systex | ae3e4db8f7155c4f1bddb2e112fc969ea936f4187286dba9159ffde133ca2a73

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Size 389KB
Sample261002-pvq6vsxtbz
SHA256 ae3e4db8f7155c4f1bddb2e112fc969ea936f4187286dba9159ffde133ca2a73
MD5 6d07a26e12b2f2fe667bd2dc0948344c
SHA1 39c7f239d25ab8f171d92e015b789e2e9dba39eb
SHA512 ec320b5803611644d62ce8ab62ee8e7ad35e7ecc9c0de54f475fed2e2a4cb4716a0899a25149531cbb2ae70cbd51d5c91753cd2838dc2bebc08e3f0771a8bf98
SSDEEP 3072:Cuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:CuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C6847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3560	bztrljdbwtomgeyw.exe
5900	bztrljdbwtomgeyw.sys
1840	CreateProcess.exe
5516	dbwtrigbyt.exe
1160	CreateProcess.exe
1156	CreateProcess.exe
2372	i_dbwtrigbyt.exe
3012	gbytqlgdbv.sys
2128	CreateProcess.exe
3876	bvtnlgdyvq.exe
908	CreateProcess.exe
2268	CreateProcess.exe
1884	i_bvtnlgdyvq.exe
5400	jdavtnlavt.sys
4120	CreateProcess.exe
1468	yvqnligays.exe
692	CreateProcess.exe
3008	CreateProcess.exe
5248	i_yvqnligays.exe
2328	vqnlfdxvqn.sys
808	CreateProcess.exe
4936	vtnlfdxnif.exe
5752	CreateProcess.exe
5288	CreateProcess.exe
1480	i_vtnlfdxnif.exe
3768	fdxvpnkica.sys
4988	CreateProcess.exe
1944	cxvspkifzx.exe
1112	CreateProcess.exe
5172	CreateProcess.exe
2916	i_cxvspkifzx.exe
5472	zxsmkhfzxs.sys
868	CreateProcess.exe
3248	wusmkecwup.exe
6076	CreateProcess.exe
6108	CreateProcess.exe
5860	i_wusmkecwup.exe
3420	mkeurpjhec.sys
4888	CreateProcess.exe
2408	hbzwromkec.exe
4764	CreateProcess.exe
4104	CreateProcess.exe
4664	i_hbzwromkec.exe
1608	pmhezwuomh.sys
1748	CreateProcess.exe
1764	uomhezwjgb.exe
2380	CreateProcess.exe
5476	CreateProcess.exe
5184	i_uomhezwjgb.exe
1100	ljebwtomge.sys
4368	CreateProcess.exe
3500	bwqojgeywq.exe
1616	CreateProcess.exe
752	CreateProcess.exe
4184	i_bwqojgeywq.exe
4332	olgdywqoig.sys
5812	CreateProcess.exe
2372	ljdbvtolgd.exe
5840	CreateProcess.exe
4740	CreateProcess.exe
2152	i_ljdbvtolgd.exe
3264	ljdbnlfdyv.sys
4752	CreateProcess.exe
3324	yvtqlidayv.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1680170203\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1443068373\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1443068373\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1443068373\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_978855595\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_297000110\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1680170203\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1443068373\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_297000110\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzwromkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xspnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zuspjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cxvspkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzwromkec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomhezwjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwqojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvtqlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zuspjhczus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljebwtrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbwtrigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomhezwjgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljebwtrmje.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	faxvtndxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_cxvspkifzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwqojgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbvtolgd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xrpjhbztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_spkhczxusm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gbywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_gbywqoigby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnlgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdxnif.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xspnhfaxsq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnlgdyvqol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqnligays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvtqlidayv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_faxvtndxvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrljdbwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbwtrigbyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtnlgdyvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqnligays.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4960	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4536	ipconfig.exe
2080	ipconfig.exe
5888	ipconfig.exe
1604	ipconfig.exe
5408	ipconfig.exe
2740	ipconfig.exe
4908	ipconfig.exe
4700	ipconfig.exe
4260	ipconfig.exe
6004	ipconfig.exe
1908	ipconfig.exe
1720	ipconfig.exe
6136	ipconfig.exe
596	ipconfig.exe
1008	ipconfig.exe
1876	ipconfig.exe
5256	ipconfig.exe
3952	ipconfig.exe
4324	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4154726816-2055034831-2297277433-1000\{FFCC18CC-EDE7-4611-9862-2FA906A64EE3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3560	bztrljdbwtomgeyw.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3560	bztrljdbwtomgeyw.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3560	bztrljdbwtomgeyw.exe
5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
3560	bztrljdbwtomgeyw.exe
3560	bztrljdbwtomgeyw.exe
3560	bztrljdbwtomgeyw.exe
3560	bztrljdbwtomgeyw.exe
3560	bztrljdbwtomgeyw.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe
2212	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2372	i_dbwtrigbyt.exe
Token: SeDebugPrivilege	1884	i_bvtnlgdyvq.exe
Token: SeDebugPrivilege	5248	i_yvqnligays.exe
Token: SeDebugPrivilege	1480	i_vtnlfdxnif.exe
Token: SeDebugPrivilege	2916	i_cxvspkifzx.exe
Token: SeDebugPrivilege	5860	i_wusmkecwup.exe
Token: SeDebugPrivilege	4664	i_hbzwromkec.exe
Token: SeDebugPrivilege	5184	i_uomhezwjgb.exe
Token: SeDebugPrivilege	4184	i_bwqojgeywq.exe
Token: SeDebugPrivilege	2152	i_ljdbvtolgd.exe
Token: SeDebugPrivilege	5184	i_yvtqlidayv.exe
Token: SeDebugPrivilege	4332	i_faxvtndxvp.exe
Token: SeDebugPrivilege	6116	i_xspnhfaxsq.exe
Token: SeDebugPrivilege	4672	i_spkhczxusm.exe
Token: SeDebugPrivilege	3368	i_zuspjhczus.exe
Token: SeDebugPrivilege	4760	i_xrpjhbztrm.exe
Token: SeDebugPrivilege	2712	i_ljebwtrmje.exe
Token: SeDebugPrivilege	5140	i_gbywqoigby.exe
Token: SeDebugPrivilege	4280	i_qnlgdyvqol.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5240 wrote to memory of 3560	5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	89
PID 5240 wrote to memory of 3608	5240	2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe	90
PID 3608 wrote to memory of 2212	3608	iexplore.exe	91
PID 2212 wrote to memory of 1396	2212	msedge.exe	92
PID 2212 wrote to memory of 704	2212	msedge.exe	93
PID 2212 wrote to memory of 4960	2212	msedge.exe	94
PID 2212 wrote to memory of 704	2212	msedge.exe	93
PID 2212 wrote to memory of 704	2212	msedge.exe	93
PID 2212 wrote to memory of 4220	2212	msedge.exe	96
PID 2212 wrote to memory of 4220	2212	msedge.exe	96
PID 2212 wrote to memory of 3200	2212	msedge.exe	98
PID 2212 wrote to memory of 3200	2212	msedge.exe	98
PID 2212 wrote to memory of 3200	2212	msedge.exe	98
PID 2212 wrote to memory of 4224	2212	msedge.exe	97
PID 2212 wrote to memory of 4224	2212	msedge.exe	97
PID 2212 wrote to memory of 4224	2212	msedge.exe	97
PID 2212 wrote to memory of 4956	2212	msedge.exe	99
PID 2212 wrote to memory of 4956	2212	msedge.exe	99
PID 2212 wrote to memory of 4956	2212	msedge.exe	99
PID 2212 wrote to memory of 5264	2212	msedge.exe	100
PID 2212 wrote to memory of 5264	2212	msedge.exe	100
PID 2212 wrote to memory of 5264	2212	msedge.exe	100
PID 2212 wrote to memory of 1068	2212	msedge.exe	101
PID 2212 wrote to memory of 1068	2212	msedge.exe	101
PID 2212 wrote to memory of 2312	2212	msedge.exe	105
PID 2212 wrote to memory of 3320	2212	msedge.exe	106
PID 2212 wrote to memory of 2312	2212	msedge.exe	105
PID 2212 wrote to memory of 3320	2212	msedge.exe	106
PID 3560 wrote to memory of 1840	3560	bztrljdbwtomgeyw.exe	108
PID 2212 wrote to memory of 944	2212	msedge.exe	110
PID 5516 wrote to memory of 1160	5516	dbwtrigbyt.exe	112
PID 2212 wrote to memory of 6076	2212	msedge.exe	115
PID 2212 wrote to memory of 6076	2212	msedge.exe	115
PID 2212 wrote to memory of 4552	2212	msedge.exe	117
PID 2212 wrote to memory of 4552	2212	msedge.exe	117
PID 3560 wrote to memory of 1156	3560	bztrljdbwtomgeyw.exe	119
PID 3560 wrote to memory of 2128	3560	bztrljdbwtomgeyw.exe	123
PID 3876 wrote to memory of 908	3876	bvtnlgdyvq.exe	125
PID 3560 wrote to memory of 2268	3560	bztrljdbwtomgeyw.exe	128
PID 3560 wrote to memory of 4120	3560	bztrljdbwtomgeyw.exe	132
PID 1468 wrote to memory of 692	1468	yvqnligays.exe	134
PID 3560 wrote to memory of 3008	3560	bztrljdbwtomgeyw.exe	137
PID 3560 wrote to memory of 808	3560	bztrljdbwtomgeyw.exe	142
PID 4936 wrote to memory of 5752	4936	vtnlfdxnif.exe	144
PID 3560 wrote to memory of 5288	3560	bztrljdbwtomgeyw.exe	147
PID 2212 wrote to memory of 1164	2212	msedge.exe	149
PID 2212 wrote to memory of 1960	2212	msedge.exe	150
PID 2212 wrote to memory of 2800	2212	msedge.exe	151
PID 3560 wrote to memory of 4988	3560	bztrljdbwtomgeyw.exe	154
PID 1944 wrote to memory of 1112	1944	cxvspkifzx.exe	156
PID 3560 wrote to memory of 5172	3560	bztrljdbwtomgeyw.exe	159
PID 3560 wrote to memory of 868	3560	bztrljdbwtomgeyw.exe	163
PID 3248 wrote to memory of 6076	3248	wusmkecwup.exe	165
PID 3560 wrote to memory of 6108	3560	bztrljdbwtomgeyw.exe	168
PID 3560 wrote to memory of 4888	3560	bztrljdbwtomgeyw.exe	172
PID 2408 wrote to memory of 4764	2408	hbzwromkec.exe	174
PID 3560 wrote to memory of 4104	3560	bztrljdbwtomgeyw.exe	177
PID 3560 wrote to memory of 1748	3560	bztrljdbwtomgeyw.exe	181
PID 1764 wrote to memory of 2380	1764	uomhezwjgb.exe	183
PID 3560 wrote to memory of 5476	3560	bztrljdbwtomgeyw.exe	186
PID 2212 wrote to memory of 2960	2212	msedge.exe	188
PID 2212 wrote to memory of 2960	2212	msedge.exe	188
PID 3560 wrote to memory of 4368	3560	bztrljdbwtomgeyw.exe	194
PID 3500 wrote to memory of 1616	3500	bwqojgeywq.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_6d07a26e12b2f2fe667bd2dc0948344c_amadey_darkgate_elex_rhadamanthys_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Temp\bztrljdbwtomgeyw.exe
  C:\Temp\bztrljdbwtomgeyw.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbwtrigbyt.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1840
  - - C:\Temp\dbwtrigbyt.exe
      C:\Temp\dbwtrigbyt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbwtrigbyt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1156
  - - C:\Temp\i_dbwtrigbyt.exe
      C:\Temp\i_dbwtrigbyt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtnlgdyvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2128
  - - C:\Temp\bvtnlgdyvq.exe
      C:\Temp\bvtnlgdyvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5408
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtnlgdyvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2268
  - - C:\Temp\i_bvtnlgdyvq.exe
      C:\Temp\i_bvtnlgdyvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1884
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqnligays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4120
  - - C:\Temp\yvqnligays.exe
      C:\Temp\yvqnligays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1468
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6136
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqnligays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3008
  - - C:\Temp\i_yvqnligays.exe
      C:\Temp\i_yvqnligays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5248
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdxnif.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:808
  - - C:\Temp\vtnlfdxnif.exe
      C:\Temp\vtnlfdxnif.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2740
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdxnif.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5288
  - - C:\Temp\i_vtnlfdxnif.exe
      C:\Temp\i_vtnlfdxnif.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\cxvspkifzx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4988
  - - C:\Temp\cxvspkifzx.exe
      C:\Temp\cxvspkifzx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1112
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_cxvspkifzx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5172
  - - C:\Temp\i_cxvspkifzx.exe
      C:\Temp\i_cxvspkifzx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusmkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:868
  - - C:\Temp\wusmkecwup.exe
      C:\Temp\wusmkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6076
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3952
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusmkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:6108
  - - C:\Temp\i_wusmkecwup.exe
      C:\Temp\i_wusmkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzwromkec.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4888
  - - C:\Temp\hbzwromkec.exe
      C:\Temp\hbzwromkec.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4764
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzwromkec.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4104
  - - C:\Temp\i_hbzwromkec.exe
      C:\Temp\i_hbzwromkec.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4664
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomhezwjgb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1748
  - - C:\Temp\uomhezwjgb.exe
      C:\Temp\uomhezwjgb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomhezwjgb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5476
  - - C:\Temp\i_uomhezwjgb.exe
      C:\Temp\i_uomhezwjgb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwqojgeywq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4368
  - - C:\Temp\bwqojgeywq.exe
      C:\Temp\bwqojgeywq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3500
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwqojgeywq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:752
  - - C:\Temp\i_bwqojgeywq.exe
      C:\Temp\i_bwqojgeywq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbvtolgd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5812
  - - C:\Temp\ljdbvtolgd.exe
      C:\Temp\ljdbvtolgd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2372
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbvtolgd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4740
  - - C:\Temp\i_ljdbvtolgd.exe
      C:\Temp\i_ljdbvtolgd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvtqlidayv.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4752
  - - C:\Temp\yvtqlidayv.exe
      C:\Temp\yvtqlidayv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3324
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvtqlidayv.exe ups_ins
    3⤵
    PID:4476
  - - C:\Temp\i_yvtqlidayv.exe
      C:\Temp\i_yvtqlidayv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\faxvtndxvp.exe ups_run
    3⤵
    PID:3692
  - - C:\Temp\faxvtndxvp.exe
      C:\Temp\faxvtndxvp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1472
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4260
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_faxvtndxvp.exe ups_ins
    3⤵
    PID:1736
  - - C:\Temp\i_faxvtndxvp.exe
      C:\Temp\i_faxvtndxvp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xspnhfaxsq.exe ups_run
    3⤵
    PID:5712
  - - C:\Temp\xspnhfaxsq.exe
      C:\Temp\xspnhfaxsq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4980
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xspnhfaxsq.exe ups_ins
    3⤵
    PID:1320
  - - C:\Temp\i_xspnhfaxsq.exe
      C:\Temp\i_xspnhfaxsq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\spkhczxusm.exe ups_run
    3⤵
    PID:5880
  - - C:\Temp\spkhczxusm.exe
      C:\Temp\spkhczxusm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:6048
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6060
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_spkhczxusm.exe ups_ins
    3⤵
    PID:4876
  - - C:\Temp\i_spkhczxusm.exe
      C:\Temp\i_spkhczxusm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4672
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zuspjhczus.exe ups_run
    3⤵
    PID:4484
  - - C:\Temp\zuspjhczus.exe
      C:\Temp\zuspjhczus.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1908
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zuspjhczus.exe ups_ins
    3⤵
    PID:5184
  - - C:\Temp\i_zuspjhczus.exe
      C:\Temp\i_zuspjhczus.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3368
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xrpjhbztrm.exe ups_run
    3⤵
    PID:2692
  - - C:\Temp\xrpjhbztrm.exe
      C:\Temp\xrpjhbztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3720
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xrpjhbztrm.exe ups_ins
    3⤵
    PID:3492
  - - C:\Temp\i_xrpjhbztrm.exe
      C:\Temp\i_xrpjhbztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4760
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljebwtrmje.exe ups_run
    3⤵
    PID:3828
  - - C:\Temp\ljebwtrmje.exe
      C:\Temp\ljebwtrmje.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5948
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3344
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljebwtrmje.exe ups_ins
    3⤵
    PID:4132
  - - C:\Temp\i_ljebwtrmje.exe
      C:\Temp\i_ljebwtrmje.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\gbywqoigby.exe ups_run
    3⤵
    PID:2384
  - - C:\Temp\gbywqoigby.exe
      C:\Temp\gbywqoigby.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5888
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_gbywqoigby.exe ups_ins
    3⤵
    PID:4420
  - - C:\Temp\i_gbywqoigby.exe
      C:\Temp\i_gbywqoigby.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5140
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnlgdyvqol.exe ups_run
    3⤵
    PID:1076
  - - C:\Temp\qnlgdyvqol.exe
      C:\Temp\qnlgdyvqol.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5192
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5000
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnlgdyvqol.exe ups_ins
    3⤵
    PID:5572
  - - C:\Temp\i_qnlgdyvqol.exe
      C:\Temp\i_qnlgdyvqol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4280
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x31c,0x7ff89e72c188,0x7ff89e72c194,0x7ff89e72c1a0
      4⤵
      PID:1396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7122355723975195644,8407820337760063442,262144 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
      4⤵
      PID:704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,12844174855882717411,4351735064775228959,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:11
      4⤵
      System Time Discovery
      PID:4960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,12890761602853165730,12706884800672448547,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:13
      4⤵
      PID:4220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,3910242158496368480,5535515718284002306,2097152 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
      4⤵
      PID:4224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,12862060038188336624,11280982950434542466,2097152 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
      4⤵
      PID:3200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,12992909032460309255,7865555850077743781,2097152 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,5961945635662949158,10395345098701899307,2097152 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:9
      4⤵
      PID:5264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,16264873962666061843,2437187938023894804,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,12664528579500870487,766038282437501061,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12349495067355083623,10416919409916933822,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
      4⤵
      PID:3320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2297616041248314297,8527690354532251252,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:4752
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2297616041248314297,8527690354532251252,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,15691766948483582256,18335023863870725328,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6155214120097903796,11200027005101209088,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,13730721175308037696,16915577721364512539,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,12399389898928962448,5622027353890004315,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,5537294294781268455,5743989204740893464,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:2800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2112,i,2880655448053829314,14521945049290639766,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
      4⤵
      PID:2960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,7853717864953853922,16496581655238293815,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:14
      4⤵
      PID:5256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,9726088425080031643,9737390610810399210,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:14
      4⤵
      PID:3344
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,9606833363640843484,7939130664080521335,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6188,i,15302226297592340984,7180138763061040605,262144 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:10
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,6625395634480132021,7396432410812510498,524288 --field-trial-handle=2448,i,15595035666671834853,1360180164546775916,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
      4⤵
      PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2328

C:\Temp\bztrljdbwtomgeyw.sys
C:\Temp\bztrljdbwtomgeyw.sys
1⤵
- Executes dropped EXE
PID:5900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3184

C:\Temp\gbytqlgdbv.sys
C:\Temp\gbytqlgdbv.sys
1⤵
- Executes dropped EXE
PID:3012

C:\Temp\jdavtnlavt.sys
C:\Temp\jdavtnlavt.sys
1⤵
- Executes dropped EXE
PID:5400

C:\Temp\vqnlfdxvqn.sys
C:\Temp\vqnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:2328

C:\Temp\fdxvpnkica.sys
C:\Temp\fdxvpnkica.sys
1⤵
- Executes dropped EXE
PID:3768

C:\Temp\zxsmkhfzxs.sys
C:\Temp\zxsmkhfzxs.sys
1⤵
- Executes dropped EXE
PID:5472

C:\Temp\mkeurpjhec.sys
C:\Temp\mkeurpjhec.sys
1⤵
- Executes dropped EXE
PID:3420

C:\Temp\pmhezwuomh.sys
C:\Temp\pmhezwuomh.sys
1⤵
- Executes dropped EXE
PID:1608

C:\Temp\ljebwtomge.sys
C:\Temp\ljebwtomge.sys
1⤵
- Executes dropped EXE
PID:1100

C:\Temp\olgdywqoig.sys
C:\Temp\olgdywqoig.sys
1⤵
- Executes dropped EXE
PID:4332

C:\Temp\ljdbnlfdyv.sys
C:\Temp\ljdbnlfdyv.sys
1⤵
- Executes dropped EXE
PID:3264

C:\Temp\daysqnifdb.sys
C:\Temp\daysqnifdb.sys
1⤵
PID:4632

C:\Temp\davsnkfdxv.sys
C:\Temp\davsnkfdxv.sys
1⤵
PID:472

C:\Temp\rpkhcaxvpn.sys
C:\Temp\rpkhcaxvpn.sys
1⤵
PID:2712

C:\Temp\hczxspkhca.sys
C:\Temp\hczxspkhca.sys
1⤵
PID:2708

C:\Temp\zxrpjhbzur.sys
C:\Temp\zxrpjhbzur.sys
1⤵
PID:1652

C:\Temp\romjebwuom.sys
C:\Temp\romjebwuom.sys
1⤵
PID:2148

C:\Temp\gdbwtolgeb.sys
C:\Temp\gdbwtolgeb.sys
1⤵
PID:2144

C:\Temp\aywqoigbyt.sys
C:\Temp\aywqoigbyt.sys
1⤵
PID:1464

C:\Temp\qkidaysqli.sys
C:\Temp\qkidaysqli.sys
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtnlgdyvq.exe

Path C:\Temp\bvtnlgdyvq.exe
Size 389KB
SHA256 1e954a3d818ae63ba4d5efdd8ecc614338198ab2c2fa64c41601302ef4166c54
MD5 90300c192cc563d1be18a1b49ae5cbd7
SHA1 3102ee4c5e0bf8712c729a3be8ab0e21ab323d88
SHA512 d22b4f0fc4742aa083645779bdb2983a5675b4b64bcef525f2c1f9ce1ea97422eb80a7068d4772f40a7c5864a1ef276b1a0e97a6e9f4f8e0f3c0ae23a310eb9f
SSDEEP 3072:Tuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:TuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T170847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwtomgeyw.exe

Path C:\Temp\bztrljdbwtomgeyw.exe
Size 389KB
SHA256 b1b801abce3a6303c3bbd03fa47ea0a0143eca4c7cb80527fcbe3438f1d4266f
MD5 8de5c017274e50cbfea38cb7446248e3
SHA1 eaeeb203301804b2fc6f0b594203e84deaed8097
SHA512 ee289722c2dfeb4c0e50547eb9c4616a14198b90b01d09f1df0d7f3543114119d87428aba7b52b25dd4640a9b898e56f1e68cb18ce0190ee2b4553447aa84a30
SSDEEP 3072:yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:yuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T125847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bztrljdbwtomgeyw.sys

Path C:\Temp\bztrljdbwtomgeyw.sys
Size 293KB
SHA256 4cdf44457dfdf867e4a6896e7f0f2f5b39c7f045daf48224ad839c885b6e7519
MD5 2696569a5026f5c3be67e45c32c12200
SHA1 03f323a7ab821c034d1700b8534ea44d8da87868
SHA512 a5324ffc0ebad610a3948bc5c5dbf5cd9597e58fa8ec3ae18c782a61605b6707fda982a72df21daa353015fa9278b07e982d453a8b508d15a05f7584303b62bf
SSDEEP 3072:6tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:6IJjiJcbI03GBc3ucY5DCSj
TLSH
T17D545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cxvspkifzx.exe

Path C:\Temp\cxvspkifzx.exe
Size 389KB
SHA256 506db51d09d511d032db78dfc2843973595ec75ca8f4e3efe9c71a6273a5ae57
MD5 3400e295975de435a0df4175fa815d8d
SHA1 6f047aca8768d1157ac98009bbef18d4d32f80b2
SHA512 d8fb61429eac198a599bdfb2862d1829bd09de8ad4b8ba222850a59be503a9cbd0f97ba3fcd5b13c2ef831a8189116a1830b5a1676e147c05d7f62876ba0d80d
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbwtrigbyt.exe

Path C:\Temp\dbwtrigbyt.exe
Size 389KB
SHA256 a74351b0431d8f86f67d0e71096d6095b10a799c74c13d33cd336f9386a9d2bd
MD5 913127c1375809f6e4cca0ede991b739
SHA1 28940fd7932d27a2ac52caf7ea7817bffb38d81e
SHA512 b34ff2e6a28e94c9022335894cffe24a24581993fac955723a21c4a09c304bfe331b8b8d8b53662ef4454a18f1593a566dda8e9fa0413e5d19fddbf08a1f3f37
SSDEEP 3072:Kuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15B847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdxvpnkica.sys

Path C:\Temp\fdxvpnkica.sys
Size 293KB
SHA256 968cfd560b087c1ee2574eb20303662f6b62fc47de42204c5c1937081594fce8
MD5 488a481d9f8c0e62c6d91607475cda96
SHA1 c527a613bd84079e48071e227142860159baa030
SHA512 18d49af955f6aafd35cec33998f89f4c14a4eca8f3441bedbae48c787cffd61a44eafbe29f37430d107bd27f68d65f41d7fe544d2fac5783ff688bdce100fece
SSDEEP 3072:5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:5IJjiJcbI03GBc3ucY5DCSj
TLSH
T184545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gbytqlgdbv.sys

Path C:\Temp\gbytqlgdbv.sys
Size 293KB
SHA256 2032ae9191cde90f949fbf74aef753ea01ef1c0b221c66d889ccb74f8df14184
MD5 2dbf371e3a1a1045b377ffee94ee5f9e
SHA1 18c4ffbb71bfdbc5db9434a3c2bd3faf98330471
SHA512 be7be8aa459a46ea589efc67c7c35f45ef46a97c3cf39345567f91fcbe3703f1ee1e170560024d5814b5b1199b0ad8c090c72b9e91f7c5f080e30b44183bc861
SSDEEP 3072:CtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:CIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtnlgdyvq.exe

Path C:\Temp\i_bvtnlgdyvq.exe
Size 389KB
SHA256 7c9a17c70bf375334e80b05292cfdd89d8a77e82cd3916eeb20ddaf64c945725
MD5 f3d98c2f5dc1a655d7c49d4554ba3a79
SHA1 fd0fcdc354ded4415ddb9623b40006e099a30200
SHA512 2c304c780c8786239a9f373b8b1102c347a7aab7a62565210cf7e3eed9d7dfb72750a3afb1e1d701bf8fb0af988cd8f64f04cc845af4bc2f3ac5eca7ddd5c894
SSDEEP 3072:Auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T121847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_cxvspkifzx.exe

Path C:\Temp\i_cxvspkifzx.exe
Size 389KB
SHA256 a8151c2925fb17da9f3392402eb74767e0b14d0ccfc22ee2d336f79ab038b92f
MD5 39e2d63faf3626328976a494cf52cc29
SHA1 9aa1e22dae03d908fe8ea2e1d09c703b1d077fbd
SHA512 405cf198822001ed568d4cc0537e888da8ebfe8530b958c003468304e3967f827aea3887c9f39762d4f9f8b46b16fd6df650ccc060d8b10772636096b895a77d
SSDEEP 3072:Kuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:KuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T162847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbwtrigbyt.exe

Path C:\Temp\i_dbwtrigbyt.exe
Size 389KB
SHA256 94aedf45b70154e077cf286d32e81e049670249df173d0398b4bc937e2397782
MD5 c6b25e6a528fc13c2fcd1784631e9bbd
SHA1 99380e1ff46bc4c37e26cf8111cb6b38e843f290
SHA512 990ad4478e8f7e3af5efb870bc5ed601685fe6fdbdd8173ec6806174772f0ffe39ffbb6ebb2ef8f45123f6a8c4521f0f36677676579fc7c41af286c4535b1406
SSDEEP 3072:Auxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:AuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T144847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtnlfdxnif.exe

Path C:\Temp\i_vtnlfdxnif.exe
Size 389KB
SHA256 3b108c3dccb615e17721a0f540d2eb16daadd83f11d48e37bb62e6c4110dce50
MD5 b4bf71c0629c11932c88f93b91c75c90
SHA1 92c928e3d0cc23470b9ac94a13b529a995fba4d8
SHA512 4852307de7bfecf57bc1844abf6e04af2ea307e925a6df9474e14b29ba80f4d59ec7cc860d510883de17c07711ac0737cbf15d20db01aff1a1d1758ec9aac326
SSDEEP 3072:euxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:euxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_yvqnligays.exe

Path C:\Temp\i_yvqnligays.exe
Size 389KB
SHA256 314a8866cda4169332087185a3efd44703388270abca57a26cb405d07e1c82ba
MD5 751c15f5df5c456139a40204ed472055
SHA1 96e3943e98982e3698d538dc3b2959fce3c623b8
SHA512 4bd6b8a93c86c2dd216ab3ad3bbe04b393c887c735bfd6c454b49f7979d4050eb79faf6e64d144502aa01bcc8436b904b84d32924f25a35838f682202ec7bb67
SSDEEP 3072:Puxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:PuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D9847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdavtnlavt.sys

Path C:\Temp\jdavtnlavt.sys
Size 293KB
SHA256 3cf209f2f752d25df754051a7d7782df6cc380ad8386aa88271c383bdaf50b20
MD5 7e69245dd8f2595b54cae378af3a9622
SHA1 05a567a08f125cebd18c100ea24fda18555f3c8d
SHA512 6943c500965d2d73113371557e32de0cb233f959810f3f3bf9b2d04ac705074d4ba3a064137f5a2d365740c740e5ea420ee374b3c332f89fae572870fea43e9a
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A9545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vqnlfdxvqn.sys

Path C:\Temp\vqnlfdxvqn.sys
Size 293KB
SHA256 686f32e7b85b8818d34eb3732ca7dc13fda4ba1cb8411917000666bc9652e713
MD5 311ecef5cbe1727e82e499b2f9431f63
SHA1 4a8b1f0057e2114dfd9ba41e845e6adbe6a14889
SHA512 7450f84b707f4d21e265e4743a6d13fff9bbd1ef23cbbb2273a290c688e108aff06c6b428da0d52f1951c2bed7224e55a54cdb6f4edc826d786c8bfc99b469a2
SSDEEP 3072:TtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:TIJjiJcbI03GBc3ucY5DCSj
TLSH
T142545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtnlfdxnif.exe

Path C:\Temp\vtnlfdxnif.exe
Size 389KB
SHA256 913d395beef451637b84ccd717cb1fb7fb6e668905bb310a7c71ce165a587614
MD5 528d693aa4e1414e3ce444b4c2413ddb
SHA1 11ae3b2fa06bd6d7560536170cf7f9b17e2897df
SHA512 74fc0f44a6a292b890b529b1a545b83c28743908ae2abf9bfb53568af63d935181f90485218f0adc5bc96d7b08f27f0959a6983d68030bc8e5efe375b20fb31b
SSDEEP 3072:Yuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wusmkecwup.exe

Path C:\Temp\wusmkecwup.exe
Size 389KB
SHA256 66d30853f196866652f860d1a0a8bf205301eaa32561ae8c4e21b91be9fa4278
MD5 e93368bbdaf291fa4244904df59e7e64
SHA1 18dd56ca0e0870e853e1a54dd04ad1dbf6968687
SHA512 9b9c8ca97d382053d3129ae0408a75b528c8a6811e09e60fb80f5756fc43bc58c4eef533d45f6ca2d165fcdc42a525f38e0013ee847b56b9114cde84e78845b4
SSDEEP 3072:uuxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:uuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T150847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yvqnligays.exe

Path C:\Temp\yvqnligays.exe
Size 389KB
SHA256 3275476353ecf38577eeb2b126a0c7e31e05c2110a151f9ea721c3113fd94cc1
MD5 af52cd6d6174f42491d99ef00d7f344b
SHA1 334e26067885433494a786c0afb5b9411943c7bd
SHA512 0c5ed56aba369282af8e6cdbe0705b418fd248547e39f0474b5f2867d92281ec3bc1dcf03512563738417cc304296471cac7581425fe07c75296c7ce719eb786
SSDEEP 3072:Ruxyxtc12aML4yrtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:RuxyxtVlIJjiJcbI03GBc3ucY5DCSjX
TLSH
T113847B04BAA4F0F6CC95047800DFAF36A67EB4281726CBC3E754CE5D99513C3A9356AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxsmkhfzxs.sys

Path C:\Temp\zxsmkhfzxs.sys
Size 293KB
SHA256 db822fe69e50c55d1ea646165e923932cf84b98af8114532ed555b01bb7ca567
MD5 ed91d092930a4aff9bbabe8f5d2c4960
SHA1 4b9cdfe2a6832ac1a09471f1651e4b3a978d0a7d
SHA512 cfce2cf35d40b55f0b9b078165fccc745cb81f7ace4344735a8e2d79482a90df5dddb621a37e4388e762783e7df96dd936784f48aa9f6b300c5ec672fe10eb5e
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T137545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30699ff6-e36f-4eed-b5de-e3ab1234abda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30699ff6-e36f-4eed-b5de-e3ab1234abda.tmp
Size 37KB
SHA256 7eb0dc9f55de90021d567413add7861862b1a61a3e9778ff8cce81726829c33b
MD5 3ce699aba8f63a26dccba8de0b27fb47
SHA1 c84a177b498cd0fe846aedb2e6301299409dc318
SHA512 b8f3c14b02e1d537be4e6f0b8a63731d2f45fc19eb432fe1a008a6119a384c5bbec08abcb1fa99b3dac7d63f5f96d364eb0de791d20e8e85b42cdda98f520234
SSDEEP 768:z/UxvxjgC+k3JIzybNbDsOeRFZD1fTos7Rzt/+Pu:GZj3+k3JQwY1fT/R5Ku
TLSH
T19D03BF39F8D86C378CF7E244B24A764BAFF455A395C91A9809ED6E0E058B7AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96dd3574-51eb-4da8-8ea2-b64ecc5e2a28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96dd3574-51eb-4da8-8ea2-b64ecc5e2a28.tmp
Size 33KB
SHA256 8e308923631e63538844e9f053af81466567360b864e4ce9662a419ac1c5a543
MD5 38d9b2a22d41425206de8cd65061b1dd
SHA1 66edb89705137e1d247fe8fb2c04088166ef4764
SHA512 02cf3552c16f7532c6737598799235adcb2956eb891a5f98224531bc5b1ccb44577a02c65f6e550dc06c53390dc65d52167a1bcd5cfa091a32e8284fd4694025
SSDEEP 768:q43XcPO3AybNbDdSEOeRFZD1fTos7Rj42snUQH:q43sPOwE6Y1fT/RU2sNH
TLSH
T1D3F2BF34B8D45D774CEAE204B34A7A467FF455B399D94A4894E98F0E0487BFD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4123fa2cc2e73053b7602d1d53a57b01f3a6cd8872729fcd7ed66886082b1b99
MD5 5100dc5469c5151f9ac793573116a7fa
SHA1 a8ffca7210c348bef0d710a66e334809b7f58988
SHA512 ead3d81382dc13f1d89e928af9189e5eec6cf3fabfb91ed18d73f1fe38b5e9f76e77fae594633baf6da19747d70fbb17eb97a8a36df60510a930f6006986acfc
TLSH
T1F4D02B75E7EC8412C0C2207C015911A231A37E00D70802C00A05801C18001C20322F09
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a201096456be1e380b7687844e70aa8e2d987a06740acf66db0d56e000a3b50d
MD5 36c9bdf74494657a1636bbc59af48eb0
SHA1 aea8177ffde7e43fa1b4cc5ce6c7cf68c2431306
SHA512 2cf6da34ccb1c58e4f6d50681952d27ffc828c4ede6f38ca0a5e429a4f520e426913b04469e4272eed54102a541263bbb54c2628f542fbe357a4afac921bb49e
TLSH
T143D02B79E7DC8512C0C2207C015811A231B37E00EB0802C00905400C18001C20323F0D
MD5 SHA1 SHA512 TLSH

Submit Download

1f4448f9-5ac0-4d9e-a770-d0066f726a9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f4448f9-5ac0-4d9e-a770-d0066f726a9a.tmp
Size 11KB
SHA256 09cfb1c1230c9ed6f5c57abaa446a3aa0d919d8671301d2a01cec302abe56b4e
MD5 45876a0856e9810583b1443d9c3af068
SHA1 d1d13166838751c2f84039c6675380adc653fab9
SHA512 a296910c2678c36129508f0a275e2c1a820efce19836aab73841faf33145db9aa1b35ca459610ed9c046dbdf2ed10ff4a390be654333699108fc7b7c7cb136a2
SSDEEP 192:sxRhR7CV/fps03ZjlvwnzoA8p92/g6+WNCcS/YDLNGcIgD+aJ:sxRhsV/fps0JjZ38/5A/oF
TLSH
T16442C815AD28AD7B8CCBE21DBB557F53D2F85132A0855E48AAFD8A1C04F76DD320780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

284864d9-f506-4353-a4c0-87ce9bab428f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\284864d9-f506-4353-a4c0-87ce9bab428f.tmp
Size 29KB
SHA256 ffa30dcebd1826fd3d807e84de95538eee6625c879f09bfffb65ee78774e6560
MD5 89123112a616fb9736b0f5e60d42919d
SHA1 a3cea5dbb9cfe3940599bf786429ac1f90f7394c
SHA512 b1a9fd51079ab576d889914776fc3d3759d8f0b4d6db683958bc6614dd2f420b27935ba07c273eccbad8aa805e78e8aa45cb945fea0f665baacaa621ba0e7ceb
SSDEEP 768:SzYbfR7pLuLbxUWgasfA68F1+UoAYDCx9Tuqh0VfUC9xbog/OVd5w8WSQroGtGu:SzYbfHEbxUWgasfA6u1ja+5wtS7YGu
TLSH
T111D2D97B640CCB7F4F904ADDED1A7A9E6D6802CB96D8C98047FA941C02C67EF511A0DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36ad33f5-7eda-44aa-bddd-c6b69e4d173f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\36ad33f5-7eda-44aa-bddd-c6b69e4d173f.tmp
Size 11KB
SHA256 09809304f133128ac2b26aba0d9c658625fa829ee9349683683b88564030eefb
MD5 535d3cd3e80df73e3bb2acb44736986f
SHA1 ae5369663d6208d2de6bb080ed0ce3b788468504
SHA512 c26258f03c48a7d8e299c1588886d3fb255259da6cfae05ff79100fa91e1c9461e12720e110f9a1acb772fd743f5d5e9b6318b6b51177843b863d8bd0957de3c
SSDEEP 192:sxRhR7CV/fpsT3ZjlvwnzoA8p92/g6+WNCcS/YDZNGcIgDMaJ:sxRhsV/fpsTJjZ38/5A/s/
TLSH
T10A42C815AD28AD7B4CCBE21DBB597F53D2F85132A0D45E48EAFD8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e78d047fb34bb0de1c2dfb1626576071bce6a09196472bb13a2ab608e499eb4b
MD5 5a19ad65a412083084a9b3db880a1893
SHA1 24e07d487d88237c572562e41106087ce859464d
SHA512 b987209ef06164c1aff13b3eb086fb98ba058d07c1fe398debae44d9f32494a42af199ace6b108a411016c9211a7f1f51c69b625d9f85a1ef29455a6a9053569
TLSH
T1D851B8EA617C04ECFFE60AB142D15E93B6B55B4459A32E5D24B0CE7CD8373A4568C1CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 dd6f77916ecb55fae8e6307558627358754c5e877fe7e73a65d0cd841092c686
MD5 ea23e7aed074685982f3b4d62519ff70
SHA1 b21400f616ac7919eed0992a106571decf44d60a
SHA512 a2e4fe38c2aea09bad5f779dff95a03ab5b2c0a21b5b3e5852c71a8f955966add577da4c0ab9d947d100f650e8063d7e31014f75e2fa1278ca36db24a99fdeb3
TLSH
T1A151BAEA617C40DCFFE60AB142D15E83B6B55B4455A32D5E24B0CE7CD8373A4968C1CC
MD5 SHA1 SHA512 TLSH

Submit Download

f0a3eb99-b2af-4a45-b547-671421e86ec2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f0a3eb99-b2af-4a45-b547-671421e86ec2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3817f347-70aa-493e-ae2c-68518ae37b9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3817f347-70aa-493e-ae2c-68518ae37b9c.tmp
Size 2KB
SHA256 2c6984aae9a012aa7e8edb2eafbb02533af801d57557baf37fece70ceb951387
MD5 688a8f23347fe436e323fd8822420ab0
SHA1 97f899ae14dbe09a98215f4deebcf0953609b585
SHA512 4cc3f2e1822fb53ad8451d8dac8d87739c4731006ab3133936e11fe371072ba3ff56665853ea0ed8bc3c216c11f3d13197276c5bcd076e5a1e555b8f5bef02fb
TLSH
T1D451BEF7C3E8866E890196F4AB186E2BCE2D0954432C3D5AC8E49F2B93E2471D14199F
MD5 SHA1 SHA512 TLSH

Submit Download

8c477bcd-6c1d-4be9-9020-e537629cb75e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8c477bcd-6c1d-4be9-9020-e537629cb75e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dce4f4c2-d905-4f0b-a333-c91da791e633.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dce4f4c2-d905-4f0b-a333-c91da791e633.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b6f2094f-66ac-440b-b9ad-ce8d11ce832b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6f2094f-66ac-440b-b9ad-ce8d11ce832b.tmp
Size 11KB
SHA256 da1514a7add3e9986400fde23ede4a9c8132dd9adab8999b019bbaf25920cc5a
MD5 1a8aea46b0f262ee77174fd0db73173f
SHA1 86874a8ab8f7b81bf3e4c888e8547f3cb56ca37d
SHA512 dd96955f576a5c9748546f070b89ac6ff5cdffac3e8dbbe9271ead62c2ae676dc7e8c689532cafd7bac6998f872cf6d8aac8f1491e37358d82b0f841207d880c
SSDEEP 192:sxRKR7CV/fpsn3ZjlvwnzoA8p92/g6+WNCcS/YDZNGcIgVaJ:sxRKsV/fpsnJjZ38/5A/sg
TLSH
T1E232D815AD28AD7B4CCBE20DBB597F53D2F95132A0D45E48EAFD8A1C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be5426d8-9de1-40e1-836f-b64b0806e398.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be5426d8-9de1-40e1-836f-b64b0806e398.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

200c6ef1-782c-498d-9f55-c44a52ad1aae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\200c6ef1-782c-498d-9f55-c44a52ad1aae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b2ca808d-1332-43ed-ad33-c94747b67e08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b2ca808d-1332-43ed-ad33-c94747b67e08.tmp
Size 42KB
SHA256 c0463daefda2e35c7be131cbdcc81863608a7ca51aa819d8db162fae6f8683f1
MD5 a05935cd8e61a0cf0405676076ecc033
SHA1 a07b2d08026afde5c7d7ecaa6835d13cb65feccb
SHA512 1270baac629f9a7683b40d5385acf88adf8322470b17daa25d3e52dfc1efc47966bc61d15d9230133b9fa48feec421e343c5b7a749235a7c66119f3f8dbf1d08
SSDEEP 768:hFQt36wgncPOPQSDdSBOeRFZD1fTos7Rj42snUQH:wt31POFvY1fT/RU2sNH
TLSH
T1801339F598D79976D8AE9343A33D7E06AEBCD163B4888484B7D44D0DCC826BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3ecb858-60f5-499b-b156-c660d9688249.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c3ecb858-60f5-499b-b156-c660d9688249.tmp
Size 33KB
SHA256 8384b1a75600c0d570ab85acec6be80df3035dc15bac6a44fdea75753578667d
MD5 e17f7e9499ca26e33bb3d0acb7b8d314
SHA1 6dc409b989d05ebbd7ee34feeb7ef29195eddde1
SHA512 527b4a41f7069edc3bf04ce3bfb971c96e975b9d40d2512ec6e265c3127c85e13796d1ecc1c8b1232bfe8b5f5f8da826a2bad3f20a997c6bda7ae89224a9f1c0
SSDEEP 768:l43kcPOsAybNbDdS9OeRFZD1fTos7Rj42snUQH:l437PO3ETY1fT/RU2sNH
TLSH
T18FF2BF34B8945D734CEAE245B24A7A067FF455B399D98A4894E98F0E0487BFD230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f6def0a-2c9a-4a8c-8820-d2bc302d0a3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\1f6def0a-2c9a-4a8c-8820-d2bc302d0a3b.tmp
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

442225ff-848e-4c3b-bf30-f959ce73d413.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\442225ff-848e-4c3b-bf30-f959ce73d413.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

d8941a2f-5636-460e-96a5-b5bfd643d32c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\d8941a2f-5636-460e-96a5-b5bfd643d32c.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

f7c00fa3-be8b-419e-9071-6e654ee6e6a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f7c00fa3-be8b-419e-9071-6e654ee6e6a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

a2dc9339-9d00-4a79-8125-4f9da65a0013.tmp

Path C:\Users\Admin\AppData\Local\Temp\a2dc9339-9d00-4a79-8125-4f9da65a0013.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ddb06002-c3e6-4312-9b58-c9f2632f6368.tmp

Path C:\Users\Admin\AppData\Local\Temp\ddb06002-c3e6-4312-9b58-c9f2632f6368.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2212_853766008\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1443068373\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_1680170203\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_297000110\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2212_978855595\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 0a4de185b81de5da330471581964e356979a48604982a480a900e67df22404ee
MD5 911cc00b7a233ff640e948e66d6db668
SHA1 23e806262c31521e820d9ec3a97643fc0b225200
SHA512 bca583225b7e7e64e5bb73c26ce1f59d23e1f1d9af4aedcf5b6d795e08f2cd67b365c0b15e4cf46cf6453fac0a01a37cfa4d8c39f1fe94c2ee74e66ba202550b
TLSH
T1B971238357A8DAB3C5DE9BF003835604F6FB223C072370640B965946FB30A7A54B8F18
MD5 SHA1 SHA512 TLSH

Submit Download

memory/472-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1100-340-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1464-482-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1608-323-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1652-444-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-483-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2144-478-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2148-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2328-271-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2708-440-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2712-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3012-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3264-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3420-325-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3544-501-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3768-283-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4332-344-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4632-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5400-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5472-296-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5900-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download