systex | 3ea11634130bdca2c6ebe49e59db5bd4a7b9c30b45fdf323b2ddf03d9d14b4f7

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 365KB
Sample261002-kn5y8atthy
SHA256 3ea11634130bdca2c6ebe49e59db5bd4a7b9c30b45fdf323b2ddf03d9d14b4f7
MD5 92edcdaf58eb0491a1225f2aade92269
SHA1 fc7eb68147dd8aa3f14327f7118488cbbdb94041
SHA512 4632498c70b2247c265346a80957952164fb9ea2b95732bebe1d7c874d300a575a6fc3b1bc83e9aac95cf777f14e8b52507ec30fac1da76b17f44d811fe7ad4e
SSDEEP 3072:guxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:guxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1F2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
5684	tqlidbvtqljgaytq.exe
5008	tqlidbvtqljgaytq.sys
5328	CreateProcess.exe
4160	dbvtnljdbv.exe
5848	CreateProcess.exe
2672	CreateProcess.exe
1892	i_dbvtnljdbv.exe
5596	vqoigayvtn.sys
1840	CreateProcess.exe
2688	gdxvtnlfdy.exe
5676	CreateProcess.exe
3136	CreateProcess.exe
3300	i_gdxvtnlfdy.exe
5892	ayvtnlfdxv.sys
5204	CreateProcess.exe
4604	aysqkicxvp.exe
1896	CreateProcess.exe
5276	CreateProcess.exe
3676	i_aysqkicxvp.exe
2352	uspkifaxsp.sys
4100	CreateProcess.exe
1148	xvpnkfcxus.exe
2656	CreateProcess.exe
5596	CreateProcess.exe
3560	i_xvpnkfcxus.exe
3080	hcaurpnhec.sys
4568	CreateProcess.exe
2372	hfzxupmkec.exe
2704	CreateProcess.exe
1340	CreateProcess.exe
5284	i_hfzxupmkec.exe
2444	jhfzxupmhe.sys
3716	CreateProcess.exe
2692	ecwuomgezw.exe
792	CreateProcess.exe
4800	CreateProcess.exe
2420	i_ecwuomgezw.exe
5816	omjhbzxrpj.sys
544	CreateProcess.exe
5304	wuomgecwro.exe
1892	CreateProcess.exe
1344	CreateProcess.exe
2652	i_wuomgecwro.exe
1124	gebwtomjeb.sys
1664	CreateProcess.exe
5808	jgeywqoljh.exe
4472	CreateProcess.exe
5116	CreateProcess.exe
1084	i_jgeywqoljh.exe
200	igdywtolgd.sys
3268	CreateProcess.exe
5892	bvtolgeywq.exe
2180	CreateProcess.exe
6028	CreateProcess.exe
2332	i_bvtolgeywq.exe
2676	vtqljdbvtq.sys
1256	CreateProcess.exe
1932	nifdbvtqli.exe
3160	CreateProcess.exe
756	CreateProcess.exe
1440	i_nifdbvtqli.exe
5492	qnlfdyvtnl.sys
2192	CreateProcess.exe
3124	nlfaxvqnig.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1575428993\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1688202366\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1688202366\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_721608990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_721608990\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1503407895\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1503407895\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1503407895\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1503407895\office_endpoints_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qolgdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qolgdbytqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlgdyvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnkfcxus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rpmhfcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icausqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rpmhfcwurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwrpjhezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgecwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdbvtqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfaxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfaxvqnig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqlidbvtqljgaytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aysqkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgecwro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jgeywqoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfcxupkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfcxupkhca.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bytrljdbvt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlgdyvql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gdxvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfzxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_aysqkicxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfzxupmkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jgeywqoljh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rljebwtomg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdxvtnlfdy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtolgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icausqnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rljebwtomg.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3016	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2660	ipconfig.exe
3432	ipconfig.exe
3356	ipconfig.exe
4308	ipconfig.exe
2332	ipconfig.exe
2684	ipconfig.exe
2468	ipconfig.exe
5188	ipconfig.exe
2008	ipconfig.exe
4408	ipconfig.exe
4388	ipconfig.exe
4644	ipconfig.exe
5100	ipconfig.exe
3384	ipconfig.exe
4292	ipconfig.exe
5840	ipconfig.exe
1256	ipconfig.exe
4052	ipconfig.exe
944	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{FABF1220-39AB-4D6D-BC51-757E1D8E8347}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe
5684	tqlidbvtqljgaytq.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	1892	i_dbvtnljdbv.exe
Token: SeDebugPrivilege	3300	i_gdxvtnlfdy.exe
Token: SeDebugPrivilege	3676	i_aysqkicxvp.exe
Token: SeDebugPrivilege	3560	i_xvpnkfcxus.exe
Token: SeDebugPrivilege	5284	i_hfzxupmkec.exe
Token: SeDebugPrivilege	2420	i_ecwuomgezw.exe
Token: SeDebugPrivilege	2652	i_wuomgecwro.exe
Token: SeDebugPrivilege	1084	i_jgeywqoljh.exe
Token: SeDebugPrivilege	2332	i_bvtolgeywq.exe
Token: SeDebugPrivilege	1440	i_nifdbvtqli.exe
Token: SeDebugPrivilege	2356	i_nlfaxvqnig.exe
Token: SeDebugPrivilege	2360	i_icausqnlfd.exe
Token: SeDebugPrivilege	1820	i_hfcxupkhca.exe
Token: SeDebugPrivilege	5492	i_rpmhfcwurm.exe
Token: SeDebugPrivilege	5908	i_bzwrpjhezw.exe
Token: SeDebugPrivilege	5672	i_rljebwtomg.exe
Token: SeDebugPrivilege	4232	i_bytrljdbvt.exe
Token: SeDebugPrivilege	5640	i_qolgdbytqo.exe
Token: SeDebugPrivilege	1928	i_vtnlgdyvql.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 5684	3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 3212 wrote to memory of 1360	3212	2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 1360 wrote to memory of 5052	1360	iexplore.exe	91
PID 5052 wrote to memory of 2752	5052	msedge.exe	92
PID 5052 wrote to memory of 3016	5052	msedge.exe	94
PID 5052 wrote to memory of 2028	5052	msedge.exe	96
PID 5052 wrote to memory of 2028	5052	msedge.exe	96
PID 5052 wrote to memory of 5932	5052	msedge.exe	95
PID 5052 wrote to memory of 5932	5052	msedge.exe	95
PID 5052 wrote to memory of 5932	5052	msedge.exe	95
PID 5052 wrote to memory of 5200	5052	msedge.exe	97
PID 5052 wrote to memory of 5200	5052	msedge.exe	97
PID 5052 wrote to memory of 5200	5052	msedge.exe	97
PID 5052 wrote to memory of 592	5052	msedge.exe	98
PID 5052 wrote to memory of 592	5052	msedge.exe	98
PID 5052 wrote to memory of 592	5052	msedge.exe	98
PID 5052 wrote to memory of 4404	5052	msedge.exe	99
PID 5052 wrote to memory of 4404	5052	msedge.exe	99
PID 5052 wrote to memory of 4404	5052	msedge.exe	99
PID 5052 wrote to memory of 4084	5052	msedge.exe	100
PID 5052 wrote to memory of 4084	5052	msedge.exe	100
PID 5052 wrote to memory of 4084	5052	msedge.exe	100
PID 5052 wrote to memory of 1480	5052	msedge.exe	101
PID 5052 wrote to memory of 1480	5052	msedge.exe	101
PID 5052 wrote to memory of 5316	5052	msedge.exe	106
PID 5052 wrote to memory of 5296	5052	msedge.exe	105
PID 5052 wrote to memory of 5316	5052	msedge.exe	106
PID 5052 wrote to memory of 5296	5052	msedge.exe	105
PID 5684 wrote to memory of 5328	5684	tqlidbvtqljgaytq.exe	107
PID 5052 wrote to memory of 5424	5052	msedge.exe	110
PID 4160 wrote to memory of 5848	4160	dbvtnljdbv.exe	112
PID 5052 wrote to memory of 5128	5052	msedge.exe	115
PID 5052 wrote to memory of 5128	5052	msedge.exe	115
PID 5052 wrote to memory of 3536	5052	msedge.exe	116
PID 5052 wrote to memory of 3536	5052	msedge.exe	116
PID 5684 wrote to memory of 2672	5684	tqlidbvtqljgaytq.exe	120
PID 5684 wrote to memory of 1840	5684	tqlidbvtqljgaytq.exe	124
PID 2688 wrote to memory of 5676	2688	gdxvtnlfdy.exe	126
PID 5684 wrote to memory of 3136	5684	tqlidbvtqljgaytq.exe	129
PID 5684 wrote to memory of 5204	5684	tqlidbvtqljgaytq.exe	133
PID 4604 wrote to memory of 1896	4604	aysqkicxvp.exe	135
PID 5684 wrote to memory of 5276	5684	tqlidbvtqljgaytq.exe	138
PID 5684 wrote to memory of 4100	5684	tqlidbvtqljgaytq.exe	143
PID 1148 wrote to memory of 2656	1148	xvpnkfcxus.exe	145
PID 5684 wrote to memory of 5596	5684	tqlidbvtqljgaytq.exe	148
PID 5052 wrote to memory of 456	5052	msedge.exe	150
PID 5052 wrote to memory of 2684	5052	msedge.exe	151
PID 5052 wrote to memory of 1188	5052	msedge.exe	152
PID 5684 wrote to memory of 4568	5684	tqlidbvtqljgaytq.exe	155
PID 2372 wrote to memory of 2704	2372	hfzxupmkec.exe	157
PID 5684 wrote to memory of 1340	5684	tqlidbvtqljgaytq.exe	160
PID 5684 wrote to memory of 3716	5684	tqlidbvtqljgaytq.exe	164
PID 2692 wrote to memory of 792	2692	ecwuomgezw.exe	166
PID 5684 wrote to memory of 4800	5684	tqlidbvtqljgaytq.exe	169
PID 5684 wrote to memory of 544	5684	tqlidbvtqljgaytq.exe	173
PID 5304 wrote to memory of 1892	5304	wuomgecwro.exe	175
PID 5684 wrote to memory of 1344	5684	tqlidbvtqljgaytq.exe	178
PID 5684 wrote to memory of 1664	5684	tqlidbvtqljgaytq.exe	182
PID 5808 wrote to memory of 4472	5808	jgeywqoljh.exe	184
PID 5684 wrote to memory of 5116	5684	tqlidbvtqljgaytq.exe	187
PID 5052 wrote to memory of 5956	5052	msedge.exe	189
PID 5052 wrote to memory of 5956	5052	msedge.exe	189
PID 5684 wrote to memory of 3268	5684	tqlidbvtqljgaytq.exe	195
PID 5892 wrote to memory of 2180	5892	bvtolgeywq.exe	197

C:\Users\Admin\AppData\Local\Temp\2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_92edcdaf58eb0491a1225f2aade92269_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Temp\tqlidbvtqljgaytq.exe
  C:\Temp\tqlidbvtqljgaytq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnljdbv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5328
  - - C:\Temp\dbvtnljdbv.exe
      C:\Temp\dbvtnljdbv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5848
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnljdbv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\i_dbvtnljdbv.exe
      C:\Temp\i_dbvtnljdbv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1892
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gdxvtnlfdy.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1840
  - - C:\Temp\gdxvtnlfdy.exe
      C:\Temp\gdxvtnlfdy.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5676
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5840
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gdxvtnlfdy.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3136
  - - C:\Temp\i_gdxvtnlfdy.exe
      C:\Temp\i_gdxvtnlfdy.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\aysqkicxvp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5204
  - - C:\Temp\aysqkicxvp.exe
      C:\Temp\aysqkicxvp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4644
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_aysqkicxvp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5276
  - - C:\Temp\i_aysqkicxvp.exe
      C:\Temp\i_aysqkicxvp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnkfcxus.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\xvpnkfcxus.exe
      C:\Temp\xvpnkfcxus.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2656
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2468
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnkfcxus.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5596
  - - C:\Temp\i_xvpnkfcxus.exe
      C:\Temp\i_xvpnkfcxus.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfzxupmkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4568
  - - C:\Temp\hfzxupmkec.exe
      C:\Temp\hfzxupmkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2704
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5188
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfzxupmkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Temp\i_hfzxupmkec.exe
      C:\Temp\i_hfzxupmkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5284
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3716
  - - C:\Temp\ecwuomgezw.exe
      C:\Temp\ecwuomgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:792
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4800
  - - C:\Temp\i_ecwuomgezw.exe
      C:\Temp\i_ecwuomgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgecwro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:544
  - - C:\Temp\wuomgecwro.exe
      C:\Temp\wuomgecwro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgecwro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1344
  - - C:\Temp\i_wuomgecwro.exe
      C:\Temp\i_wuomgecwro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2652
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jgeywqoljh.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1664
  - - C:\Temp\jgeywqoljh.exe
      C:\Temp\jgeywqoljh.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jgeywqoljh.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5116
  - - C:\Temp\i_jgeywqoljh.exe
      C:\Temp\i_jgeywqoljh.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1084
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtolgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3268
  - - C:\Temp\bvtolgeywq.exe
      C:\Temp\bvtolgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5892
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2180
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5100
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtolgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6028
  - - C:\Temp\i_bvtolgeywq.exe
      C:\Temp\i_bvtolgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdbvtqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1256
  - - C:\Temp\nifdbvtqli.exe
      C:\Temp\nifdbvtqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3384
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdbvtqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:756
  - - C:\Temp\i_nifdbvtqli.exe
      C:\Temp\i_nifdbvtqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfaxvqnig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2192
  - - C:\Temp\nlfaxvqnig.exe
      C:\Temp\nlfaxvqnig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3124
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:824
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfaxvqnig.exe ups_ins
    3⤵
    PID:2132
  - - C:\Temp\i_nlfaxvqnig.exe
      C:\Temp\i_nlfaxvqnig.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icausqnlfd.exe ups_run
    3⤵
    PID:2484
  - - C:\Temp\icausqnlfd.exe
      C:\Temp\icausqnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3664
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4388
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icausqnlfd.exe ups_ins
    3⤵
    PID:3264
  - - C:\Temp\i_icausqnlfd.exe
      C:\Temp\i_icausqnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2360
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfcxupkhca.exe ups_run
    3⤵
    PID:3360
  - - C:\Temp\hfcxupkhca.exe
      C:\Temp\hfcxupkhca.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4748
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfcxupkhca.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_hfcxupkhca.exe
      C:\Temp\i_hfcxupkhca.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1820
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rpmhfcwurm.exe ups_run
    3⤵
    PID:4348
  - - C:\Temp\rpmhfcwurm.exe
      C:\Temp\rpmhfcwurm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3712
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5600
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2684
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rpmhfcwurm.exe ups_ins
    3⤵
    PID:3408
  - - C:\Temp\i_rpmhfcwurm.exe
      C:\Temp\i_rpmhfcwurm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5492
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwrpjhezw.exe ups_run
    3⤵
    PID:4716
  - - C:\Temp\bzwrpjhezw.exe
      C:\Temp\bzwrpjhezw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwrpjhezw.exe ups_ins
    3⤵
    PID:4300
  - - C:\Temp\i_bzwrpjhezw.exe
      C:\Temp\i_bzwrpjhezw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rljebwtomg.exe ups_run
    3⤵
    PID:2376
  - - C:\Temp\rljebwtomg.exe
      C:\Temp\rljebwtomg.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5856
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4292
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rljebwtomg.exe ups_ins
    3⤵
    PID:2988
  - - C:\Temp\i_rljebwtomg.exe
      C:\Temp\i_rljebwtomg.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bytrljdbvt.exe ups_run
    3⤵
    PID:5900
  - - C:\Temp\bytrljdbvt.exe
      C:\Temp\bytrljdbvt.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1820
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:944
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bytrljdbvt.exe ups_ins
    3⤵
    PID:1936
  - - C:\Temp\i_bytrljdbvt.exe
      C:\Temp\i_bytrljdbvt.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qolgdbytqo.exe ups_run
    3⤵
    PID:2092
  - - C:\Temp\qolgdbytqo.exe
      C:\Temp\qolgdbytqo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qolgdbytqo.exe ups_ins
    3⤵
    PID:3004
  - - C:\Temp\i_qolgdbytqo.exe
      C:\Temp\i_qolgdbytqo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5640
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlgdyvql.exe ups_run
    3⤵
    PID:2492
  - - C:\Temp\vtnlgdyvql.exe
      C:\Temp\vtnlgdyvql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlgdyvql.exe ups_ins
    3⤵
    PID:4544
  - - C:\Temp\i_vtnlgdyvql.exe
      C:\Temp\i_vtnlgdyvql.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1928
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff81fdbc188,0x7ff81fdbc194,0x7ff81fdbc1a0
      4⤵
      PID:2752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,10881153684799489339,5678593761785285927,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:11
      4⤵
      System Time Discovery
      PID:3016
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,10239214155340565964,17756748324164536051,262144 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
      4⤵
      PID:5932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,932704110682787088,6817243388795399064,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,17571587272792319018,12428949297779327474,2097152 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,8324161972626543447,1584191869142735951,2097152 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
      4⤵
      PID:592
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,16750853228972105216,9209057550498236705,2097152 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:1
      4⤵
      PID:4404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,352520561405364933,15160947878894324358,2097152 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:9
      4⤵
      PID:4084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,9902359456245937297,17285742458221020240,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,8629111810658850456,16189974252087697387,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,9275973376820577602,15775456189054292146,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12461086120196850470,10600067315429654880,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:4288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,12461086120196850470,10600067315429654880,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,1539761072786575893,1728077076295347686,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,6594136392356857297,4400581423546539015,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
      4⤵
      PID:3536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,3965855830564966021,10850586417581850080,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:14
      4⤵
      PID:456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,10035993099300688979,11174628894921515762,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
      4⤵
      PID:2684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17329813961458559413,5113449582602883957,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:1188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,11252302007408620292,7214911868613733426,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
      4⤵
      PID:5956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,3014015494442559319,12791173436200805861,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:14
      4⤵
      PID:1124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1453990431297904208,12459097818956733247,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,17029435982283262864,2254556278812528097,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:14
      4⤵
      PID:5284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,13764877030956114383,3757857358214767996,262144 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:10
      4⤵
      PID:5972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,13736413957711536344,6193248545551642765,524288 --field-trial-handle=2376,i,4588955409164846401,3676309394268653642,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
      4⤵
      PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

C:\Temp\tqlidbvtqljgaytq.sys
C:\Temp\tqlidbvtqljgaytq.sys
1⤵
- Executes dropped EXE
PID:5008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:480

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:544

C:\Temp\vqoigayvtn.sys
C:\Temp\vqoigayvtn.sys
1⤵
- Executes dropped EXE
PID:5596

C:\Temp\ayvtnlfdxv.sys
C:\Temp\ayvtnlfdxv.sys
1⤵
- Executes dropped EXE
PID:5892

C:\Temp\uspkifaxsp.sys
C:\Temp\uspkifaxsp.sys
1⤵
- Executes dropped EXE
PID:2352

C:\Temp\hcaurpnhec.sys
C:\Temp\hcaurpnhec.sys
1⤵
- Executes dropped EXE
PID:3080

C:\Temp\jhfzxupmhe.sys
C:\Temp\jhfzxupmhe.sys
1⤵
- Executes dropped EXE
PID:2444

C:\Temp\omjhbzxrpj.sys
C:\Temp\omjhbzxrpj.sys
1⤵
- Executes dropped EXE
PID:5816

C:\Temp\gebwtomjeb.sys
C:\Temp\gebwtomjeb.sys
1⤵
- Executes dropped EXE
PID:1124

C:\Temp\igdywtolgd.sys
C:\Temp\igdywtolgd.sys
1⤵
- Executes dropped EXE
PID:200

C:\Temp\vtqljdbvtq.sys
C:\Temp\vtqljdbvtq.sys
1⤵
- Executes dropped EXE
PID:2676

C:\Temp\qnlfdyvtnl.sys
C:\Temp\qnlfdyvtnl.sys
1⤵
- Executes dropped EXE
PID:5492

C:\Temp\fdxvsnkifa.sys
C:\Temp\fdxvsnkifa.sys
1⤵
PID:4840

C:\Temp\khfcxvpkhc.sys
C:\Temp\khfcxvpkhc.sys
1⤵
PID:2968

C:\Temp\xrpnhfcwus.sys
C:\Temp\xrpnhfcwus.sys
1⤵
PID:3696

C:\Temp\bzurmjebzx.sys
C:\Temp\bzurmjebzx.sys
1⤵
PID:2616

C:\Temp\trmjebzwrl.sys
C:\Temp\trmjebzwrl.sys
1⤵
PID:2444

C:\Temp\dbytoljgby.sys
C:\Temp\dbytoljgby.sys
1⤵
PID:1516

C:\Temp\vtqoigeywt.sys
C:\Temp\vtqoigeywt.sys
1⤵
PID:2404

C:\Temp\vqoigayvqo.sys
C:\Temp\vqoigayvqo.sys
1⤵
PID:4176

C:\Temp\dxvpnliday.sys
C:\Temp\dxvpnliday.sys
1⤵
PID:5104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

aysqkicxvp.exe

Path C:\Temp\aysqkicxvp.exe
Size 365KB
SHA256 66086329e747c4354f0fb65fd35e80511b8ce4192ec760fe54c4573ce72165d1
MD5 05c614aaecc71017fe3b752602faa5e3
SHA1 3fd2c853a747e2e91554e9834b3d774c01af0490
SHA512 b3bc0f587ba1e770a04635b2ac0796f84a8c471807ac63e0db056ce2df6e1b5d310bcb90da7a7086d4cbede981a661a53e32f2ec8a7db3b906c5b4ba0653bf94
SSDEEP 3072:7uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:7uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ayvtnlfdxv.sys

Path C:\Temp\ayvtnlfdxv.sys
Size 293KB
SHA256 9cf0c89dc5419c3245d3ccc1475f245668e51f2f88029e2429fa614cd1c0c1a8
MD5 0d369ebfc1b01c23894543947dab8fd4
SHA1 36e314367b1490cec904e1ba35589f4c92792ec8
SHA512 9f55aef8c5515a4e668b39952922f2a949be5c2a60e2e1f52787b3bc4ea9723eca2d137f083032da5fffea10bb6d8c6942013f6db6c05ee2a441065395df5b62
SSDEEP 3072:rtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:rIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbvtnljdbv.exe

Path C:\Temp\dbvtnljdbv.exe
Size 365KB
SHA256 c6df9588d1a6a6fb778e05d28cd52c0258289ed3208c7952e93c0f72d08d3cde
MD5 703242bf9b4b36dfdd30c7b8ad77c2d5
SHA1 61b164b8050f658f9597206b243b95703ba7d1b0
SHA512 d0fdc0a5ea9f47f053e4880d7445270466e726afc34d35b5de20c7487e2d13f0a5fe0d705c273c5e75ee741775b29455ca25c9d46eb08b3300b6812645ad1ef1
SSDEEP 3072:0uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:0uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecwuomgezw.exe

Path C:\Temp\ecwuomgezw.exe
Size 365KB
SHA256 f615a2d1eb7a1b1f177149a955230b28f514593f1b2ad3551eeb66791a39f63c
MD5 3a7e77c3dc15de4ece6954d5efa46185
SHA1 9d5e54d93f41b1eed4ae5657683a038c7a021318
SHA512 af142a76a13363a0527140f8f1f28bf49c216186864841a2f1372e646d3818b5f14af8f150630c1b79bf5e84d923d325dc4523a28896dd91df499c8fef22eb35
SSDEEP 3072:Euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:EuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EE847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gdxvtnlfdy.exe

Path C:\Temp\gdxvtnlfdy.exe
Size 365KB
SHA256 577138eb8a30ad4d17f1abe92712f808ece2807ffeface1c5892df78fb8e78e8
MD5 bec24aeddeb4ebdb998183ea06503601
SHA1 8269311bce3fa0e3a1058749d6f3f11b0077bf63
SHA512 2913d415f86b1e3b82c99d6cf5169eebb0494c172efdc3204690dd5df6a70d469497f7552213912d7ee92d4f4cac4103aa5e5715b859f89bee675ac930b9978a
SSDEEP 3072:Duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:DuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hcaurpnhec.sys

Path C:\Temp\hcaurpnhec.sys
Size 293KB
SHA256 10748dc5539d527cf71bbbc9974824c0101aee1a7e433aa618fda25d55d43920
MD5 f2b4f2556962d46b8cb858b19f6cd829
SHA1 9d840d075e4e4dce71a5f026adc7ad5bad4ff057
SHA512 bb2003a7a9452f2a08f3f3eb7be89ef88ca11132324b92af282cb98b1db675c5810016b553e88bbdb1079ffe70fcdaa7837cd77c8b6ae6563777f59632035a65
SSDEEP 3072:RtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:RIJjiJcbI03GBc3ucY5DCSj
TLSH
T15B545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfzxupmkec.exe

Path C:\Temp\hfzxupmkec.exe
Size 365KB
SHA256 be80bf8e28696059d2c9f952ec1ece7dea85db0ad630c758af2826f58a3b8c6a
MD5 6489ffdd8e3b45e3acf27f26c4216953
SHA1 f3f12b567cf5733c545c8e38313a43e00e89c706
SHA512 2db56e79a4cba86c74c2c147934333d428eeb8f2b2ea62650645e8b74c948523c7febac9d0d66edb7ad44e5b52327567772b36e0efe2cdac3726c76c2101dcbc
SSDEEP 3072:duxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:duxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17E847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_aysqkicxvp.exe

Path C:\Temp\i_aysqkicxvp.exe
Size 365KB
SHA256 a2549f792f4df4e58e4c3eca4e3378b0b96fd14c4056b3b2928f68eb52e35412
MD5 02bf9fc29500fba1948e99ba092301b6
SHA1 435e8c1b20a3bcad405404e07c3215e6a31b9516
SHA512 041b0b246ded4b73788026f6c239a8cc75a5306726bb40969045d1f2e04138cd1a07665d9709792a086770c152e1087092798e3b3bd34904822f3147f93b3182
SSDEEP 3072:iuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:iuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T136847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnljdbv.exe

Path C:\Temp\i_dbvtnljdbv.exe
Size 365KB
SHA256 c0a1879a46733228390def074d2768b6c5d7ecee9afa4bf09f44f52213dc7bab
MD5 77d380d3b36bf500c89adb552ddcfc55
SHA1 0d20e19f9044250fb78a2c2495a17dfc03c229c7
SHA512 110355b335d6da157c135821791b87bdf60ebf687982c859305e9e96e9cb7ae1420de77837daba13990c4deb554d66ffe64c6c9aae7e8e359c529f40a76e8b02
SSDEEP 3072:+uxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+uxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_gdxvtnlfdy.exe

Path C:\Temp\i_gdxvtnlfdy.exe
Size 365KB
SHA256 5013da7ed1aabaa6390d0c5fafae6b6e19d6cf34fb06987d11e296b26529745e
MD5 e11cba94caa3029381dfca10af349f9e
SHA1 bee899f4edb4fea5741eefe682a054d0c0953ee2
SHA512 7cb0c473ddefdf1b5b2e3e0388aa32951c366ed4db27df9b8157e6da7e549b7f65f28d3220ade37303994aa9d0f1d3c02b04812827984ece9b3d8ab4e0890db2
SSDEEP 3072:Muxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:MuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hfzxupmkec.exe

Path C:\Temp\i_hfzxupmkec.exe
Size 365KB
SHA256 24007bba2c1c7130c78819261325d098216831539e3058648e3ed3cdf123955b
MD5 25eec8ae1f092f2dba0c6e4cdf89d5ed
SHA1 6312602a53a79a3bafad4a40ff8540b77da1428e
SHA512 f896b067350ca2d5a185c9a7a9ab387c9eaa82f49c151532efad770f90d651d2c860a9c8aad08681d77060194901bdbcad5f42e89a5eff9058ccaeeeb557029a
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_xvpnkfcxus.exe

Path C:\Temp\i_xvpnkfcxus.exe
Size 365KB
SHA256 8e452a3a61a56d0bdafd0334985b6f51e5d668a6046faf48c28ed810c55107af
MD5 17c45218479557179a6c4d07a9f014dd
SHA1 bef4c16f32470ef002f1de05c14863e45e890b93
SHA512 79040bbc1615e1a797feda6a015639fa29b0062fea6324f18b055896840ec907a42167934e6b6a153dab4a60878c21b7f8ec3d86e280382ed33bc3a27457db80
SSDEEP 3072:Vuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:VuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T141847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxupmhe.sys

Path C:\Temp\jhfzxupmhe.sys
Size 293KB
SHA256 f27dd37f9852cb27bd0ab45d10a455e510efc1abe9244f6f4fc73c419845984b
MD5 b1a8716d12ef2b4ee8751122231fd05e
SHA1 52ae52669717585417189e2b75ada3775917e76e
SHA512 03afe768ab4a852d3494b27fb9382aaa719d4402812e106300a7a899b65d0612940c6bff153f9d34fca621f3512610c262541ffe07b43f7379b98641cd9b701a
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T1E4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtqljgaytq.exe

Path C:\Temp\tqlidbvtqljgaytq.exe
Size 365KB
SHA256 ccf4b141a31c7a916818f18af2bbf4abc4e827d67eb3f92f775ff5aa478f9c84
MD5 242fc7767069dc121d9187572841913a
SHA1 47c418d6d65ee79a6a82503d24c02727a2a263af
SHA512 78ad5a2612132a5adabf27986e8b6f1479167aa771512dade0fe5ba3e6520ed068b2a033a3ad93ce515439bb6bc93b0a8b4a598092b10e51f11999b571a2f256
SSDEEP 3072:juxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:juxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T167847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tqlidbvtqljgaytq.sys

Path C:\Temp\tqlidbvtqljgaytq.sys
Size 293KB
SHA256 e8f2cffa032c86c8b88cf9f0f4815cc94ab90866a4c3a3c57bf34084cc08cc76
MD5 ef976b1ecd4c4d678893f2e9ff657fab
SHA1 7d2f1984fecc53c2d155b892ea9a8ca6602755da
SHA512 a42b732a189f6101c18e95c4cef0ac0cc094019ea4a0231009be0d8dcc835c1bd1c5a6cc41747c98a587990b131d03bd3eaf7d592fa884333910b32f727fd744
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T152545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkifaxsp.sys

Path C:\Temp\uspkifaxsp.sys
Size 293KB
SHA256 1238230731a571427ce3b20993f41f77c0fca2fb39735ac4407aa9d9b01c712c
MD5 514ebc70c5cd77b59449e23d46f7f8d1
SHA1 09e1b99246c8f27a9aaf1846d82531533d0ff931
SHA512 6ac0ce0d444b92e4fcb14bcdd9570a1254741b9ff5d6c454f134fa8058454c37895d75021b4302c75b303dc6ae6d29799dbebbea60915d947c0552dd4d5f2c50
SSDEEP 3072:2tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:2IJjiJcbI03GBc3ucY5DCSj
TLSH
T1EC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqoigayvtn.sys

Path C:\Temp\vqoigayvtn.sys
Size 293KB
SHA256 be3b54c0e67626ce6a3cd28357a1c0d6683c930a53dbd095c6613d19192808ed
MD5 ba6d5bc7812ca6ca3729a34d0bfc607e
SHA1 78c32c396c2447670c7030f1ff9794552604ca3e
SHA512 b6c475e06681f0e39f5f2ffb59fa0ba77b08fcbe85b826494f7199cf04d0826f058471dcec0dd8a0f982a42800fd9ce267fc99f6f2d72968fea3913544cfbf70
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xvpnkfcxus.exe

Path C:\Temp\xvpnkfcxus.exe
Size 365KB
SHA256 61c0ea4201c525bcee8f62a367df1cace4f332920e15b73ff14c61108839ae72
MD5 5e7e46453459a63e2f2d8fa8a6a84384
SHA1 321bf45280485bd49f45ed92fcd9b762b99adeed
SHA512 f9dffeecc406ab358404cce589b2c264d149267b92cdec61aae11b21c92bc03161d260eea3c86b3079b86e69048b7939e39be0b273de41034f5ebc11bf66f059
SSDEEP 3072:Yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12238769-bd0e-4e46-8275-f4a72bf0bdb1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12238769-bd0e-4e46-8275-f4a72bf0bdb1.tmp
Size 33KB
SHA256 afdeefc9799e41acab7750d9290644b707d740589fa804d527baf6fa41b78960
MD5 9f0174204ef9c5bf69b2e70bd9899e6b
SHA1 e771b9f43b4095063db2a928305c2b58e2af91ba
SHA512 743a39fb7b86ec84eda25baa534ba8db553d5f140e46847a90a59f777f7520fee5d9f1bedd6d3175264135b091d7443670909fd8123706aa3e661c93249552f7
SSDEEP 768:GI3Qvpc7fZrKHp5XSwQs88uBkiT2v2sJl:GI3QKtrqILNBq2sJl
TLSH
T10FF2BF34EC948DB3ACFAA386774637466FF06157D8C40B48C9DEA21D024776E274B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b46103-2e78-4913-8c07-c9ffbce35bac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35b46103-2e78-4913-8c07-c9ffbce35bac.tmp
Size 33KB
SHA256 7630883ff46366baeb810cd381f142c90059cd0da2806e0f2e2aba5bd9579022
MD5 cb9d337427edbb49eb2ec5e5bacaee11
SHA1 a5c83108a5069cdd7cee3250062692aa70ac35dc
SHA512 4ec55ae35733dfb66e4331d21d4440dff8937408283e981f35ca53c0aecdeea2dfff47bab2fadcbadbca2854d86e99b29677a8627c722c44fa5360937fc1658c
SSDEEP 768:KI3Ripc7fZrKHp5XSwQs88uBkiT2v2sJl:KI3RftrqILNBq2sJl
TLSH
T1A7F2BF34EC948DB3ACFAA382774637466FF06157D4C40B48C9DEA61D028776E274B86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

741567ab-6354-4ed4-927b-4d102fc102ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\741567ab-6354-4ed4-927b-4d102fc102ec.tmp
Size 42KB
SHA256 01d5d4bbcd4dfc5c14b4002168651fb74ab38f2a738b5273677dbfd4fb82ef99
MD5 15b8e99ad241e0b0d013f5bc5d0be546
SHA1 6e9197efce1105492e09bc71aa2cadbb4538dfd4
SHA512 8c087720819a4d38e4a79e39d61f594136a55cfb054b99bec290f3b3af2a1fab3c5e42df7890d3316c1387426384ab7d88d3a668402fba1ac61d601efd1f9031
SSDEEP 768:6FQM3YwgOMRgerK0Np5XSwQs88uBkiT2v2sJl:hM3PorpTILNBq2sJl
TLSH
T1B01338F598D38976E8AE5383677D2E069EFCD053B4884984B7C9591CCC822BFD30B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94bc8cc5-7d92-4a3d-9af9-b743786e7bbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\94bc8cc5-7d92-4a3d-9af9-b743786e7bbb.tmp
Size 37KB
SHA256 b1111195407ca74852b8124ea819b1b9d22d7c36d6a2bffe1db61c356e76c7b7
MD5 be0caf126bc568042ebe86c8fe4e678d
SHA1 6f732c71f9ecd445d4b4059af08b5b7dfea5e393
SHA512 361d72d97400c66140a92cedcc80f37cb7b65142bb8164a389854218eaf4c9377f0a02aae57f954f472a11c04659da384ea94adc8c49eb85af34df246eb16a7f
SSDEEP 768:R/UxvxjgC+W3gXac7fZrKZp5XSwQs88uBkiTCJ/P84g:kZj3+W3gJtrOILNBAHg
TLSH
T1E803C039EC946873ACB3A385365A275BAFF05053C4C41B9849EE7A1E039735DA307897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

55dbadcf-77a9-4059-988d-5220cd269a4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55dbadcf-77a9-4059-988d-5220cd269a4c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b4b6f48-cf25-40bd-9f14-7bf6a2ddaf73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b4b6f48-cf25-40bd-9f14-7bf6a2ddaf73.tmp
Size 29KB
SHA256 d9c0eb6408d1be7dce0bd77df20e095d284ece172c447979bf6083ff4d59f4a5
MD5 15a0ca3dc9ff65a97a70ce9bc5314233
SHA1 27e2b888e0ea7d3df5d9b529bfe73985cda8c0d6
SHA512 93a737bad7555679cf7e264b4a1a4bf10228521dc1f752fe6778f7f6b395648f07ae66d28a6e5a2b5ae03b115dd0a8d1c87d9351d7080ebd1bac94fd554f9638
SSDEEP 768:U/pC7x7pLuLbLmWg8KfrL8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOOuyhp8roJYM:U/pC7nEbLmWg8KfrLu1jaJOu8pn+M
TLSH
T1E3D2DA7B740CCA7F4F804ADDA8197ADB6DA802CB9A98CD4047FE941D02C77EB91164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b93b732-0e0e-4911-878c-d9bfcfbbc374.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b93b732-0e0e-4911-878c-d9bfcfbbc374.tmp
Size 11KB
SHA256 3feb7b2b289a7a753fe4d18d7cae18c8b9a0603bf021001ad9fa83e57bdd7774
MD5 b450c526eeeff3f74d678373a6b56c2a
SHA1 47cf3f95aaed7f5b4ad6aeece43f7027a77c808d
SHA512 4cc1c5803543e4b34f1f33af78967d2bbca0a06b4ce52a5e5fb3a3a180758677f78cc98e4e3a4c5e175ddc5781922c1a92ef5abf9b7dfa0f4ea5cde34d6cc013
SSDEEP 192:sxR5RrC4/fIsPmZ+TMzoA8p9n/g6+WNCZR/YEhLGmHcIgD32J:sxR5w4/fIsPQ+5Z/5K/pA+
TLSH
T19042B715BD38A97B4CCBE219FB557F57D2F81032A0951F48A6FC8A2C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b0d972b-2011-4edd-b345-1252e566ab03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b0d972b-2011-4edd-b345-1252e566ab03.tmp
Size 11KB
SHA256 300bce1421e83cb2140ddf6f6d9e5ab73d85cde4eac2b44cd22bd60222c0ff5a
MD5 69f3ea9b0eb16822592502a78d2d18d2
SHA1 cbc11a97af84cbaa65924ecc8df2707730d801db
SHA512 dd4817f82a2a98a5b382e14546436bc3d4f166a8ee0240abdfe603eedc7ce953952ad1e707d68f1c36cf89c03349b3e11f44371bea2a25fc12f14f13f4b5bab2
SSDEEP 192:sxRyRrC4/fIs+mZ+TMzoA8p9n/g6+WNCZR/YEhLGmHcIgV2J:sxRyw4/fIs+Q+5Z/5K/pAY
TLSH
T1C632B815BD38A97B4CCBE219FB657F53D2F91132A1951F48A6FC8A1C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 0e3e3a4f8512fc64daf32c3e7dd2044e93a1751c718633f8cfeea7481ba654e9
MD5 87a033a039bec62c5f0cb6ae66011fd5
SHA1 26f2310742eb76c4d3cb0e6ac33800e4f8f7d28e
SHA512 05ec7151bdd689f6602564b0a84c0e0d06441fe5861647ffdf25fe44d30881d9bd00c2bed302bc31fd0d8d729ba65c610d756aadfdb62228f981ffbabb329290
TLSH
T18D5193871DB18070D76840F4C4E013873EF525B02AE31E05467BFEB4BF4E3D28189828
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 df1ba176b8dbdb5bbaa8ec473f518a4a5cd32c7e94d4e87aeaf52d47533f5b12
MD5 0a3cf1e9c1fec0e38422698e9c1ccf1b
SHA1 60624e0ce3a3239609d65142711341cbbfef7805
SHA512 f97a71e4c67c96194bfac2c5ed033b946c4264d99841fea3de833f7e4e62ce5777a2e14b904b7a104046a7c3ba8555c623feb25e51cd42ccff332f2a84695c6f
TLSH
T1B651A4871EB18070D75840F0D4E013873EF525B02AE31E06467BFEB4BF4E3D29189828
MD5 SHA1 SHA512 TLSH

Submit Download

e8ef2d76-c245-412b-b7bd-3fdda71cdc0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\e8ef2d76-c245-412b-b7bd-3fdda71cdc0b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1f38d0b3-1c80-495a-b999-9ed0b0b39347.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1f38d0b3-1c80-495a-b999-9ed0b0b39347.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2a7cedac-a3f7-42d3-8d5c-464a37cd3873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2a7cedac-a3f7-42d3-8d5c-464a37cd3873.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9c1dbd00-51a3-4054-9f49-aadb03945d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9c1dbd00-51a3-4054-9f49-aadb03945d28.tmp
Size 2KB
SHA256 e569e5a18f052911865dcaff5a01f8ca6e403d41cf23ea564a0c063c3d4202d0
MD5 e8799b008a74cb3695c41751f6197a83
SHA1 5d05ce5c3bb2d17e442f67e77b3c19a148ad5ccb
SHA512 ed96282d56238a0e3e48054fb05f8ce5a3dc8dda1ad149f0665f8604700791597c7fe4a8fe5c5ef897d3e2bb1ed18c4d3198a1c5db6be4b41b3b79e53aff1712
TLSH
T1BA51C0F3C3E8866D891196F0AB187E2BCE2D0954432C7D5AC8E4EE6B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

ebe3cd15-5211-4eee-986c-23e4b6f39152.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ebe3cd15-5211-4eee-986c-23e4b6f39152.tmp
Size 11KB
SHA256 d67cdf4bdb704eded669456c330f95030fff169ecdd154e250ef25a64e4c94b4
MD5 0e4ab53728d04b4281aabc7be8dd2d12
SHA1 e43d8890672d1f53f757bcab4cf96d1ae18a9270
SHA512 c0d9f283932b0fb465707ab4bbd32df8f05e75e51a40aac0f2038ad6cf745926e29d146d65c623a53860c7f073772928d3dcdaeb03ed9edd8a7764eb52db06ea
SSDEEP 192:sxR5RrC4/fIs0mZ+TMzoA8p9n/g6+WNCZR/YE8LGmHcIgD12J:sxR5w4/fIs0Q+5Z/5K/MAE
TLSH
T17F42B715BD28A97B8CCBE209FB557F53D2F85032A0951F48A6FC8A2C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f7191ca-363b-4857-959e-bae5d7c9ad83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1f7191ca-363b-4857-959e-bae5d7c9ad83.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

8d06bd2e-26bb-49ab-94db-99c5769df6e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\8d06bd2e-26bb-49ab-94db-99c5769df6e3.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

902bf57c-1dbb-4656-9cd5-20c7f41f34ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\902bf57c-1dbb-4656-9cd5-20c7f41f34ec.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f5966a5e-80b8-47b2-9f04-45a67518c188.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f5966a5e-80b8-47b2-9f04-45a67518c188.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

e4602bee-fafb-4f11-9520-04b9ca23dba5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e4602bee-fafb-4f11-9520-04b9ca23dba5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

8bf52cd0-c4ad-4f5e-b168-ad04428e0b95.tmp

Path C:\Users\Admin\AppData\Local\Temp\8bf52cd0-c4ad-4f5e-b168-ad04428e0b95.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

a91be5b7-c0c7-4b60-8a20-bc3d5eb2ac51.tmp

Path C:\Users\Admin\AppData\Local\Temp\a91be5b7-c0c7-4b60-8a20-bc3d5eb2ac51.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5052_508101555\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1503407895\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1575428993\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_1688202366\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5052_721608990\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 24c65bcf02c604dc4ca3f30e617886697785ed02a456ac845210e456130741db
MD5 2a430ab4475a54abed236606f96ec32b
SHA1 d8588bf23f6fdfd727deb0df5358bf7d7b732c37
SHA512 0ea3a495fac0109d3cc55980c7f79c695bf7c651527368fa252c81b10e8cb53c3e2f66d9136db54907eea5d8046dc9f613b38371feb347066bddf6e6fb4cdd9c
TLSH
T1E871238357A8DAB2C2DE5FF002839644F6FB223C072330740791558BEB30A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/200-342-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1124-326-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-477-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1516-484-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2352-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2404-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-297-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2444-456-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2616-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2676-348-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2968-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3080-284-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3696-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4176-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4840-398-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5008-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5104-505-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5492-378-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5596-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5816-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5892-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download