfdxvsnkig.exe
Token: SeDebugPrivilege	3856	i_qnhfzxspnh.exe
Token: SeDebugPrivilege	5272	i_axsqkicaus.exe
Token: SeDebugPrivilege	2052	i_zxrpjhczus.exe
Token: SeDebugPrivilege	404	i_ecwuomhezx.exe
Token: SeDebugPrivilege	4784	i_bztrljhbzt.exe
Token: SeDebugPrivilege	4956	i_rlbvtolgey.exe
Token: SeDebugPrivilege	1944	i_lgdywqoige.exe
Token: SeDebugPrivilege	5944	i_tnkidavtnl.exe
Token: SeDebugPrivilege	5564	i_xvpnkicaxv.exe
Token: SeDebugPrivilege	5540	i_xspnhfaxsp.exe
Token: SeDebugPrivilege	2984	i_xupnhfzxsp.exe
Token: SeDebugPrivilege	1152	i_urmkecwuom.exe
Token: SeDebugPrivilege	5492	i_bwuomgeywr.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 4916	3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 3112 wrote to memory of 4192	3112	2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe	91
PID 4192 wrote to memory of 1260	4192	iexplore.exe	92
PID 1260 wrote to memory of 3488	1260	msedge.exe	93
PID 1260 wrote to memory of 1456	1260	msedge.exe	94
PID 1260 wrote to memory of 5992	1260	msedge.exe	95
PID 1260 wrote to memory of 5992	1260	msedge.exe	95
PID 1260 wrote to memory of 1612	1260	msedge.exe	96
PID 1260 wrote to memory of 1612	1260	msedge.exe	96
PID 1260 wrote to memory of 1612	1260	msedge.exe	96
PID 1260 wrote to memory of 2372	1260	msedge.exe	99
PID 1260 wrote to memory of 2160	1260	msedge.exe	98
PID 1260 wrote to memory of 2372	1260	msedge.exe	99
PID 1260 wrote to memory of 2372	1260	msedge.exe	99
PID 1260 wrote to memory of 2160	1260	msedge.exe	98
PID 1260 wrote to memory of 2160	1260	msedge.exe	98
PID 1260 wrote to memory of 3776	1260	msedge.exe	100
PID 1260 wrote to memory of 3776	1260	msedge.exe	100
PID 1260 wrote to memory of 3776	1260	msedge.exe	100
PID 1260 wrote to memory of 1904	1260	msedge.exe	101
PID 1260 wrote to memory of 1904	1260	msedge.exe	101
PID 1260 wrote to memory of 1904	1260	msedge.exe	101
PID 1260 wrote to memory of 1544	1260	msedge.exe	102
PID 1260 wrote to memory of 1544	1260	msedge.exe	102
PID 1260 wrote to memory of 5344	1260	msedge.exe	106
PID 1260 wrote to memory of 5344	1260	msedge.exe	106
PID 1260 wrote to memory of 5344	1260	msedge.exe	106
PID 1260 wrote to memory of 2436	1260	msedge.exe	107
PID 1260 wrote to memory of 2436	1260	msedge.exe	107
PID 1260 wrote to memory of 892	1260	msedge.exe	108
PID 1260 wrote to memory of 892	1260	msedge.exe	108
PID 4916 wrote to memory of 2000	4916	xrpjhczurpmhezwu.exe	109
PID 3948 wrote to memory of 4980	3948	czxrpjhfzx.exe	113
PID 1260 wrote to memory of 2696	1260	msedge.exe	116
PID 1260 wrote to memory of 2696	1260	msedge.exe	116
PID 1260 wrote to memory of 2696	1260	msedge.exe	116
PID 1260 wrote to memory of 2224	1260	msedge.exe	117
PID 1260 wrote to memory of 3676	1260	msedge.exe	120
PID 1260 wrote to memory of 3676	1260	msedge.exe	120
PID 1260 wrote to memory of 716	1260	msedge.exe	121
PID 1260 wrote to memory of 716	1260	msedge.exe	121
PID 4916 wrote to memory of 4268	4916	xrpjhczurpmhezwu.exe	122
PID 1260 wrote to memory of 4324	1260	msedge.exe	126
PID 1260 wrote to memory of 4324	1260	msedge.exe	126
PID 1260 wrote to memory of 4324	1260	msedge.exe	126
PID 4916 wrote to memory of 2372	4916	xrpjhczurpmhezwu.exe	127
PID 2624 wrote to memory of 4372	2624	jhbzuomgez.exe	129
PID 4916 wrote to memory of 3732	4916	xrpjhczurpmhezwu.exe	132
PID 4916 wrote to memory of 4400	4916	xrpjhczurpmhezwu.exe	136
PID 4252 wrote to memory of 1104	4252	jebwtolgey.exe	138
PID 4916 wrote to memory of 4136	4916	xrpjhczurpmhezwu.exe	141
PID 4916 wrote to memory of 5056	4916	xrpjhczurpmhezwu.exe	146
PID 4420 wrote to memory of 1192	4420	ytrljgdbvt.exe	148
PID 4916 wrote to memory of 3588	4916	xrpjhczurpmhezwu.exe	151
PID 1260 wrote to memory of 628	1260	msedge.exe	153
PID 1260 wrote to memory of 5800	1260	msedge.exe	154
PID 1260 wrote to memory of 5876	1260	msedge.exe	155
PID 4916 wrote to memory of 2896	4916	xrpjhczurpmhezwu.exe	158
PID 4580 wrote to memory of 3256	4580	vtnlfdyvqn.exe	160
PID 4916 wrote to memory of 5472	4916	xrpjhczurpmhezwu.exe	163
PID 1260 wrote to memory of 5936	1260	msedge.exe	165
PID 1260 wrote to memory of 5936	1260	msedge.exe	165
PID 1260 wrote to memory of 5936	1260	msedge.exe	165
PID 4916 wrote to memory of 5528	4916	xrpjhczurpmhezwu.exe	168

C:\Users\Admin\AppData\Local\Temp\2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-30_b162cc86ab995f4ff6f3bdd07ec8b218_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Temp\xrpjhczurpmhezwu.exe
  C:\Temp\xrpjhczurpmhezwu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpjhfzx.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2000
  - - C:\Temp\czxrpjhfzx.exe
      C:\Temp\czxrpjhfzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2688
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpjhfzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4268
  - - C:\Temp\i_czxrpjhfzx.exe
      C:\Temp\i_czxrpjhfzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1828
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhbzuomgez.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2372
  - - C:\Temp\jhbzuomgez.exe
      C:\Temp\jhbzuomgez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2624
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4372
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhbzuomgez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3732
  - - C:\Temp\i_jhbzuomgez.exe
      C:\Temp\i_jhbzuomgez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3040
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jebwtolgey.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4400
  - - C:\Temp\jebwtolgey.exe
      C:\Temp\jebwtolgey.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4452
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jebwtolgey.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4136
  - - C:\Temp\i_jebwtolgey.exe
      C:\Temp\i_jebwtolgey.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ytrljgdbvt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\ytrljgdbvt.exe
      C:\Temp\ytrljgdbvt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ytrljgdbvt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3588
  - - C:\Temp\i_ytrljgdbvt.exe
      C:\Temp\i_ytrljgdbvt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2896
  - - C:\Temp\vtnlfdyvqn.exe
      C:\Temp\vtnlfdyvqn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3256
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5472
  - - C:\Temp\i_vtnlfdyvqn.exe
      C:\Temp\i_vtnlfdyvqn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2220
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lfdxvsnkig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5528
  - - C:\Temp\lfdxvsnkig.exe
      C:\Temp\lfdxvsnkig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4312
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4188
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lfdxvsnkig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1216
  - - C:\Temp\i_lfdxvsnkig.exe
      C:\Temp\i_lfdxvsnkig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2328
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnhfzxspnh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3524
  - - C:\Temp\qnhfzxspnh.exe
      C:\Temp\qnhfzxspnh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2484
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2384
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnhfzxspnh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\i_qnhfzxspnh.exe
      C:\Temp\i_qnhfzxspnh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqkicaus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2168
  - - C:\Temp\axsqkicaus.exe
      C:\Temp\axsqkicaus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3260
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:200
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqkicaus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2528
  - - C:\Temp\i_axsqkicaus.exe
      C:\Temp\i_axsqkicaus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpjhczus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4748
  - - C:\Temp\zxrpjhczus.exe
      C:\Temp\zxrpjhczus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1220
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2648
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3000
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpjhczus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4896
  - - C:\Temp\i_zxrpjhczus.exe
      C:\Temp\i_zxrpjhczus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomhezx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4876
  - - C:\Temp\ecwuomhezx.exe
      C:\Temp\ecwuomhezx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4628
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomhezx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4288
  - - C:\Temp\i_ecwuomhezx.exe
      C:\Temp\i_ecwuomhezx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4296
  - - C:\Temp\bztrljhbzt.exe
      C:\Temp\bztrljhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3676
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4668
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrljhbzt.exe ups_ins
    3⤵
    PID:4832
  - - C:\Temp\i_bztrljhbzt.exe
      C:\Temp\i_bztrljhbzt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4784
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rlbvtolgey.exe ups_run
    3⤵
    PID:8
  - - C:\Temp\rlbvtolgey.exe
      C:\Temp\rlbvtolgey.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5096
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rlbvtolgey.exe ups_ins
    3⤵
    PID:5836
  - - C:\Temp\i_rlbvtolgey.exe
      C:\Temp\i_rlbvtolgey.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lgdywqoige.exe ups_run
    3⤵
    PID:1128
  - - C:\Temp\lgdywqoige.exe
      C:\Temp\lgdywqoige.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4856
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5808
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6120
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lgdywqoige.exe ups_ins
    3⤵
    PID:968
  - - C:\Temp\i_lgdywqoige.exe
      C:\Temp\i_lgdywqoige.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnkidavtnl.exe ups_run
    3⤵
    PID:1620
  - - C:\Temp\tnkidavtnl.exe
      C:\Temp\tnkidavtnl.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4380
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnkidavtnl.exe ups_ins
    3⤵
    PID:3912
  - - C:\Temp\i_tnkidavtnl.exe
      C:\Temp\i_tnkidavtnl.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnkicaxv.exe ups_run
    3⤵
    PID:4632
  - - C:\Temp\xvpnkicaxv.exe
      C:\Temp\xvpnkicaxv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2100
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnkicaxv.exe ups_ins
    3⤵
    PID:1548
  - - C:\Temp\i_xvpnkicaxv.exe
      C:\Temp\i_xvpnkicaxv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5564
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxsp.exe ups_run
    3⤵
    PID:5552
  - - C:\Temp\xspnhfaxsp.exe
      C:\Temp\xspnhfaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxsp.exe ups_ins
    3⤵
    PID:3816
  - - C:\Temp\i_xspnhfaxsp.exe
      C:\Temp\i_xspnhfaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xupnhfzxsp.exe ups_run
    3⤵
    PID:5932
  - - C:\Temp\xupnhfzxsp.exe
      C:\Temp\xupnhfzxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1920
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:960
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xupnhfzxsp.exe ups_ins
    3⤵
    PID:2376
  - - C:\Temp\i_xupnhfzxsp.exe
      C:\Temp\i_xupnhfzxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urmkecwuom.exe ups_run
    3⤵
    PID:2964
  - - C:\Temp\urmkecwuom.exe
      C:\Temp\urmkecwuom.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4956
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urmkecwuom.exe ups_ins
    3⤵
    PID:1344
  - - C:\Temp\i_urmkecwuom.exe
      C:\Temp\i_urmkecwuom.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwuomgeywr.exe ups_run
    3⤵
    PID:4196
  - - C:\Temp\bwuomgeywr.exe
      C:\Temp\bwuomgeywr.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2744
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwuomgeywr.exe ups_ins
    3⤵
    PID:3344
  - - C:\Temp\i_bwuomgeywr.exe
      C:\Temp\i_bwuomgeywr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5492
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2cc,0x2f4,0x2f8,0x2c8,0x35c,0x7fff9130c188,0x7fff9130c194,0x7fff9130c1a0
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1728,i,2333983186377746966,16962924521164821804,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:11
      4⤵
      System Time Discovery
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,14454310085237664676,470566266143390000,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:13
      4⤵
      PID:5992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,10405131801455771566,8928441592815805181,262144 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
      4⤵
      PID:1612
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3612,i,11953215993357866100,627544878852251662,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:2160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,14018813903233576692,14732343263297073818,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
      4⤵
      PID:2372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4364,i,4444334703193576037,10498460632042015230,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:9
      4⤵
      PID:3776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,12348916110629343965,5179890547428629140,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
      4⤵
      PID:1904
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,4333506599035553691,17426464536812292673,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5416,i,16135137357028337851,12522328979227053996,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:5344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,5218736781396589821,16596201487202319971,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:14
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,2210967704348608643,8253143493799577883,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9206844406796493720,1904052540019456441,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6160,i,10516914186935039457,11557323473829282834,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
      4⤵
      PID:2696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,9206844406796493720,1904052540019456441,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:2224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,11190373562847826713,9891596528679937928,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
      4⤵
      PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5541171003613355910,2453823018335017310,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:14
      4⤵
      PID:716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5644,i,9597136512454714328,879159998979096303,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
      4⤵
      PID:4324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,5801142828706106365,295110902141464845,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,6902720380853385556,5991360722637136031,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:14
      4⤵
      PID:5800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,12909486556693745608,14561984406648711191,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:5876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=1416,i,4840783871735190533,4057437930088366204,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:1
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,11986733914508872782,11903005633692610110,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5640,i,2847481482255411182,7684838674607346153,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6108,i,9136481992050847152,9633492961518231342,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,432298906722627059,12616343663175827374,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3332 /prefetch:14
      4⤵
      PID:5836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6756,i,5649932480700133665,6222391827383755014,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
      4⤵
      PID:5468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=2864,i,5257753882176758450,9702948759190807044,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
      4⤵
      PID:1212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,7708570902067950395,1766865479077963082,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:3248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5620,i,4617855944226014954,9688370369849610138,2097152 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
      4⤵
      PID:2932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,16081650126694058829,13135649821470781953,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4720,i,10120582177226118395,6331872670770792874,262144 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:10
      4⤵
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,12739079164851368222,15758644755827698275,524288 --field-trial-handle=2292,i,3380564002627746998,3797039245534585132,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:14
      4⤵
      PID:952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5136

C:\Temp\xrpjhczurpmhezwu.sys
C:\Temp\xrpjhczurpmhezwu.sys
1⤵
- Executes dropped EXE
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5304

C:\Temp\omjecwuomh.sys
C:\Temp\omjecwuomh.sys
1⤵
- Executes dropped EXE
PID:2052

C:\Temp\trljhbztrl.sys
C:\Temp\trljhbztrl.sys
1⤵
- Executes dropped EXE
PID:5988

C:\Temp\ytqomgeywt.sys
C:\Temp\ytqomgeywt.sys
1⤵
- Executes dropped EXE
PID:4724

C:\Temp\bvtqligdyw.sys
C:\Temp\bvtqligdyw.sys
1⤵
- Executes dropped EXE
PID:5096

C:\Temp\tnlfdyvqni.sys
C:\Temp\tnlfdyvqni.sys
1⤵
- Executes dropped EXE
PID:3764

C:\Temp\fdavsnlfdx.sys
C:\Temp\fdavsnlfdx.sys
1⤵
- Executes dropped EXE
PID:3360

C:\Temp\kicausnkfc.sys
C:\Temp\kicausnkfc.sys
1⤵
- Executes dropped EXE
PID:1620

C:\Temp\hczxrpkhcz.sys
C:\Temp\hczxrpkhcz.sys
1⤵
- Executes dropped EXE
PID:3676

C:\Temp\mjecwuomge.sys
C:\Temp\mjecwuomge.sys
1⤵
- Executes dropped EXE
PID:5160

C:\Temp\uomgecwuge.sys
C:\Temp\uomgecwuge.sys
1⤵
- Executes dropped EXE
PID:3228

C:\Temp\ztrljebwto.sys
C:\Temp\ztrljebwto.sys
1⤵
PID:5196

C:\Temp\vtolgdywqo.sys
C:\Temp\vtolgdywqo.sys
1⤵
PID:5272

C:\Temp\avtnlidavt.sys
C:\Temp\avtnlidavt.sys
1⤵
PID:4812

C:\Temp\faxvqnhfax.sys
C:\Temp\faxvqnhfax.sys
1⤵
PID:1688

C:\Temp\icausnkfdx.sys
C:\Temp\icausnkfdx.sys
1⤵
PID:3976

C:\Temp\cxvpnhfzxs.sys
C:\Temp\cxvpnhfzxs.sys
1⤵
PID:2396

C:\Temp\upmhezxurm.sys
C:\Temp\upmhezxurm.sys
1⤵
PID:4968

C:\Temp\jwuomjebzt.sys
C:\Temp\jwuomjebzt.sys
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtqligdyw.sys

Path C:\Temp\bvtqligdyw.sys
Size 293KB
SHA256 6b7e605cbd9eb64b7bc6045a266cd5502d3f5dc0fd1c5d4d6a85a0152cc06829
MD5 9e4f09436897b4827c14d9a91fecc24a
SHA1 28030365466bd0c40f8c66c2c477a76b5b88e831
SHA512 218f90c3098d187a61d8857bb37abae34043213d428b210fd09fc7cfdd160ef5102989db689c1ba3b940eb3af4ce8bcd649f9da80efca8ee354564d7092c732b
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T14D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

czxrpjhfzx.exe

Path C:\Temp\czxrpjhfzx.exe
Size 384KB
SHA256 4973df6d350f88c5ad82461dee02fe22a831d6dfc48c04425bc5b1c0ea04f1a9
MD5 0bd2cc162a9475b7027c1e66522010e1
SHA1 bdfa401aa8bd85cda1329434745ad496436b6d71
SHA512 f74f17c3cab25bb2535ab32322289ae06423eb131c2aa89bffabca5101c494d3c81b4d37144666623747b36e3a90037dc5b14a817792a7684b2d3b84f720a521
SSDEEP 3072:NbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Nbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_czxrpjhfzx.exe

Path C:\Temp\i_czxrpjhfzx.exe
Size 384KB
SHA256 ba54202659d92b863bb2d506e287ffffafbd479b5dfe7bf88e4714cb0741b600
MD5 fe96174b62a76437dcaed84c7d166fc8
SHA1 ba3534171599dbbd816ca932adb6b9e2c5e1678e
SHA512 a9ec90be6272fea9d663b373170c99582d77b7ccd1d238e363db89206b97bb6a943af103d0dee906d431d0c55a7696915f020772dc9fb9017062ae6d76468b46
SSDEEP 3072:cbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:cbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12F847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jebwtolgey.exe

Path C:\Temp\i_jebwtolgey.exe
Size 384KB
SHA256 f44cbbf4e2a948dbdd33989d641647f5a6536a011940ea92eb4eff6697565dc4
MD5 2ca84d020bb71cc96848336e8622f82e
SHA1 8e78c427366ae93d9f13230a14c1d0742d756e21
SHA512 463e426f0f83950a88a90cae57e9e2df36c623f30d8ab979f2d0675fcad66f6600141cca4705d51bdde07fd83a746f546bd81acaf4f7d5b21b5caf06af7ace3a
SSDEEP 3072:TbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T153847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhbzuomgez.exe

Path C:\Temp\i_jhbzuomgez.exe
Size 384KB
SHA256 28724b02affc1fc3dd056acf4355f8a273d7864ce57b25cee04f053a445b0214
MD5 46961f2848e4cab02287daffa69263ff
SHA1 fe6ba1be08402e6eed9b82e3bbd09c12b60d4838
SHA512 d95ce19a827918522c068394c7a8a1d8a6f7c1f5184f2ead269257e00605c7d423d36bc49cf9b2d8bd853a4b35e415bdb6faf1118ef6efb97da44e4f5c5cdaaa
SSDEEP 3072:hbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:hbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdyvqn.exe

Path C:\Temp\i_vtnlfdyvqn.exe
Size 384KB
SHA256 d99e1a9b07b32fc760b1bc387e2f632d06adfc99e7a3acbf58975c4158fad805
MD5 309b3f42b9ffcbb56669b9c371dac367
SHA1 3c8c020e948950d136e5861a497315aa7d975195
SHA512 b0faa949e29a4502a9e4ed979eab59dd65244480c1a5730de45132d9914d18821b9bbc14196237a6d89826b10655715e5e396c92ebbed8e66bd5f9b98b7f2e4a
SSDEEP 3072:tbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:tbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A517C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ytrljgdbvt.exe

Path C:\Temp\i_ytrljgdbvt.exe
Size 384KB
SHA256 422741f61de1c848b39228cff1e6eae9a0103f4ff9e0d7bd610811e8c91ac45a
MD5 9dcf8a005069eff0f814a203961fa258
SHA1 f13f284f01e7f898a45c11f0891c4ccb38746808
SHA512 e5b611b716cb4b327650f343219d33e38d2e46c9411434fd0a3b82ea0fef3b4d53a06350e29db2d9c3c25ebbcaf11130c475af11f965e81c45abbe8da998087e
SSDEEP 3072:WbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Wbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwtolgey.exe

Path C:\Temp\jebwtolgey.exe
Size 384KB
SHA256 97aa896eb76d29f0bdc0416e0a066e98d7b527bbccc1b25943725205282e1a24
MD5 8336ae7b031faf4002469d3f60fb6598
SHA1 a75d53432f969378e185f6ff760605f6fb7446b8
SHA512 08b9b6d490b449a096cd6b5ca860e303bf41402d85d373824897bb03ecd68ba641789364ea2064008908c24cceb9a9d77808308cd0abff1fc459934df17e47fe
SSDEEP 3072:8btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:8btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T138847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhbzuomgez.exe

Path C:\Temp\jhbzuomgez.exe
Size 384KB
SHA256 8419a05f72477e17fa9b134c1e8b490523d17fbfc33918242b432174fec1a573
MD5 49667ddb1755ecc2f171870c36df9ec9
SHA1 f4610233bd94a9ed09bdc08a81e655c38c27287c
SHA512 bd003dc7ad7753b8aedff01696c1adb1c75dbb783b5ea4aadda3e7f2fd1316e4791f0c5a9c4adf265521550b222142a7e1e75bb500b949410d5c2e61e1161e73
SSDEEP 3072:9btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:9btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CC847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lfdxvsnkig.exe

Path C:\Temp\lfdxvsnkig.exe
Size 384KB
SHA256 bfb3c275fa42f3e4adab7fc2985b235e21a0cb5dc43d4aa1d6d60a12463847a7
MD5 daf7adc4e3e96b1e81267f1ca85e09fb
SHA1 1d90bd28cfe62c4252abdd0b922a796cf09aefb1
SHA512 a318adba9b18271689bc4e7b7f106773c5c16fbe2a7e1e7686019aed94b3600c15f98c785ddab7440e162a5e2053b8141f4fcbe80d671d80b92894a9f142809f
SSDEEP 3072:/btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:/btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F0847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

omjecwuomh.sys

Path C:\Temp\omjecwuomh.sys
Size 293KB
SHA256 94eec37188b8bc1882685ffc96ad41ab51826a5a86d1235bd72be118b8c7bc6f
MD5 a550088d90988e04d85adc69f72f6591
SHA1 5ff684bdf391700c0a5836bb29a930352ade57a2
SHA512 db1c750eff2cd7300bcfe53d5e3d888f28ea43b86ff9d4dd00b57d264986deffd0b31d55cdccd73688168d5262675d9a253b1c9af9ab4a4da249ee86df27296f
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EB545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlfdyvqni.sys

Path C:\Temp\tnlfdyvqni.sys
Size 293KB
SHA256 e9351a90ed7de1c461b95870ec6f1e965f544dd20d259108e7436594e2fb2c1b
MD5 e0259f8f5f4ca6ba18468b278b1ace5a
SHA1 5bcceabf69154c3e60171afc52ad530c5843371d
SHA512 6014e31eb8a6fb048dcfc8238e17417ff3c65a089bf04b5f28a68e9576cec38c665f5b368c2ecbcd00323a9c72df1ba9abf8c70e2fd4a511210c5a1dc38496ed
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trljhbztrl.sys

Path C:\Temp\trljhbztrl.sys
Size 293KB
SHA256 ddc9d17ac71bf8e86d14ecdbc022dc7563b1ed9af1b9e64245267d45585f9582
MD5 ae6f0edce7df08d9c55995a386ce4b14
SHA1 72145a05f6a90e1beb7716511f666c3687fa1e14
SHA512 64d9feee67380b442acc6b585252279865456494e64220d3d9a6c34a25b130a49812e581efca1c288b8f7464590e20b151a8bb219fb9f18b1bd6ee551bbdd5f2
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1AC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdyvqn.exe

Path C:\Temp\vtnlfdyvqn.exe
Size 384KB
SHA256 95b481cdbf4bfda385cf4f32508740a21e6fa8f36e7ecee846fb8ec81f131122
MD5 b2a7b0bedf555e27ec769fa452b2d0c0
SHA1 7d3b4169605a34fb280d5f1b2e999fd911e1c610
SHA512 dc351f56ca3a17ca2bc0fb368b55043fca50d0c29c9ac5bce910f7a9ec72dacd7d4ec80960c4bb355b3282a385878c7015dcc4500c967e661f87889f15695724
SSDEEP 3072:JbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:Jbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T12D847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurpmhezwu.exe

Path C:\Temp\xrpjhczurpmhezwu.exe
Size 384KB
SHA256 79c567710d188ac83309b6c974627fbbcacc5df34cba6e14b1b02dcc7543b057
MD5 f6de8e92fb0f99a279442cca516eeea4
SHA1 ffdb4305aa6c6aff720c6e8518f47c5ed9f72b58
SHA512 dd8dc5022732ed48804465cd084968eed12aa86127632b9b808e5cff0b58e545371175c7871689833392a6e1ee6bbd485e288a57ea42b9ccdbed45b24e6e6692
SSDEEP 3072:vbtF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:vbtt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC7F354CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xrpjhczurpmhezwu.sys

Path C:\Temp\xrpjhczurpmhezwu.sys
Size 293KB
SHA256 e0204c33de1ad94132af3cd54591d9d500d920652cc126767c7d91380e93e403
MD5 c868fadf16d18d76943b3c83c6f1177b
SHA1 272b375221753f23feff9b31ceeb01f561a6e1e0
SHA512 c3b5185563bae59f2e34df03ce72be3fa823ce517e0bbe6cedfdc2919446db8e373139e429271b6044191582d9c3c513738d15508a418db215ea8b4dd1d53a2e
SSDEEP 3072:9tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:9IJjiJcbI03GBc3ucY5DCSj
TLSH
T159545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqomgeywt.sys

Path C:\Temp\ytqomgeywt.sys
Size 293KB
SHA256 3da6ebc94da7f4ad23b71b98e2893083cb8700604ddd5a2c81121b80152b723d
MD5 b98f5ba7ddbfc023d4993a542b3ad7eb
SHA1 d447a8497f81eda34b347c939fa874d8f0a0be33
SHA512 5d1cff60104bbabebdc7ecf30eb642e78392cc80da71ac82b890d9f4fd2988e4d8c52be6cf7cfaec7ed352a2b699e43d4baf1aaf5629cbf1a498c6cc890a8329
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytrljgdbvt.exe

Path C:\Temp\ytrljgdbvt.exe
Size 384KB
SHA256 48ee10f6826a9365cdb272a36767fcc28746bea35e35685c5a1b08f12b830afe
MD5 5d54d10670a92a95710e07797fbbb4c4
SHA1 d31797252a768b160d94eb0bdcd2de671e1ecd36
SHA512 8d015bee35409ced1ebb9dc219055c6ecbb40fd751d0c207e4a1bd84d9dbe0236a53a6edcc83d4fdddccd29074f5f1d177ed3f8afe6423d071ac6f207e28e67e
SSDEEP 3072:+btF73aMr4yhtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:+btt/IJjiJcbI03GBc3ucY5DCSjX
TLSH
T10B847B04BAA4F0F6C895043800DFAF36A67EB4281726CBC3F754CE5D9A417C3A93569B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0a1e646beadfff70af6a1dc73b6baa41188262ddbb2b7781270d4e94c92c02be
MD5 893220bb58a1416480d52375128fa19a
SHA1 3a577208211e9133f3744d9ba695501b0481ca9b
SHA512 b3f0e3d85398f7aa7fcea74cd44fd2709c0265d9072771dccfe7508832bc1173f452a0f49028e8bd62ea434676abcdf4a111c8e31f121871fbdfa4acf207b131
TLSH
T1C2D02B3179BCD772C18C503E405A01112A85F001FD46C1801A53F10848913400005281
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e1837ee53009f9b691f7aee3be45ffb945d4894bf04ccaf875b9947114bb5224
MD5 58ba31abb4a3fd3bbc9aadea4fc9ca13
SHA1 d79c4b2ccee6dadb45162ea34fb988911510f0b8
SHA512 0c096d7f5d364e0911d26f4bc2ea03e3d81b2026be5182b04fc17e7949640761db8056138b55b28aa9abe884d601d2cf6b1be9e992fd3565c35c69def459d32a
TLSH
T1F3D02B3579ACD772C18C503A405901112A95F001FD46C1801953B10848913400006295
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 16f018818a414586a1ec4a13924272be7ce31785460c91f6ee33ce9f24431513
MD5 c509c9b57a037af311008b52518560f5
SHA1 0ed0b8bd108654544bbdaeedfe43e45ebcd3b91b
SHA512 28aadad1bc0195d87d0afa9955fcada30eff6078ea3e58528c20b43c0315aa0512c2258bb6825903d7ed4333f999270db8b2fc5481da79ac5731bd11a098ae71
TLSH
T12671CB1AAB328A46FBD43AB48AD60E963E77908CAFC34F4051D6C1F41E273A384644DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5965c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5965c5.TMP
Size 3KB
SHA256 fac7824db507ccd50a7bf08e850477cf63f2b8fee0b742333c52905f63fa6930
MD5 a18c60d3e6009d195278b1841a802339
SHA1 0ecc9c1304c4cabcb37ec75f33a1f3d942c5cfa1
SHA512 b25fa580928ce9a90c3c9f21331be5f42416e396d22f6e01c31cc7e243081f39315622043b3e25605a92015c3692307ff08d8065763e9feadc5a9c5d729685d7
TLSH
T1B971CB1A9B328A45FBD43AB48AD60E963E77908CAFC34F5051C6C1F41E273A384640DC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cd3ef601bb8c953e7283490475c2e64042a87300e6d82a9f674ea1c6119df00f
MD5 d1f71b1636d41c6ec7e7abb5693b0c0c
SHA1 0d3e4bc8ad0d9e09a93b02addb2cc1c35a663786
SHA512 7e2c1b1e2ce0fccf1acf02bca6b46af2b13aac6cd47519bb433930156caffb4dfcaed522a2660a5d843c1f855d9bf9e7b290ae8853d6494cf2fe1b655a600aab
TLSH
T12651A0F3C3E8866D891156F0AB187E2BCE1D0954432C3D5AC8E4AF2B93E34B1E14199F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 23d419b42d25fd82c4589f8bf9713aa4a4f97fc846fc895fd460de0322a3917b
MD5 b2bf21f60a1170991a6b2d5d529121ad
SHA1 9c1af755dc585a274495970257d8bce21bcb5fbb
SHA512 1799f42786f76b888dff305fa5161deb336eed27d69cf50f396468cb4522f1ab69ef095e4fb2b9a631cb801a663b82e22d4a4920bdf64d17ad09b4ad6262a4a3
SSDEEP 192:sxRURkCE/fvsGZZuMhPq2pzoA8p9X/g6+WNIYdqwGvlIgVoJ:sxRURE/fvsG3xq20x/5Inm
TLSH
T1B832A615AD68A97B9CCBE21DFB657F53D3F91032A0911E48BAFC861C04EA6DD120781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9066fff6dc154033996088ebe1d7bb4967774f77e29cdc21c900b154173c62eb
MD5 6477680081c1c0db7284ec4946605053
SHA1 11163508942334df38a568c584ba3c20fccc456e
SHA512 5b695ef66d9b50a79a36ef5cb92ed8cca3b26c705e0fcca6c997fe7c3babe6e906aa8ae580efa4efa83486724e702715b68ebaf022da357d73796dcdcf338886
SSDEEP 192:sxRvRkCE/fvsrZZuMhPq2pzoA8p9X/g6+WNIYdJwGvlIgDGoJ:sxRvRE/fvsr3xq20x/5I8v
TLSH
T1B342B615AD68A97B9CCBE21DBB557F53E3F91032A0911F48BAFC861C04E76DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6f927978ec46bd9417cc2c5440787d12558eb8309f1300e25b0910f1412ab312
MD5 ace43df308b48a61b7e8b77a18d1342f
SHA1 93310cc79253fdf50985cfd8cd940bf78efbb53d
SHA512 063be3a1790f157fb26785e05a2567b7ad39b42062e9b550e7032994c81bd3fca5df273d7839252ea235c89419d0bc4f3d9d4a7dbde5c94bb6f77bad69ad8abb
SSDEEP 192:sxRvRkCE/fvsYZZuMhPq2pzoA8p9X/g6+WNIYdqwGvlIgDkoJ:sxRvRE/fvsY3xq20x/5InB
TLSH
T157329615AD68A97B8CCBE21DFB657F53D3F91032A0951E48BAFC861C04EA6DD120781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1185baa1abbbe05e4ad7d30fc6fe65ba5edcdc766acfc0893a86356230b365da
MD5 8b26d84d3109e7bfc15e534e55e7a05b
SHA1 8b590e71ee4a0c6cd88154ccdc7cec20172c5797
SHA512 93d912c09ad9966939e25d9ffcc38576f528aaefc00c7b34f9775b0b7a07c2c6d7b4801064f1339c3e062b314fd7941ee7d9e3516d8e0d2b05d071f459322bd2
SSDEEP 768:qF+z8U7pLuLb9oWgU6f8S8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTNIIGUCro12:qF+z8YEb9oWgU6f8Su1jaINIxUZM
TLSH
T1C0D2E97B740CCB7F4F900ADDAC197E9E6DA802CB9698CD4047FE941D02C6BEA52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0001.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0001.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 df3b8ee2dc3922af5d916c4f13c612da332eca1fb6af5c0db097adb90fa60e43
MD5 45705b8855e853869aa2c31e4276c0d2
SHA1 3f23581679917ad7e881022f22fa944c0e5c1830
SHA512 5cda00293fe785068cee6653948fb2f39a54ea6ca462cdb14e7ef8f6fd6c38ce7e2a28cce498cc29c5eb3f574f2334765fcfc5b5c7eeb1514356ac07c42b39cc
SSDEEP 768:B/UxvxjgC+CZ3YTejE28K3Op1h3Yogkl5akl8pbHW0AWThSHvP0Vv:UZj3+I3Bi1h3Yog05akl4bHW0AYSCv
TLSH
T15903C039EC659D778EE6A244760AA317FFF89463AAC4569449DC9F0D02873BC030B853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 9fcd9e6db21bfeae30b9080bb30230abd5808bcf8919cc059af00262f05284a9
MD5 c2a06f15f0f836b040e85750afd78dd6
SHA1 1ecbbd49482e4ab069092749d5026de1a68ea79b
SHA512 f3cf34f6de0351f0abd3a68dbc49ae0b3cd1676bc26e12987b2b365824505a9f9350bd5ab720a18e8bb2d617f1826023ae2f7c104298f34dc98284f24c66b120
SSDEEP 768:df3JvAqK3OY1h3Yogkl5akl8pbHW0AWDs3DrgvPtN:df3J01h3Yog05akl4bHW0AxzrgNN
TLSH
T16FF2AF34ACB59E738AEAE184B5567217BFF89463AAC44A84C5CDDB0D01476ED170FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 7dea9b25af43ad7e054ed38079868eee095542f44f6e8151b342dcc8cb143c57
MD5 ec0851b880802d3a8bc7adafc2e5bc30
SHA1 1e3e8f27dfd8c2f22974732d442cec772f2c29dd
SHA512 90b16300c484e42b94d1272bb06007c421f2f618417ae84a801ca805ed685c96bf9cac3e914bfbc60acf326e733f88c2405b2a4946b2858fb7c6dc7b967bb42f
SSDEEP 768:RFQPo3CwgEvADe3OK1h3Yogkl5akl8pbHW0AWDs3DrgvPtN:gw3Lf1h3Yog05akl4bHW0AxzrgNN
TLSH
T1A3038D36D8A4DA779EE797C5B6057647EFF440A38AC899C4D5CD9E0D00872EE070BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6a0cafdaef7a5876ac406136a9c7609c0532ea45a4cb34fcc6a5eadf203e3e6a
MD5 c93c8a4d5851d3ab65ce3084413d29de
SHA1 1f76f87c1825db84b9bf27bc1536b7b68ccd76ab
SHA512 9749e56a9063ad4efb93291b9c490116db5d8e14089f00c71fb31161074325f030a56042078308455fac22d51e9c170dd2b0b28448b921e9f707bbb704a97d1c
SSDEEP 768:3/UxvxjgC+m3tpAqK3OM1h3Yogkl5akl8pbHW0AWDsE7M:qZj3+m3tq1h3Yog05akl4bHW0AxE7M
TLSH
T14903C035ECA9AE338AE6E244B20A6357EFF4547369C4499889DD8F0E05873AD070FC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 e5401949354765a500d7ee0b7421e9c06405cfa6a571f414bef8452228760bcc
MD5 3bd04b17cd850fedc60e15d1959d4c32
SHA1 af4a2153562f483c56e5cd2aee131e4552e5e364
SHA512 a4729d3891caadc6ecc7da16c16654d971c3cc74e5f0bd20355724c56d892b05aada9e31846443d98565ee562d6c20722eccaa02e9528f794eb2ff3544e5ebca
SSDEEP 768:Lf3svAqK3OY1h3Yogkl5akl8pbHW0AWDs3DrgvPtN:Lf3s01h3Yog05akl4bHW0AxzrgNN
TLSH
T178F2AF34ACB59E738AEAE184B5567217BFF89463AAC44A84C4CDDB0D01476ED170FC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

61ecd728-b7c1-4e8a-8223-532e68abdd87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\61ecd728-b7c1-4e8a-8223-532e68abdd87.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1260_1918527648\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 afe105507f15240eeb30a67ede0d4eb0473f0cac2f0a57df417fa44e8b5df99c
MD5 6e7b6f4a665557e626d7841a8e9658c0
SHA1 ae336d3ec62e1a4761f9b2f33dc2aa9c944919c2
SHA512 05b4ae3437b068ff6ce87cd4bb2a4fdd9b0bdb52d7bb5e64e1e3d0f94bd40c272eb5355dec27b012f67c24b6dd050a5705b611fa0d4a256c7c623063f9c872e9
TLSH
T1D771238396B8C9F2C6DA5BF002835644F5FF22380B3370710755554AAB30A7A14B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-487-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1620-310-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1688-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2052-185-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2396-465-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3228-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3360-311-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-352-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3676-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3764-301-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3976-435-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4156-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4724-260-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4812-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4968-469-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5096-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5160-346-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5196-380-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5272-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5988-232-0x0000000000010000-0x00000000000AB000-memory.dmp

Download