systex | 755fe6ef58c5c2c0e019c42de3f873e257b1141c08e75957b76d182b9b4e0062

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260814-3ab34atekh
SHA256 755fe6ef58c5c2c0e019c42de3f873e257b1141c08e75957b76d182b9b4e0062
MD5 9e6a32d86b4bd9193b24d805accffec9
SHA1 64458438a1f0d01198ef5077e32e0c1e68173c5b
SHA512 608e757aa7d9d9658b090f1ef878bead1c971f5a70b196e46c9adfad2a6f578d1a3608e1d9bc7309dd1f6e3658c1ac22a7c71f1020dc97670ba07b7285a1ec1b
SSDEEP 3072:z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:RctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T109847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
864	dyvqoigaysqlavtn.exe
3364	dyvqoigaysqlavtn.sys
6080	CreateProcess.exe
3808	ysqkigdysq.exe
4200	CreateProcess.exe
852	CreateProcess.exe
2352	i_ysqkigdysq.exe
5072	kicaysqnif.sys
1916	CreateProcess.exe
4596	dxvpnlfdxn.exe
2052	CreateProcess.exe
4120	CreateProcess.exe
5788	i_dxvpnlfdxn.exe
2644	causnkicau.sys
868	CreateProcess.exe
2708	uspkicausn.exe
3228	CreateProcess.exe
5736	CreateProcess.exe
3264	i_uspkicausn.exe
1648	spkhcausmk.sys
3652	CreateProcess.exe
1728	jhfzxrpjhf.exe
2488	CreateProcess.exe
1376	CreateProcess.exe
4116	i_jhfzxrpjhf.exe
5500	wuomkecwur.sys
4808	CreateProcess.exe
1340	uomjeczxrp.exe
3500	CreateProcess.exe
3952	CreateProcess.exe
2304	i_uomjeczxrp.exe
5128	hbztrmjebw.sys
248	CreateProcess.exe
4108	trmjebwuom.exe
4232	CreateProcess.exe
2664	CreateProcess.exe
2592	i_trmjebwuom.exe
4416	bzwtoljdby.sys
4792	CreateProcess.exe
5000	hbywtoljdb.exe
2872	CreateProcess.exe
1460	CreateProcess.exe
5876	i_hbywtoljdb.exe
3068	igdywqoigb.sys
4172	CreateProcess.exe
2620	igaytqljda.exe
5016	CreateProcess.exe
3696	CreateProcess.exe
3152	i_igaytqljda.exe
3840	ligbqlidbv.sys
3416	CreateProcess.exe
2524	vtnlfdyvqo.exe
1592	CreateProcess.exe
2592	CreateProcess.exe
2616	i_vtnlfdyvqo.exe
4344	vtnlfdxvqn.sys
4244	CreateProcess.exe
4380	qndxvsnlfd.exe
5652	CreateProcess.exe
2804	CreateProcess.exe
2780	i_qndxvsnlfd.exe
4152	nkicavsnkf.sys
5068	CreateProcess.exe
2876	kicausnkfc.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1787296316\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_2075704089\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_2075704089\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1021076653\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1432444259\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1021076653\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1432444259\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1432444259\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2924_1432444259\smart_switch_list.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvpnlfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaytqljda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qndxvsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qndxvsnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zwurmjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axsqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkigdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uomjeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kicausnkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dyvqoigaysqlavtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_uspkicausn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_trmjebwuom.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbywtoljdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbztrmjebw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkigdysq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vsqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avsqolfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_avsqolfvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_axsqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvpnlfdxn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_jhfzxrpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaytqljda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kfcausmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsqlidbvtn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnlfdyvqo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusmkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zwurmjztrm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbwtomge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhfzxrpjhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uomjeczxrp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_kfcausmkfc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4280	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1268	ipconfig.exe
5572	ipconfig.exe
4624	ipconfig.exe
4456	ipconfig.exe
4192	ipconfig.exe
2476	ipconfig.exe
2928	ipconfig.exe
5004	ipconfig.exe
1108	ipconfig.exe
6132	ipconfig.exe
1888	ipconfig.exe
1304	ipconfig.exe
5008	ipconfig.exe
5048	ipconfig.exe
2348	ipconfig.exe
3920	ipconfig.exe
348	ipconfig.exe
568	ipconfig.exe
4624	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312231043256133"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{DD8BB0CF-BF06-4543-8767-05E01DBA9C36}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe
864	dyvqoigaysqlavtn.exe

Suspicious behavior: LoadsDriver 20 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2352	i_ysqkigdysq.exe
Token: SeDebugPrivilege	5788	i_dxvpnlfdxn.exe
Token: SeDebugPrivilege	3264	i_uspkicausn.exe
Token: SeDebugPrivilege	4116	i_jhfzxrpjhf.exe
Token: SeDebugPrivilege	2304	i_uomjeczxrp.exe
Token: SeDebugPrivilege	2592	i_trmjebwuom.exe
Token: SeDebugPrivilege	5876	i_hbywtoljdb.exe
Token: SeDebugPrivilege	3152	i_igaytqljda.exe
Token: SeDebugPrivilege	2616	i_vtnlfdyvqo.exe
Token: SeDebugPrivilege	2780	i_qndxvsnlfd.exe
Token: SeDebugPrivilege	5336	i_kicausnkfc.exe
Token: SeDebugPrivilege	5144	i_kfcausmkfc.exe
Token: SeDebugPrivilege	5048	i_wusmkecwup.exe
Token: SeDebugPrivilege	4864	i_zwurmjztrm.exe
Token: SeDebugPrivilege	4904	i_hbztrmjebw.exe
Token: SeDebugPrivilege	1888	i_ljdbwtomge.exe
Token: SeDebugPrivilege	3916	i_vsqlidbvtn.exe
Token: SeDebugPrivilege	5864	i_avsqolfvpn.exe
Token: SeDebugPrivilege	3068	i_axsqnifays.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 864	2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe	88
PID 2420 wrote to memory of 3532	2420	2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 3532 wrote to memory of 2924	3532	iexplore.exe	90
PID 2924 wrote to memory of 4664	2924	msedge.exe	91
PID 2924 wrote to memory of 3596	2924	msedge.exe	92
PID 2924 wrote to memory of 4280	2924	msedge.exe	94
PID 2924 wrote to memory of 3596	2924	msedge.exe	92
PID 2924 wrote to memory of 3596	2924	msedge.exe	92
PID 2924 wrote to memory of 5936	2924	msedge.exe	95
PID 2924 wrote to memory of 5936	2924	msedge.exe	95
PID 2924 wrote to memory of 5812	2924	msedge.exe	96
PID 2924 wrote to memory of 5812	2924	msedge.exe	96
PID 2924 wrote to memory of 5812	2924	msedge.exe	96
PID 2924 wrote to memory of 3000	2924	msedge.exe	97
PID 2924 wrote to memory of 3000	2924	msedge.exe	97
PID 2924 wrote to memory of 3000	2924	msedge.exe	97
PID 2924 wrote to memory of 4872	2924	msedge.exe	98
PID 2924 wrote to memory of 4872	2924	msedge.exe	98
PID 2924 wrote to memory of 4872	2924	msedge.exe	98
PID 2924 wrote to memory of 5500	2924	msedge.exe	99
PID 2924 wrote to memory of 5500	2924	msedge.exe	99
PID 2924 wrote to memory of 5500	2924	msedge.exe	99
PID 2924 wrote to memory of 1160	2924	msedge.exe	100
PID 2924 wrote to memory of 1160	2924	msedge.exe	100
PID 864 wrote to memory of 6080	864	dyvqoigaysqlavtn.exe	104
PID 2924 wrote to memory of 4196	2924	msedge.exe	106
PID 2924 wrote to memory of 4520	2924	msedge.exe	107
PID 2924 wrote to memory of 4196	2924	msedge.exe	106
PID 2924 wrote to memory of 4520	2924	msedge.exe	107
PID 3808 wrote to memory of 4200	3808	ysqkigdysq.exe	109
PID 2924 wrote to memory of 5588	2924	msedge.exe	113
PID 2924 wrote to memory of 1876	2924	msedge.exe	114
PID 2924 wrote to memory of 1876	2924	msedge.exe	114
PID 2924 wrote to memory of 1232	2924	msedge.exe	117
PID 2924 wrote to memory of 1232	2924	msedge.exe	117
PID 864 wrote to memory of 852	864	dyvqoigaysqlavtn.exe	119
PID 2924 wrote to memory of 1372	2924	msedge.exe	123
PID 2924 wrote to memory of 1372	2924	msedge.exe	123
PID 2924 wrote to memory of 1372	2924	msedge.exe	123
PID 864 wrote to memory of 1916	864	dyvqoigaysqlavtn.exe	124
PID 4596 wrote to memory of 2052	4596	dxvpnlfdxn.exe	126
PID 2924 wrote to memory of 5052	2924	msedge.exe	129
PID 2924 wrote to memory of 5052	2924	msedge.exe	129
PID 2924 wrote to memory of 5052	2924	msedge.exe	129
PID 864 wrote to memory of 4120	864	dyvqoigaysqlavtn.exe	130
PID 864 wrote to memory of 868	864	dyvqoigaysqlavtn.exe	134
PID 2708 wrote to memory of 3228	2708	uspkicausn.exe	136
PID 864 wrote to memory of 5736	864	dyvqoigaysqlavtn.exe	139
PID 864 wrote to memory of 3652	864	dyvqoigaysqlavtn.exe	144
PID 1728 wrote to memory of 2488	1728	jhfzxrpjhf.exe	146
PID 2924 wrote to memory of 3352	2924	msedge.exe	149
PID 2924 wrote to memory of 3352	2924	msedge.exe	149
PID 2924 wrote to memory of 3352	2924	msedge.exe	149
PID 864 wrote to memory of 1376	864	dyvqoigaysqlavtn.exe	150
PID 2924 wrote to memory of 4308	2924	msedge.exe	152
PID 2924 wrote to memory of 3336	2924	msedge.exe	153
PID 2924 wrote to memory of 996	2924	msedge.exe	154
PID 864 wrote to memory of 4808	864	dyvqoigaysqlavtn.exe	157
PID 1340 wrote to memory of 3500	1340	uomjeczxrp.exe	159
PID 864 wrote to memory of 3952	864	dyvqoigaysqlavtn.exe	162
PID 864 wrote to memory of 248	864	dyvqoigaysqlavtn.exe	166
PID 4108 wrote to memory of 4232	4108	trmjebwuom.exe	168
PID 864 wrote to memory of 2664	864	dyvqoigaysqlavtn.exe	171
PID 864 wrote to memory of 4792	864	dyvqoigaysqlavtn.exe	175

C:\Users\Admin\AppData\Local\Temp\2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_9e6a32d86b4bd9193b24d805accffec9_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Temp\dyvqoigaysqlavtn.exe
  C:\Temp\dyvqoigaysqlavtn.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkigdysq.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6080
  - - C:\Temp\ysqkigdysq.exe
      C:\Temp\ysqkigdysq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2928
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkigdysq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:852
  - - C:\Temp\i_ysqkigdysq.exe
      C:\Temp\i_ysqkigdysq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2352
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvpnlfdxn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1916
  - - C:\Temp\dxvpnlfdxn.exe
      C:\Temp\dxvpnlfdxn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4596
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5004
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvpnlfdxn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4120
  - - C:\Temp\i_dxvpnlfdxn.exe
      C:\Temp\i_dxvpnlfdxn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5788
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uspkicausn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:868
  - - C:\Temp\uspkicausn.exe
      C:\Temp\uspkicausn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3228
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uspkicausn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5736
  - - C:\Temp\i_uspkicausn.exe
      C:\Temp\i_uspkicausn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3264
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\jhfzxrpjhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3652
  - - C:\Temp\jhfzxrpjhf.exe
      C:\Temp\jhfzxrpjhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1728
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2488
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_jhfzxrpjhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1376
  - - C:\Temp\i_jhfzxrpjhf.exe
      C:\Temp\i_jhfzxrpjhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\uomjeczxrp.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\uomjeczxrp.exe
      C:\Temp\uomjeczxrp.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:568
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_uomjeczxrp.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3952
  - - C:\Temp\i_uomjeczxrp.exe
      C:\Temp\i_uomjeczxrp.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\trmjebwuom.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:248
  - - C:\Temp\trmjebwuom.exe
      C:\Temp\trmjebwuom.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4108
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_trmjebwuom.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2664
  - - C:\Temp\i_trmjebwuom.exe
      C:\Temp\i_trmjebwuom.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2592
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbywtoljdb.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4792
  - - C:\Temp\hbywtoljdb.exe
      C:\Temp\hbywtoljdb.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6132
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbywtoljdb.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1460
  - - C:\Temp\i_hbywtoljdb.exe
      C:\Temp\i_hbywtoljdb.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaytqljda.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4172
  - - C:\Temp\igaytqljda.exe
      C:\Temp\igaytqljda.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2620
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5016
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2476
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaytqljda.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3696
  - - C:\Temp\i_igaytqljda.exe
      C:\Temp\i_igaytqljda.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnlfdyvqo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3416
  - - C:\Temp\vtnlfdyvqo.exe
      C:\Temp\vtnlfdyvqo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5008
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnlfdyvqo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2592
  - - C:\Temp\i_vtnlfdyvqo.exe
      C:\Temp\i_vtnlfdyvqo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qndxvsnlfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4244
  - - C:\Temp\qndxvsnlfd.exe
      C:\Temp\qndxvsnlfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5652
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qndxvsnlfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2804
  - - C:\Temp\i_qndxvsnlfd.exe
      C:\Temp\i_qndxvsnlfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2780
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kicausnkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5068
  - - C:\Temp\kicausnkfc.exe
      C:\Temp\kicausnkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2876
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4568
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kicausnkfc.exe ups_ins
    3⤵
    PID:3840
  - - C:\Temp\i_kicausnkfc.exe
      C:\Temp\i_kicausnkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5336
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\kfcausmkfc.exe ups_run
    3⤵
    PID:1624
  - - C:\Temp\kfcausmkfc.exe
      C:\Temp\kfcausmkfc.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5080
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1268
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_kfcausmkfc.exe ups_ins
    3⤵
    PID:4732
  - - C:\Temp\i_kfcausmkfc.exe
      C:\Temp\i_kfcausmkfc.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5144
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wusmkecwup.exe ups_run
    3⤵
    PID:3560
  - - C:\Temp\wusmkecwup.exe
      C:\Temp\wusmkecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2932
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3380
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wusmkecwup.exe ups_ins
    3⤵
    PID:5516
  - - C:\Temp\i_wusmkecwup.exe
      C:\Temp\i_wusmkecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5048
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zwurmjztrm.exe ups_run
    3⤵
    PID:3136
  - - C:\Temp\zwurmjztrm.exe
      C:\Temp\zwurmjztrm.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4788
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2348
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zwurmjztrm.exe ups_ins
    3⤵
    PID:4560
  - - C:\Temp\i_zwurmjztrm.exe
      C:\Temp\i_zwurmjztrm.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbztrmjebw.exe ups_run
    3⤵
    PID:1996
  - - C:\Temp\hbztrmjebw.exe
      C:\Temp\hbztrmjebw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4540
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:724
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5572
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbztrmjebw.exe ups_ins
    3⤵
    PID:4272
  - - C:\Temp\i_hbztrmjebw.exe
      C:\Temp\i_hbztrmjebw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbwtomge.exe ups_run
    3⤵
    PID:2352
  - - C:\Temp\ljdbwtomge.exe
      C:\Temp\ljdbwtomge.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1784
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4872
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1304
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbwtomge.exe ups_ins
    3⤵
    PID:5876
  - - C:\Temp\i_ljdbwtomge.exe
      C:\Temp\i_ljdbwtomge.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vsqlidbvtn.exe ups_run
    3⤵
    PID:5508
  - - C:\Temp\vsqlidbvtn.exe
      C:\Temp\vsqlidbvtn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2000
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2900
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4624
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vsqlidbvtn.exe ups_ins
    3⤵
    PID:4600
  - - C:\Temp\i_vsqlidbvtn.exe
      C:\Temp\i_vsqlidbvtn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\avsqolfvpn.exe ups_run
    3⤵
    PID:4400
  - - C:\Temp\avsqolfvpn.exe
      C:\Temp\avsqolfvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4456
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_avsqolfvpn.exe ups_ins
    3⤵
    PID:4372
  - - C:\Temp\i_avsqolfvpn.exe
      C:\Temp\i_avsqolfvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\axsqnifays.exe ups_run
    3⤵
    PID:1752
  - - C:\Temp\axsqnifays.exe
      C:\Temp\axsqnifays.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1304
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4564
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3920
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_axsqnifays.exe ups_ins
    3⤵
    PID:1060
  - - C:\Temp\i_axsqnifays.exe
      C:\Temp\i_axsqnifays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3068
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffd2baac188,0x7ffd2baac194,0x7ffd2baac1a0
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,16993110067109939489,8536659290123082715,262144 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6193996634460762407,986539686527632947,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
      4⤵
      System Time Discovery
      PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,7428304772767838634,5422118905378854848,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
      4⤵
      PID:5936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,13030541684602763322,11056510413013211353,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,16104729307686834816,14820781775140075857,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
      4⤵
      PID:3000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,17950628776616493663,13253219827918747066,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,11682781418652044086,13666032790032027759,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:5500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,15764296207685990405,12790654331993840821,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14214714161753993904,11966064506616798278,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,18046873197625036869,14792447158967529365,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:14
      4⤵
      PID:4520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12174122754458444579,1066930881172833113,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:1004
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,12174122754458444579,1066930881172833113,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
      4⤵
      PID:5588
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,3647895729708181790,3135686036360313506,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,13762568048909311899,13445110608381162563,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
      4⤵
      PID:1232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6200,i,11196717288006965116,17885327731816311221,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
      4⤵
      PID:1372
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6660,i,7850936838074789765,12135717206010994418,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
      4⤵
      PID:5052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6596,i,5341498356749990919,1838764706914547047,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
      4⤵
      PID:3352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,3353443996878976135,7816214833436491438,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,13527638051767785733,11755010491398584940,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,599060820862628183,3679546672129689339,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
      4⤵
      PID:996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2772,i,12394117352254744724,15685405987807876976,2097152 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
      4⤵
      PID:472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,7535344056513999773,5704251859208448588,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
      4⤵
      PID:3508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,1411979199715401084,4410224714242222328,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=928,i,4991246483370208017,6637997053972033884,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,772370839667221023,16192734933166452679,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:5912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,12356930675660889463,5400810727695179424,262144 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:10
      4⤵
      PID:4284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,16084119342683101592,9517062399732371468,524288 --field-trial-handle=2332,i,264391760869589985,8507054863372124158,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:14
      4⤵
      PID:5548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1416

C:\Temp\dyvqoigaysqlavtn.sys
C:\Temp\dyvqoigaysqlavtn.sys
1⤵
- Executes dropped EXE
PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4076

C:\Temp\kicaysqnif.sys
C:\Temp\kicaysqnif.sys
1⤵
- Executes dropped EXE
PID:5072

C:\Temp\causnkicau.sys
C:\Temp\causnkicau.sys
1⤵
- Executes dropped EXE
PID:2644

C:\Temp\spkhcausmk.sys
C:\Temp\spkhcausmk.sys
1⤵
- Executes dropped EXE
PID:1648

C:\Temp\wuomkecwur.sys
C:\Temp\wuomkecwur.sys
1⤵
- Executes dropped EXE
PID:5500

C:\Temp\hbztrmjebw.sys
C:\Temp\hbztrmjebw.sys
1⤵
- Executes dropped EXE
PID:5128

C:\Temp\bzwtoljdby.sys
C:\Temp\bzwtoljdby.sys
1⤵
- Executes dropped EXE
PID:4416

C:\Temp\igdywqoigb.sys
C:\Temp\igdywqoigb.sys
1⤵
- Executes dropped EXE
PID:3068

C:\Temp\ligbqlidbv.sys
C:\Temp\ligbqlidbv.sys
1⤵
- Executes dropped EXE
PID:3840

C:\Temp\vtnlfdxvqn.sys
C:\Temp\vtnlfdxvqn.sys
1⤵
- Executes dropped EXE
PID:4344

C:\Temp\nkicavsnkf.sys
C:\Temp\nkicavsnkf.sys
1⤵
- Executes dropped EXE
PID:4152

C:\Temp\khfcxusmkh.sys
C:\Temp\khfcxusmkh.sys
1⤵
PID:5848

C:\Temp\mkecxukecx.sys
C:\Temp\mkecxukecx.sys
1⤵
PID:1984

C:\Temp\wurmjebzur.sys
C:\Temp\wurmjebzur.sys
1⤵
PID:2016

C:\Temp\ebwuomjecw.sys
C:\Temp\ebwuomjecw.sys
1⤵
PID:3916

C:\Temp\igbywqojge.sys
C:\Temp\igbywqojge.sys
1⤵
PID:2532

C:\Temp\igeywqodyw.sys
C:\Temp\igeywqodyw.sys
1⤵
PID:2280

C:\Temp\ayvtnligay.sys
C:\Temp\ayvtnligay.sys
1⤵
PID:5452

C:\Temp\cavsnkicav.sys
C:\Temp\cavsnkicav.sys
1⤵
PID:5540

C:\Temp\vpnhfaxspk.sys
C:\Temp\vpnhfaxspk.sys
1⤵
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

causnkicau.sys

Path C:\Temp\causnkicau.sys
Size 293KB
SHA256 28d56f48d860e71797a93a5cf7ea9ae06057b04ba2b21f9ad41a7b1e10c974ec
MD5 1a18ede564e88a821ed6189d7da52a07
SHA1 52229c71ae1c285bf05764e8414df9274d1f11b1
SHA512 07f51ede8b72c80e4eda71ee5bb01c50eb1838d6ceb0cd54d56db38be211833b8d3ef4e542b1d1328738b714b37b42609d848875d5688f2d3d5973198cecbe54
SSDEEP 3072:otKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:oIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CC545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxvpnlfdxn.exe

Path C:\Temp\dxvpnlfdxn.exe
Size 384KB
SHA256 ef5ad75af036f597bfd845da85e1df1fea62d8359152c801c89c74f65db7ef44
MD5 4a6000cab066ff187e92be595c60586b
SHA1 575dc428db778eab46bce997df3efa41d405586c
SHA512 d1cb5161449b9c4fd01ffb0c544878ddc98c444ee5b5f28b7295f5e2e705800abef2c2abc47464133aec56b0f79a2a4d13413a93ca7df43c93d7fceec53c4521
SSDEEP 3072:m9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:UctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T15F847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigaysqlavtn.exe

Path C:\Temp\dyvqoigaysqlavtn.exe
Size 384KB
SHA256 e2430c0346bb564516c928bde0f40284f5597bda291639189cf138d7fcfea392
MD5 27621a60abe5cfdac93403d072359abc
SHA1 656510f445e210107ffc6e18cb73823e99d6df88
SHA512 b56e9e24c65fd08b49b85bc0a001d50f861d202071cd5eb7ea1c0b1d8eadc40022e2dc97c9fc5950e03f76e5a1a2e686e452fa233ef95ad85bcb7f2db918279a
SSDEEP 3072:39ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:NctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dyvqoigaysqlavtn.sys

Path C:\Temp\dyvqoigaysqlavtn.sys
Size 293KB
SHA256 78155a907186b44f016554fa86d9a949161b5a17fa39ee789f9d744bc2dc6f3c
MD5 a39dcb5a0839a3b20a3f49a03db857b2
SHA1 9cda75124e4ab998df97e540cfa543fb685fd895
SHA512 67a24fb24a50761c8d390247b7dcab3451a2575d5fbfbc8264966ff82d28ecda3865fe718691b7225f2320741c2c432a8cb4299c63f5b4119b9b397089e0a64d
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C3545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbztrmjebw.sys

Path C:\Temp\hbztrmjebw.sys
Size 293KB
SHA256 f6d9493ac698848e6701fbc89feee45dc3e5a33e1ed1ef2d7718e711e416aed6
MD5 414af8d1ce0e14865ea48fa8a3dba7f0
SHA1 105615035dfb8fd0c48cd4a294b7bbcb4c749961
SHA512 d8c669ca41cbdb22661600460d7aa5e999efb5fa8575d38b4e90fb79bd2db87f539cb983bfe2158b6377af3fb864986339380c8ed59b417efd9f822491214359
SSDEEP 3072:8tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:8IJjiJcbI03GBc3ucY5DCSj
TLSH
T1FA545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dxvpnlfdxn.exe

Path C:\Temp\i_dxvpnlfdxn.exe
Size 384KB
SHA256 9f962c0cca3737aec08eae063eba07e97c7db6cfda6268f288f8bddfab684dc0
MD5 47def8ee3884a70b15a3657544a02801
SHA1 e8bc88bb72cfa42d9f944caf484737248fc84deb
SHA512 6f7df2ddf26a46916910fd817d61c6a678dcc698cd8f8a134210ac5a877afdccb4433c3f512f281c3128818a0988a4a7fbdb00d7d866d828d3d8b6503d3c687c
SSDEEP 3072:y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:IctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T140847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_jhfzxrpjhf.exe

Path C:\Temp\i_jhfzxrpjhf.exe
Size 384KB
SHA256 168c01b8a4f9791abe801e791920ea837c476d10be031b21d98279516bc37616
MD5 3829a3a40b6ca0ba8188111f82def2ce
SHA1 02025788bd6edde296071ab66ff5a827bf02797d
SHA512 6e6e94ae1ecf928760faeae5d7a26be334d0b70462bb92c7f5659e326fe327b191a145829f4b8e0db4a8aeb6f0838887d3717c99e911365c189d59005eea84ec
SSDEEP 3072:F9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:nctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uomjeczxrp.exe

Path C:\Temp\i_uomjeczxrp.exe
Size 384KB
SHA256 2fcabab01c831d1b8017e52bdbbc41f3a0de17f28eca953f89e09750d786fa82
MD5 d42f023996517bef818444cae9525df9
SHA1 486b06943a906f3ee918b4f76a06c23629dbfb36
SHA512 93080880bce0f30816ddea6124038e525c4013bbafab8f4ccb5d46b8aa49aef2be56af939c9ed87dcecc8a4256e7239d4f5428a9726023928cece3583171bbdf
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_uspkicausn.exe

Path C:\Temp\i_uspkicausn.exe
Size 384KB
SHA256 ec899142e3894d3433896489ab61c0c194a648d0c998e39704cc4480c37bbe4c
MD5 7e064535b6b1402dcf06c0c66bec98a6
SHA1 0c62c876af8721a33d12f4ec6568bf903fe9fdbc
SHA512 e4c219bae9ccce2e5a5394596fd955eb93f29b452c2d90723fb6911ce02ba7462d6e378acd27bad3a5e3ebd6596ec8e8d00cf8640f17a8b825960e4c6368f48d
SSDEEP 3072:L9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:5ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkigdysq.exe

Path C:\Temp\i_ysqkigdysq.exe
Size 384KB
SHA256 16e5b07fe977ad7f33d82ba74b9a92f9507b9f5109cd05f807bfc06c9486c3f8
MD5 88af8879df67e261fc9ec7feeefc036a
SHA1 dd6597805eee73f0e7a774743074bc9ed2a944bb
SHA512 e27110b3d604af2ab1350158e75851db52d8b9acfb4c50f90ef5fce19c0718537d73709971d0d246ca7015329427eda399f5a6d61423e128739b65e34c29e83f
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T161847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jhfzxrpjhf.exe

Path C:\Temp\jhfzxrpjhf.exe
Size 384KB
SHA256 8810bd2f823df434a81d22d48f1ce3d1e83f1d291acbbcbfaa0447efdf223cd5
MD5 d717662fb533192f7efa15f87d4b6047
SHA1 df5e8d7007bb256602a2a1134e436ee0268d5315
SHA512 097be0de9ef69b5afc4c0d89b8bd703c771d1525c658285d52d15f4b359ebee0d37e8f393123a1fdefe9d0b40cf25ee256b1fb4a32609ad2cffbb1ca211b8c0d
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T139847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kicaysqnif.sys

Path C:\Temp\kicaysqnif.sys
Size 293KB
SHA256 67f565692e1d6fa087edda5b87b36094b6e4369e586f508d784f6ead0083241d
MD5 0e039edd09c6088e36f97ba2fa756396
SHA1 8057fce25d834762d81b0fe06ab6acae6e9506e3
SHA512 e7691b71d7bc1752e04084fc878ed370f6fad7e38341c85039c1754163395fb29c6bb4ab94d87b7a818c05f124934af506928fd28147e865f68b36275bbe65f5
SSDEEP 3072:utKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:uIJjiJcbI03GBc3ucY5DCSj
TLSH
T1BE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spkhcausmk.sys

Path C:\Temp\spkhcausmk.sys
Size 293KB
SHA256 c9648d41212bda3fb90ceae35ba93b504954ed39fc6e9529db6db7e4e6caed3d
MD5 15482e53c5414b765c790d40b0cb4f11
SHA1 94c1929c86338623cb5ee7d55a991f613a4961a0
SHA512 c9ecfea13037c295db1aa92732fec841c76d8ddc58930b5f0ab6b4dc253345b35f2ce351f7798a2ea174eb323ae151b80c2d44cc1397f5a009fcfc0a321dbb10
SSDEEP 3072:ktKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:kIJjiJcbI03GBc3ucY5DCSj
TLSH
T192545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

trmjebwuom.exe

Path C:\Temp\trmjebwuom.exe
Size 384KB
SHA256 517ec443d1971af4f7ba5cb25db8f0a43cfed0d5459ae80bf39915fe2511e306
MD5 a18cadb394897bde234a26d68a346276
SHA1 558860f1ad5dbaf1e95893614c41c65ee79d9991
SHA512 f445136023c84cf4af7b5a422a1fca33b1a4e2005710e4b1ab33ad2cd5a4d217632c0ca6bc91593169329889aeae45237a63dca92861d84540d547871d2d1454
SSDEEP 3072:t9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:/ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T178847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uomjeczxrp.exe

Path C:\Temp\uomjeczxrp.exe
Size 384KB
SHA256 b3d7a49ddb0059ecabdadbaab2ebf5ccbff96a8255806078fd0897bbc4d68c67
MD5 cfded36b96e484aac3a4c4be319e0512
SHA1 158b3ca2edbb9f7f545f252e888134e8e7a37220
SHA512 a9671143d6f24cb4d531f4d9198016fb23658311f79f0e01e7d5e6c5f8e447dfcd0e00eb2f4f5e7f92d9344893d3ab2ffc018824ca93422330a0eaf220940c5c
SSDEEP 3072:/9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:FctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T17C847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uspkicausn.exe

Path C:\Temp\uspkicausn.exe
Size 384KB
SHA256 143ff6788a8f51acd46767a22124bbfe6ca80fce7bc042e5199d8e0a36cef734
MD5 e24ca0dfe3cc7d93c43636fb6c93355f
SHA1 082ac8ead09f1a0784ebe10ebea01385578317fb
SHA512 ae879bffbcd14de294f82c8cfba5d4b0135a2db43f8ad0841348fc5182cc58549b86759e5c61814f49781479389a12c0d3c4a40447bc4702523a7d58584df915
SSDEEP 3072:sL9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9b:s5ctFtIJjiJcbI03GBc3ucY5DCSjXZ
TLSH
T155847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuomkecwur.sys

Path C:\Temp\wuomkecwur.sys
Size 293KB
SHA256 1d044fe9c35c4f3206b6b8395fbf878a006f47e76ef00cd13b9134417a38d0e1
MD5 c87ca187c2aefba76e476f1507c67b77
SHA1 a4350f429a1eb29d6ebc025165d1778a18d821e0
SHA512 75b736cfb66a8ca02a2870f4051545d7e6d997659aa3abd7a7893df9031c24755e9cf454770d6b6c9cd816a2a0288268337c7a9475617cf69af4016ab43e5cd3
SSDEEP 3072:MtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:MIJjiJcbI03GBc3ucY5DCSj
TLSH
T193545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkigdysq.exe

Path C:\Temp\ysqkigdysq.exe
Size 384KB
SHA256 251069f9e69d4054d60fe4f6ab943ad35248285b56c27d0c6caaf02f8569fc54
MD5 41d339971837a4225d919bc934204b0f
SHA1 d559b7653ed135da094fac20be031d7b791171d6
SHA512 8fe306c6a99c3bc9fa68b99e87c686d0b82961f5fb7aca36146adac83acbe11d74666f9f5d8b35cb03c3b870e29d22f1f0648690dbf6ca0825c3109254bd42ff
SSDEEP 3072:A9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:SctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T154847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a8007805e866030ddef8c0bffd6eec19b553c477bee180584b20c9c94621d55
MD5 f5400134b7975827b28654b3dcb1bdd6
SHA1 7e8ece0707d714e927405149f6d79c09a5c4d741
SHA512 1a774a2d3347b177b206cdb44ef3d8dfa5dc050dc320a393142991f46902ad3f68a035ce5a4ceb798b1663a69be306b2e14c094ed33e586d5db67c58a873f12f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T190B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 168dc438fa355b9b84e416f9d4caca14da218ad190d72da09fe489277625815d
MD5 39064a84dfec9bbd8c4b789b6d7a7c62
SHA1 5d817a4df5ed7bd1eac0c4bc0464a76007ad0c46
SHA512 3a4f32a1ad3eb6c391e6d11f4f6ba07c4d21cc935ddd8fd93306857b9e0cfda06c39786a872cae88f394320921a63296ad4df0e61334710db192febec2f48618
TLSH
T1B5D0C034763961C2C92725B2CC3163007320007030B587425171840C8E3489667CF3C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08a3eccff4cd9b05162ffe0d083662ea8cd60457899147f42dbbf95a0a97d97e
MD5 394c25b8b347a39d61b9cf28babb5c77
SHA1 c7334bcf8642ac580d30cf31659724fe1ab323c9
SHA512 8e5c09dada01bf020bbf53884d65940c521dc62e17d9ce99fe6c571edde4b95c7c7716f2eda97b70568b2cbac8823e7afed5a9bac7be39d1acc6fc95c23a4b1c
TLSH
T1F6D0C038762962C2C92725B2CC3063007330007030B587425071440C8E3489667CF3C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 98fabfcaf8198c28488fbe80612dab52b9181a6ae0868ee7f0f1de479dcc53f5
MD5 1f34c512c8eac64ad0d98e9dca59a2b5
SHA1 4c32f46e144b2909e4d04f0bd78b611c907770b4
SHA512 dec3cd1fa900f23d036a215249ea938551a806c6d6267896141861b28d8de2b01fd48f74bbf08ed0897e13aae3fb3ba22a1bda66fc1f8d59981ff268e3f07371
TLSH
T11651CB5D5B6CDDFDC722A9B664E050D93DFB8C7505875F1203FAE974490EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f497.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f497.TMP
Size 2KB
SHA256 8c3c629e4c18385bfa2b1acce706b5e65bd20bec6ee094ed6f9e83fd8b0e335a
MD5 e33b6147492b2c6ea015524aba267004
SHA1 6ecddc349e3a796df976023f1a060d191a95b626
SHA512 2c1e6d83f3155797f0ad509a304acedab29e9e8408651a8f30cfbe70414a453f27324d0c9953bbcf0300c6c3ab13c45c9735cfdaddcef8fd03d1cc7442c3c47a
TLSH
T15451CB5D5B6CDDFDC722A8B664E040D93DFF8C7905475F1202FAEA74490EFA82311211
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eca60cb13e951cf489c82dbc3b2ef954063a258150acf2fdde73218b44dd9359
MD5 bc47b5ce58a6dffa683505f0892da916
SHA1 cc2f4e3588592276e09f733f8ccffbe115420d3e
SHA512 83064569cb83cca9e87fb6465b212c293ea85f5d5d197789f16c91712b45cf1b6d5ad48b2bb7e815a7108cbbcb5d94140bc53f243a152bc23407a3d59ea87129
TLSH
T16E419EF3C3F4856E891196F0AB18AE2FCE1D0515432C7D5AC9E4AE2B93E3471E141A6F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 473f9a79169d7070a15808a37b45fc80c172dbc5f341d2680d79291aeb61e87d
MD5 76726cad672d944a46673ac72ced3c98
SHA1 63a762de9dccce7de13d3d63c256a40ec2aa4c82
SHA512 e788470ed95104fa3bc17611f63a6f139fad8622e2b8026cc49c81d43945f57c3780fc73e1ad633d290cf1dd6ee731e2c04fedf3179e4ba7b59f683f818f084b
SSDEEP 192:sxRyRr6yM/jK1Ml8wC9/f44sEA+ZMjH6zoA8pi/g6+WNIYZ7BqI6YoGVIgVbJ:sxRyVS89/f7sEA4YH3i/5IDYFf
TLSH
T17462C715AA64993B8CDBD20DFA45BF53D6F81463A1901E44AEFCCB1C04E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8517d93910e0d0324ac009466e51ad880d83c5fad6e0f8ffded7ac893d17e145
MD5 7011c67b08b44eb4f66683a267af4a33
SHA1 58c9f7316a97714b4cbc9e0db09bd77dc39e6335
SHA512 4f021571d07d37305289f9caddeb039eb9738333c4fd90b518edda0f5e7d21a84dd46e70c2d6f576bf12aaabd36ecbde317ea97fa2783e635b2841d845452b09
SSDEEP 192:sxRRRr6yM/jK1Ml8UQtC9/f44s+W+ZM7H6zoA8prU/g6+WNC53/YZ7e3QnYoGVIm:sxRRVaqM9/f7s+W4UH34/5w/0YF7
TLSH
T1C262C715A9649A778CDBD20DBA55BB93E3F81473A1901E44AEFCCB1C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c2cce666f929954ea718167ad130a33e42dde9924d218c5152db927e30ca0510
MD5 582ab9c7202c3e5014da27fbe11a1807
SHA1 c339201e9f76ce1a8481c3b82ae01b08eb8e8435
SHA512 9ccff275e13c1331a15287fdec8d374dc073f4f60b8dd5c75f8e2a5cf5323c2396da3f2e9365c17e350be3a14cf48976534fc5b3795cd54dd95a0072d7159579
SSDEEP 192:sxRRRr6yM/jK1Ml8wC9/f44s+W+ZM7H6zoA8prU/g6+WNC53/YZ7e3QnYoGVIgDv:sxRRVa89/f7s+W4UH34/5w/0YF7
TLSH
T15462C715A9649A7B8CDBD209BA55BB53D3F81473A1901E44AEFCCB1C00E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2d346416b6bab4631cdc628c3a5d7530671750d7a131b038e994acd8a9b1ec53
MD5 533d25f653dddd05ddb5cff034734b8f
SHA1 d4a8da4915ce0f7faf55b31e16d946f3fdb347a9
SHA512 c9ca75bf4b0e83700aa6494404d297efb1ebedc3b26117c8f0919e15b734ca2e0a18e0574e3c5405753d1cece3a2122c660e3ae0d755734b528afc7cd375b43d
SSDEEP 192:sxRRRr6yM/jK1Ml8wC9/f44s+A+ZM7H6zoA8p9V/g6+WNIYZ7PqI6YoGVIgDHbJ:sxRRVS89/f7s+A4UH3T/5IHYFJ
TLSH
T1C362B615AA64997B8CDBD209FA45BF93D7F81463A1901E44AEFC8B1C04E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 df4cbe7916824872e8f71ad157be084623447e6ad31eaaa64e44d55d382c3495
MD5 0a2ba680c121471119a977fa2df39bf3
SHA1 548063bf9c3a95b6df680affd74d17ad9d656222
SHA512 0c784d3a87f40e7ba146e42dd0af765a94d85ff193699f39812e8c27a12ab8d662d8a8f1b4abd1a684fb1cb93e0fc846774277b865fb266e6a6459d18ec5819c
SSDEEP 768:kfISlS7pLuL7CvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpRtSV2AlroHh04:kfISlqE7CvWgd5fWbu1jauRtU2BHh0PA
TLSH
T12EE2DC3B680CCB7F4F8049DCEC297E9AADA801CF96D8C99447EA850C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e500c4c73f8fec39dce8da298601025e2e8deae69b63ffc944f6c620cc1d753f
MD5 37500ef0e88150b7e2f7ae4b59c16e62
SHA1 d23752514991170bd79e347899eb9040f41e8525
SHA512 8ecc91e23167eb17afbe5f2c71cf1e215f277cda4411e57850258d1ac63076669aeffd593ea527df4f8c5c7fc8e822e2cab4fe157fd2fc2df28e11c4bf72c31f
SSDEEP 48:KcuI/KvK0jyJ8IjKN6cJ2j282P2z2N2h2d2gB2J2O2zIC272gKz2172F2g/2L2wx:KcuIKvKSq8AKN6G1+KeEyF
TLSH
T1979123C2757A42413CBE251985B6C65686A6F063306DF47FBBE900A60F66F010FFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c569f9bd-25f4-4fe4-a95e-c83c28358f83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c569f9bd-25f4-4fe4-a95e-c83c28358f83.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a73c9b501d75d9f1a4893461554af71b0e2c04a249b20e53da47a62eeee860cb
MD5 3d96e6e6af1bbffdbc30e9da543ed7ae
SHA1 958d003260428f3e1dbb259712be6b4882ada0d3
SHA512 d4a8ee535c0a4dd3d1149c72e7f1d0e139199a8573fc19c0800cfe8d39104f2d1bbfddb40f896b10afc5f92ddd93d8160544e9942149a61039a724a67613c292
SSDEEP 768:BK3Vj/BqsLHLKpAam6aQMGdjWca4Ghf997o:BK3IbmaME6p9s
TLSH
T1C5E29F305CA49C739CEBB295F71A6787BEF011B388D84D84D9E95B1D069329E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 b40aff61c66e0933015fe0715ffd50441610e4b1f989c960a139649e7eec4ae6
MD5 e17818e299f52fb202e60b9c2f7998cf
SHA1 9baa5c0826c033259c8f83f1d5b0b5bcbb5a1be4
SHA512 355eb5d550ee0a81b35e42c1899f11aca9c7b9591077cd3a61734487b0467ae57e9c7e7fcb57eb67dd916ae6a54f7638668a9d1bca8cda5b7911b8f02021569e
SSDEEP 768:/rv+4UNbdq3VGqsLwAAam6aQMGdjWca4GhfBPPeU/:/bsbc3TKmaME6pnH
TLSH
T118F2AE31A8689973DDB79A99F21B6787BFF021A384D40A80D9D92B0D43975CE3307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 dda6119d76e6648cf1f5bb80871ee1bd2fe2d8bfb1696d7120247137f2460f83
MD5 edcabc57b55e3c0e347e2039d4aaea55
SHA1 2e8ab343d262bdf283cbe2b0267f04a22e58d827
SHA512 dac0bca1c30db7627a8448be433c4ade42231bc09354dbdd1cf53a583be6d03d4279f20b7f459487cc47f76bca192ae2a625da016b0cfdebc0138ba8e1976da0
SSDEEP 768:yK3Ve/BqsLHLKpAam6aQMGdjWca4Ghf997o:yK3hbmaME6p9s
TLSH
T1C3E29E305CA4DC739CABB295F71A6787BEF011B388D84E84D9E95B1D069319E270BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c09defa84c4c032af94dd7f6e6800d7df9541df402cb822cd85e8ca8bafeb07a
MD5 fdbdad4dc0dafd19396dedcc02c11468
SHA1 a340d14427b01360b78b83931c4f209470b9f34b
SHA512 bc11022c4e139a8ed12398461b1206532964d0ce57948855eeb88b99f2125df8e7be58877875b02754cc5674c58df622e895cee19a6370594298959c1a08f278
SSDEEP 768:srv+4UNbdq3ccPqsLHLK0Aam6aQMGdjWca4Ghfw9PeU/:sbsbc3gWmaME6pGH
TLSH
T14DF2BF31A86CD9739DB7A295F25F6687BFB021B388C40E80D9D96B0D029758E370BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 26a9298673971bb87a4d2b3e33d07801a2b1f847b607f258ddabad659465fef6
MD5 a3970e96f6b683b9de1e889cfdb9fdfe
SHA1 0bbcac010e850737dd40196b19e5b67ae15481a7
SHA512 30a8a5500d4402670f7d52ca62a39450896f3f0e677459ffe849cb6fd9bf1a409c3e985ea501fff1c6ee03ce605964059c288493996c5bd1c05275cd70856e29
SSDEEP 768:SFQt3V5wgW/leLHLeAam6aQMGdjWca4Ghf997o:pt30maME6p9s
TLSH
T14B0318F198D78937D8AE5783A73D6E469ABCD163B4884884FBD45E0CCC921BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

ec9fd496-f7d4-4a34-9bef-f02486d4f733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ec9fd496-f7d4-4a34-9bef-f02486d4f733.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2924_1424830067\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 b5a11eebe8c76e2df724574873212ef52c6a2c1408b429d4b11c95ad575925fd
MD5 5ca2bf99388c18ea46385702eac77a0d
SHA1 bfb1dca71fc4095d8a351e18e43ac39192a8b8f7
SHA512 252326250cd901dd6db4bc64d0649959c6e3fa3b2b4500d5bd1d48d729859dc245396a555476e3cf8401af6f30b0e05aba2c1c9ef1988aff4cb03f32be4d38aa
TLSH
T1A771238356A9C5B2C5DE5FF102835244F2FB223847633020079655C6EB30A3A54F8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1648-273-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1984-414-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2016-418-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2280-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2532-449-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2644-245-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3068-324-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3364-66-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3840-339-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3916-438-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4152-374-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4216-504-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4344-353-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4416-320-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5072-194-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5128-298-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5452-475-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5500-285-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5540-500-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5848-394-0x0000000000010000-0x00000000000AB000-memory.dmp

Download