systex | 2b8af1df9f41ed58877e17227edcc624300ef8a5fe8776e86114d2c6129e937b

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260628-wv78psbs9v
SHA256 2b8af1df9f41ed58877e17227edcc624300ef8a5fe8776e86114d2c6129e937b
MD5 e80d4746cb9df9b8cebb318628275a52
SHA1 5b4611ca096e981b079e7885e711df996bb37a36
SHA512 6c094137c5fcb3802c6bacff2a81c540136c8ca3bffc3be62af08f6d0bc143bd6a731e1606e6c1be83862dda55ad261095be3d379ca861c4acf23bece7adb6f8
SSDEEP 3072:N9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:fctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T127847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
4192	ywrojhbztrljebwu.exe
560	ywrojhbztrljebwu.sys
3172	CreateProcess.exe
2380	ztrmjecztr.exe
5772	CreateProcess.exe
5108	CreateProcess.exe
3816	i_ztrmjecztr.exe
1336	jebwuomgey.sys
6140	CreateProcess.exe
1424	bvtrojgeyw.exe
948	CreateProcess.exe
2036	CreateProcess.exe
1340	i_bvtrojgeyw.exe
3956	ljdywtqljd.sys
2156	CreateProcess.exe
5684	vtqligdvto.exe
3840	CreateProcess.exe
1228	CreateProcess.exe
2668	i_vtqligdvto.exe
2792	sqlidbvtql.sys
976	CreateProcess.exe
5576	lavqnifays.exe
5440	CreateProcess.exe
5292	CreateProcess.exe
1836	i_lavqnifays.exe
4168	snifdxvtnl.sys
1932	CreateProcess.exe
4068	igaysqkica.exe
4896	CreateProcess.exe
1340	CreateProcess.exe
3832	i_igaysqkica.exe
3512	nkicausmkf.sys
680	CreateProcess.exe
5284	ifzxusmkfc.exe
4184	CreateProcess.exe
5288	CreateProcess.exe
4432	i_ifzxusmkfc.exe
5280	pnhfzxrpkh.sys
2780	CreateProcess.exe
1152	mkecwupmhf.exe
5680	CreateProcess.exe
2672	CreateProcess.exe
2332	i_mkecwupmhf.exe
1200	fcxupmhecz.sys
5356	CreateProcess.exe
592	urpjhbzurm.exe
3192	CreateProcess.exe
3812	CreateProcess.exe
2980	i_urpjhbzurm.exe
5448	trpjhbzurm.sys
2976	CreateProcess.exe
1724	rmjecwuomj.exe
6120	CreateProcess.exe
3380	CreateProcess.exe
2800	i_rmjecwuomj.exe
5060	geywrojgey.sys
2872	CreateProcess.exe
3816	ywtrljhbzt.exe
1832	CreateProcess.exe
5836	CreateProcess.exe
5736	i_ywtrljhbzt.exe
5352	qojgbytrlj.sys
5128	CreateProcess.exe
5808	rligaywtol.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igayvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igayvtnlfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_nlfdaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bztrlgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlfdaytnlf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wupmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tqojgbytql.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ifzxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bztrlgeywq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ztrmjecztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lavqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_igaysqkica.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_czxrpkhczu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bvtrojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_lavqnifays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rligaywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywrojhbztrljebwu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_mkecwupmhf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ywtrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bvtrojgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vtqligdvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rmjecwuomj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnifaxsp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wupmhecwup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bzwuomzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_bzwuomzwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ztrmjecztr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ifzxusmkfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_urpjhbzurm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ywtrljhbzt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rligaywtol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_vtqligdvto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_rmjecwuomj.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4468	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 19 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2836	ipconfig.exe
3324	ipconfig.exe
1056	ipconfig.exe
2612	ipconfig.exe
5832	ipconfig.exe
1704	ipconfig.exe
616	ipconfig.exe
2228	ipconfig.exe
1720	ipconfig.exe
3596	ipconfig.exe
1948	ipconfig.exe
5904	ipconfig.exe
1720	ipconfig.exe
3256	ipconfig.exe
1724	ipconfig.exe
3912	ipconfig.exe
3060	ipconfig.exe
716	ipconfig.exe
5236	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271441728071548"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{4C036E15-88BE-4D90-93DA-E66B77231F40}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
4192	ywrojhbztrljebwu.exe
4192	ywrojhbztrljebwu.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
4192	ywrojhbztrljebwu.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
4192	ywrojhbztrljebwu.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
4192	ywrojhbztrljebwu.exe
4192	ywrojhbztrljebwu.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
4192	ywrojhbztrljebwu.exe
4192	ywrojhbztrljebwu.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe

Suspicious behavior: LoadsDriver 19 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe
5960	msedge.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	3816	i_ztrmjecztr.exe
Token: SeDebugPrivilege	1340	i_bvtrojgeyw.exe
Token: SeDebugPrivilege	2668	i_vtqligdvto.exe
Token: SeDebugPrivilege	1836	i_lavqnifays.exe
Token: SeDebugPrivilege	3832	i_igaysqkica.exe
Token: SeDebugPrivilege	4432	i_ifzxusmkfc.exe
Token: SeDebugPrivilege	2332	i_mkecwupmhf.exe
Token: SeDebugPrivilege	2980	i_urpjhbzurm.exe
Token: SeDebugPrivilege	2800	i_rmjecwuomj.exe
Token: SeDebugPrivilege	5736	i_ywtrljhbzt.exe
Token: SeDebugPrivilege	5864	i_rligaywtol.exe
Token: SeDebugPrivilege	5992	i_igayvtnlfd.exe
Token: SeDebugPrivilege	5480	i_nlfdaytnlf.exe
Token: SeDebugPrivilege	5448	i_xvpnifaxsp.exe
Token: SeDebugPrivilege	5992	i_czxrpkhczu.exe
Token: SeDebugPrivilege	4724	i_wupmhecwup.exe
Token: SeDebugPrivilege	500	i_bzwuomzwuo.exe
Token: SeDebugPrivilege	2540	i_bztrlgeywq.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5668 wrote to memory of 4192	5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 5668 wrote to memory of 1436	5668	2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 1436 wrote to memory of 5960	1436	iexplore.exe	91
PID 5960 wrote to memory of 4728	5960	msedge.exe	92
PID 5960 wrote to memory of 5744	5960	msedge.exe	94
PID 5960 wrote to memory of 4468	5960	msedge.exe	95
PID 5960 wrote to memory of 5744	5960	msedge.exe	94
PID 5960 wrote to memory of 5744	5960	msedge.exe	94
PID 5960 wrote to memory of 1952	5960	msedge.exe	96
PID 5960 wrote to memory of 1952	5960	msedge.exe	96
PID 5960 wrote to memory of 2416	5960	msedge.exe	98
PID 5960 wrote to memory of 5300	5960	msedge.exe	97
PID 5960 wrote to memory of 2416	5960	msedge.exe	98
PID 5960 wrote to memory of 2416	5960	msedge.exe	98
PID 5960 wrote to memory of 5300	5960	msedge.exe	97
PID 5960 wrote to memory of 5300	5960	msedge.exe	97
PID 5960 wrote to memory of 2464	5960	msedge.exe	99
PID 5960 wrote to memory of 5316	5960	msedge.exe	100
PID 5960 wrote to memory of 2464	5960	msedge.exe	99
PID 5960 wrote to memory of 2464	5960	msedge.exe	99
PID 5960 wrote to memory of 5316	5960	msedge.exe	100
PID 5960 wrote to memory of 5316	5960	msedge.exe	100
PID 5960 wrote to memory of 1716	5960	msedge.exe	101
PID 5960 wrote to memory of 1716	5960	msedge.exe	101
PID 4192 wrote to memory of 3172	4192	ywrojhbztrljebwu.exe	105
PID 5960 wrote to memory of 1896	5960	msedge.exe	107
PID 5960 wrote to memory of 1896	5960	msedge.exe	107
PID 5960 wrote to memory of 2504	5960	msedge.exe	108
PID 5960 wrote to memory of 2504	5960	msedge.exe	108
PID 2380 wrote to memory of 5772	2380	ztrmjecztr.exe	110
PID 5960 wrote to memory of 2412	5960	msedge.exe	114
PID 5960 wrote to memory of 5952	5960	msedge.exe	117
PID 5960 wrote to memory of 5952	5960	msedge.exe	117
PID 5960 wrote to memory of 2720	5960	msedge.exe	118
PID 5960 wrote to memory of 2720	5960	msedge.exe	118
PID 4192 wrote to memory of 5108	4192	ywrojhbztrljebwu.exe	119
PID 4192 wrote to memory of 6140	4192	ywrojhbztrljebwu.exe	123
PID 1424 wrote to memory of 948	1424	bvtrojgeyw.exe	125
PID 4192 wrote to memory of 2036	4192	ywrojhbztrljebwu.exe	128
PID 4192 wrote to memory of 2156	4192	ywrojhbztrljebwu.exe	132
PID 5684 wrote to memory of 3840	5684	vtqligdvto.exe	134
PID 4192 wrote to memory of 1228	4192	ywrojhbztrljebwu.exe	137
PID 4192 wrote to memory of 976	4192	ywrojhbztrljebwu.exe	142
PID 5576 wrote to memory of 5440	5576	lavqnifays.exe	144
PID 4192 wrote to memory of 5292	4192	ywrojhbztrljebwu.exe	147
PID 5960 wrote to memory of 260	5960	msedge.exe	149
PID 5960 wrote to memory of 3408	5960	msedge.exe	150
PID 5960 wrote to memory of 1200	5960	msedge.exe	151
PID 4192 wrote to memory of 1932	4192	ywrojhbztrljebwu.exe	154
PID 4068 wrote to memory of 4896	4068	igaysqkica.exe	156
PID 4192 wrote to memory of 1340	4192	ywrojhbztrljebwu.exe	159
PID 4192 wrote to memory of 680	4192	ywrojhbztrljebwu.exe	163
PID 5284 wrote to memory of 4184	5284	ifzxusmkfc.exe	165
PID 4192 wrote to memory of 5288	4192	ywrojhbztrljebwu.exe	168
PID 4192 wrote to memory of 2780	4192	ywrojhbztrljebwu.exe	172
PID 1152 wrote to memory of 5680	1152	mkecwupmhf.exe	174
PID 4192 wrote to memory of 2672	4192	ywrojhbztrljebwu.exe	177
PID 4192 wrote to memory of 5356	4192	ywrojhbztrljebwu.exe	181
PID 592 wrote to memory of 3192	592	urpjhbzurm.exe	183
PID 5960 wrote to memory of 2136	5960	msedge.exe	186
PID 5960 wrote to memory of 2136	5960	msedge.exe	186
PID 4192 wrote to memory of 3812	4192	ywrojhbztrljebwu.exe	188
PID 4192 wrote to memory of 2976	4192	ywrojhbztrljebwu.exe	194
PID 1724 wrote to memory of 6120	1724	rmjecwuomj.exe	196

C:\Users\Admin\AppData\Local\Temp\2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_e80d4746cb9df9b8cebb318628275a52_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Temp\ywrojhbztrljebwu.exe
  C:\Temp\ywrojhbztrljebwu.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ztrmjecztr.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3172
  - - C:\Temp\ztrmjecztr.exe
      C:\Temp\ztrmjecztr.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2380
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5772
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ztrmjecztr.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5108
  - - C:\Temp\i_ztrmjecztr.exe
      C:\Temp\i_ztrmjecztr.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3816
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bvtrojgeyw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:6140
  - - C:\Temp\bvtrojgeyw.exe
      C:\Temp\bvtrojgeyw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1424
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:948
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3256
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bvtrojgeyw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2036
  - - C:\Temp\i_bvtrojgeyw.exe
      C:\Temp\i_bvtrojgeyw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\vtqligdvto.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Temp\vtqligdvto.exe
      C:\Temp\vtqligdvto.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5684
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3840
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_vtqligdvto.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1228
  - - C:\Temp\i_vtqligdvto.exe
      C:\Temp\i_vtqligdvto.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2668
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\lavqnifays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:976
  - - C:\Temp\lavqnifays.exe
      C:\Temp\lavqnifays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5576
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2612
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_lavqnifays.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5292
  - - C:\Temp\i_lavqnifays.exe
      C:\Temp\i_lavqnifays.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1836
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igaysqkica.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1932
  - - C:\Temp\igaysqkica.exe
      C:\Temp\igaysqkica.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4896
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3324
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igaysqkica.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:1340
  - - C:\Temp\i_igaysqkica.exe
      C:\Temp\i_igaysqkica.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ifzxusmkfc.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:680
  - - C:\Temp\ifzxusmkfc.exe
      C:\Temp\ifzxusmkfc.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4184
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3912
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ifzxusmkfc.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5288
  - - C:\Temp\i_ifzxusmkfc.exe
      C:\Temp\i_ifzxusmkfc.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4432
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\mkecwupmhf.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2780
  - - C:\Temp\mkecwupmhf.exe
      C:\Temp\mkecwupmhf.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:5680
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3060
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_mkecwupmhf.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:2672
  - - C:\Temp\i_mkecwupmhf.exe
      C:\Temp\i_mkecwupmhf.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2332
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\urpjhbzurm.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5356
  - - C:\Temp\urpjhbzurm.exe
      C:\Temp\urpjhbzurm.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3192
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_urpjhbzurm.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3812
  - - C:\Temp\i_urpjhbzurm.exe
      C:\Temp\i_urpjhbzurm.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rmjecwuomj.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2976
  - - C:\Temp\rmjecwuomj.exe
      C:\Temp\rmjecwuomj.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6120
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1056
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rmjecwuomj.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3380
  - - C:\Temp\i_rmjecwuomj.exe
      C:\Temp\i_rmjecwuomj.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2800
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ywtrljhbzt.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:2872
  - - C:\Temp\ywtrljhbzt.exe
      C:\Temp\ywtrljhbzt.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3816
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1832
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5832
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ywtrljhbzt.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5836
  - - C:\Temp\i_ywtrljhbzt.exe
      C:\Temp\i_ywtrljhbzt.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\rligaywtol.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5128
  - - C:\Temp\rligaywtol.exe
      C:\Temp\rligaywtol.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5808
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2412
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_rligaywtol.exe ups_ins
    3⤵
    PID:3372
  - - C:\Temp\i_rligaywtol.exe
      C:\Temp\i_rligaywtol.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5864
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\igayvtnlfd.exe ups_run
    3⤵
    PID:3636
  - - C:\Temp\igayvtnlfd.exe
      C:\Temp\igayvtnlfd.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2344
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3160
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_igayvtnlfd.exe ups_ins
    3⤵
    PID:2528
  - - C:\Temp\i_igayvtnlfd.exe
      C:\Temp\i_igayvtnlfd.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\nlfdaytnlf.exe ups_run
    3⤵
    PID:3400
  - - C:\Temp\nlfdaytnlf.exe
      C:\Temp\nlfdaytnlf.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1788
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2484
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:616
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_nlfdaytnlf.exe ups_ins
    3⤵
    PID:5796
  - - C:\Temp\i_nlfdaytnlf.exe
      C:\Temp\i_nlfdaytnlf.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5480
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnifaxsp.exe ups_run
    3⤵
    PID:2064
  - - C:\Temp\xvpnifaxsp.exe
      C:\Temp\xvpnifaxsp.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1232
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3596
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnifaxsp.exe ups_ins
    3⤵
    PID:4196
  - - C:\Temp\i_xvpnifaxsp.exe
      C:\Temp\i_xvpnifaxsp.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\czxrpkhczu.exe ups_run
    3⤵
    PID:5872
  - - C:\Temp\czxrpkhczu.exe
      C:\Temp\czxrpkhczu.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5264
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4592
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1948
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_czxrpkhczu.exe ups_ins
    3⤵
    PID:1748
  - - C:\Temp\i_czxrpkhczu.exe
      C:\Temp\i_czxrpkhczu.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5992
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wupmhecwup.exe ups_run
    3⤵
    PID:1172
  - - C:\Temp\wupmhecwup.exe
      C:\Temp\wupmhecwup.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4476
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:716
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wupmhecwup.exe ups_ins
    3⤵
    PID:200
  - - C:\Temp\i_wupmhecwup.exe
      C:\Temp\i_wupmhecwup.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4724
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bzwuomzwuo.exe ups_run
    3⤵
    PID:1704
  - - C:\Temp\bzwuomzwuo.exe
      C:\Temp\bzwuomzwuo.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2580
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5624
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5236
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bzwuomzwuo.exe ups_ins
    3⤵
    PID:5368
  - - C:\Temp\i_bzwuomzwuo.exe
      C:\Temp\i_bzwuomzwuo.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:500
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\bztrlgeywq.exe ups_run
    3⤵
    PID:5932
  - - C:\Temp\bztrlgeywq.exe
      C:\Temp\bztrlgeywq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2516
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4928
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5904
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_bztrlgeywq.exe ups_ins
    3⤵
    PID:2644
  - - C:\Temp\i_bztrlgeywq.exe
      C:\Temp\i_bztrlgeywq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tqojgbytql.exe ups_run
    3⤵
    PID:4744
  - - C:\Temp\tqojgbytql.exe
      C:\Temp\tqojgbytql.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:6104
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1720
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tqojgbytql.exe ups_ins
    3⤵
    PID:1880
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7fff181ec188,0x7fff181ec194,0x7fff181ec1a0
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1984,i,1975546735675410255,9575421680287991350,262144 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:2
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,9975057222599131274,9048395833400089086,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:11
      4⤵
      System Time Discovery
      PID:4468
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,9759197441213564508,15587436726292961458,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:13
      4⤵
      PID:1952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,12590035277813234376,2031272421760553367,2097152 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
      4⤵
      PID:5300
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,9084320725152376668,7775057786797815946,2097152 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,12669418508426033533,14400974004089689867,2097152 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      PID:2464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,14561844736306609286,9392108769055486961,2097152 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:9
      4⤵
      PID:5316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,15891275363120721464,2790883173158547653,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
      4⤵
      PID:1716
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,2430723646238362604,17844511201565240744,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
      4⤵
      PID:1896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4052998911722184705,7442811551377539695,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:2504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18119977187355657346,2767698458545164448,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:2888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,18119977187355657346,2767698458545164448,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,146359261712216795,15884144467392955822,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:5952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,16147930987828233013,3226327810709144301,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
      4⤵
      PID:2720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,16600105979593441401,6467395893120630985,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:14
      4⤵
      PID:260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,9906966669200681484,2115645400898254842,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=1252 /prefetch:14
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,11306337498653572616,4726357011131930714,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=1432 /prefetch:14
      4⤵
      PID:1200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,15656536436169249600,1085464143591800216,524288 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
      4⤵
      PID:2136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,3235498549410964867,7628311391286402625,262144 --field-trial-handle=2932,i,11183034331287522229,10785388414415818772,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:10
      4⤵
      PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4848

C:\Temp\ywrojhbztrljebwu.sys
C:\Temp\ywrojhbztrljebwu.sys
1⤵
- Executes dropped EXE
PID:560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4412

C:\Temp\jebwuomgey.sys
C:\Temp\jebwuomgey.sys
1⤵
- Executes dropped EXE
PID:1336

C:\Temp\ljdywtqljd.sys
C:\Temp\ljdywtqljd.sys
1⤵
- Executes dropped EXE
PID:3956

C:\Temp\sqlidbvtql.sys
C:\Temp\sqlidbvtql.sys
1⤵
- Executes dropped EXE
PID:2792

C:\Temp\snifdxvtnl.sys
C:\Temp\snifdxvtnl.sys
1⤵
- Executes dropped EXE
PID:4168

C:\Temp\nkicausmkf.sys
C:\Temp\nkicausmkf.sys
1⤵
- Executes dropped EXE
PID:3512

C:\Temp\pnhfzxrpkh.sys
C:\Temp\pnhfzxrpkh.sys
1⤵
- Executes dropped EXE
PID:5280

C:\Temp\fcxupmhecz.sys
C:\Temp\fcxupmhecz.sys
1⤵
- Executes dropped EXE
PID:1200

C:\Temp\trpjhbzurm.sys
C:\Temp\trpjhbzurm.sys
1⤵
- Executes dropped EXE
PID:5448

C:\Temp\geywrojgey.sys
C:\Temp\geywrojgey.sys
1⤵
- Executes dropped EXE
PID:5060

C:\Temp\qojgbytrlj.sys
C:\Temp\qojgbytrlj.sys
1⤵
- Executes dropped EXE
PID:5352

C:\Temp\qligaywqol.sys
C:\Temp\qligaywqol.sys
1⤵
PID:2480

C:\Temp\qnifdxvqni.sys
C:\Temp\qnifdxvqni.sys
1⤵
PID:1880

C:\Temp\dxvpnhfaxs.sys
C:\Temp\dxvpnhfaxs.sys
1⤵
PID:5692

C:\Temp\icauspkhcz.sys
C:\Temp\icauspkhcz.sys
1⤵
PID:5056

C:\Temp\fzxrpjhfzx.sys
C:\Temp\fzxrpjhfzx.sys
1⤵
PID:2044

C:\Temp\mkecwurmjh.sys
C:\Temp\mkecwurmjh.sys
1⤵
PID:3332

C:\Temp\cwtoljhbzt.sys
C:\Temp\cwtoljhbzt.sys
1⤵
PID:5380

C:\Temp\wqoigeywqo.sys
C:\Temp\wqoigeywqo.sys
1⤵
PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bvtrojgeyw.exe

Path C:\Temp\bvtrojgeyw.exe
Size 384KB
SHA256 d66c56195b7eb9d7e32c65deb0a204de8bb17e451d1faa577ad2f897ecc6ef07
MD5 6ee6a62123ce78308d97dc3b5e060923
SHA1 bf57a5e86292886a07df368609c885e363ba7343
SHA512 19d6af061924bb0d8db1907dbe6cd1cf600b424c18af12adc93eae1786148a3a1c02ab76d9c05dfe4ba817f8047c860ca7f495f7e0fa75da5f53b74dfcc08843
SSDEEP 3072:H9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:dctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T152847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_bvtrojgeyw.exe

Path C:\Temp\i_bvtrojgeyw.exe
Size 384KB
SHA256 496b2fd9778790c828106f2231434f08d19b2a0e8fa0f0aecfb22dc0fd7f7bfb
MD5 6dc51407d77e551496e0520e86094cf3
SHA1 bec9e35c25cea412385de12d547c01b050e2fb7a
SHA512 dc9c38c6ec425504f4c0508076e270dadd1a45b7b07a7d0699f68658874787d46b141a563a37384939d26e43b9838b93eb3b84d9fd47b11e1d43d204d18c3109
SSDEEP 3072:49ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:6ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T133847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_igaysqkica.exe

Path C:\Temp\i_igaysqkica.exe
Size 384KB
SHA256 dbea6ccb5cf0c46287392335a9b98e110bd63deec2e7a85c848e93b8d7f1458e
MD5 b0e6e78fdb48372dab378b1c08e15dae
SHA1 90e331daaeebde04e00cda47ab9f371df5e8595e
SHA512 d4effb7d904b6959e67ce02fa6ab89a1a746669f0e366fe0051d15f73fbc9879948b59580544099844a3f560167e19df96dbb35f5a80ccec2ddc8ae8b178d6d8
SSDEEP 3072:f9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:lctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T11E847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_lavqnifays.exe

Path C:\Temp\i_lavqnifays.exe
Size 384KB
SHA256 3cf0194cdf87c47ff32607bcf8474c6dc1e537461e33923cf2889844c0937e11
MD5 0e186c66de2ccaf91fe60e89ae520130
SHA1 f9495ac0fde82ad5893cd3bf5c6dca1b69dff4d0
SHA512 c240fb803e5fc7d75f974b7da5a55e219a4f850e3badfb2e557807cb42e558034a51c8f98f3893427b66ff32f636cfc847c674b2d56776aa3d0b0352fb5bfa86
SSDEEP 3072:Y9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:actFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T12A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_vtqligdvto.exe

Path C:\Temp\i_vtqligdvto.exe
Size 384KB
SHA256 7b9a88968a79140a4849ba5642988a804f7bab40004e0b85eb35ef959f4dc1c4
MD5 489e34390741cfeac7e3c90dc8e21fdd
SHA1 61e0945b2a21eaf8b8a6e1731394eeb2bf03f663
SHA512 c89f51107cee2e47751cbdfec5f8fbfddfecc82b44dee28286e59ad1430e295e2d6afc0f2920a8fc8175dfdf2b4cf12efccee9044edfc250356ba12817b951d1
SSDEEP 3072:r9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:ZctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T176847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ztrmjecztr.exe

Path C:\Temp\i_ztrmjecztr.exe
Size 384KB
SHA256 54951616c4f04b7d7c820968feaa7cb011fc67ca4b102e7f4787a82621ad7673
MD5 32c8824e94d869f5a709dbdb3a6d88de
SHA1 c0e9fac5511af52b31c5ceca8c799831e659f0db
SHA512 41cb723cbf50d8a6cd8f07d1f7eca8a3e6dc575279c06ed5dc2ff1fd468f364c6948a66cb05264c97372ce063762b953e1f6eca5baa3406e809dc505e090f3f2
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A0847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ifzxusmkfc.exe

Path C:\Temp\ifzxusmkfc.exe
Size 384KB
SHA256 b78ae18218b543faedb0b6c172c01edc4c1f2a101f7939853ca1acc4d1065db4
MD5 e72951fd9fe89a933da6626c6b585243
SHA1 6372ed76cfc6e4d7c19f23c5a315693661c5aad4
SHA512 0ffaa1b597c7757c412d8966620e79c6207e96d4d3458ec3dad940b6327484c9ceeb84113759ffedc4dca4aab8497a9e0909c567ab75796902cd2de85fecc27f
SSDEEP 3072:K9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:wctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D4846B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkica.exe

Path C:\Temp\igaysqkica.exe
Size 384KB
SHA256 21a48a8fef4e8af85bc2760fd903e4a85688f8ad9f0335022c11837fc050a94d
MD5 feecfaa01c88f2c09d7115c2e028334f
SHA1 28332ecdf6080d48e9a41616c859cd6d9712a4d6
SHA512 a428992d42223bc71acabc478c3f4044fedeca3a90ecffa42aca08e28edac7c2ff4755e2f231c849282842f5d631518c0ecccec4dd5e6538d1c6d2c0cf9f0a4d
SSDEEP 3072:Z9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:zctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T132847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jebwuomgey.sys

Path C:\Temp\jebwuomgey.sys
Size 293KB
SHA256 f0458b5e39043497f1b4e7c07aa057957fe357ee63d685d653582f8323e66ba8
MD5 0058affc0a2146d17a12a7350cfc2b01
SHA1 b1506927aa08d19b719fec72015e6d32b9ec0bfc
SHA512 1da3c49cd13de1e141aca7c8950a8c42843767fa33d4f5864924858eb63ab7be9cb1ee3c1677cf61e13038ca7f918b1cc236fa02c44e833214e0f4c66c9ee2d7
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1EE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lavqnifays.exe

Path C:\Temp\lavqnifays.exe
Size 384KB
SHA256 5648f68d7e1029bc8a6ff8ce1c06b536706e7df572fb8a1c769dba0d8427b3c6
MD5 92230e63c3689213be8c72b33b882164
SHA1 7de7893f88e38e4c6d53795ff9212ef35de1124d
SHA512 fa20a071b0c95dce3b03e246ecd350cc90768135f3eec4878969f38a5fdb1b1ee28aa058936ec1ffaca6f708e61a94a409685a01f1ec7d80d7c89703e71bbad1
SSDEEP 3072:+9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:cctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T131847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ljdywtqljd.sys

Path C:\Temp\ljdywtqljd.sys
Size 293KB
SHA256 d04b92d7b6ff1f1064e4f5d4eeaea128002591eaefbf76f35bf8c764c43a6a93
MD5 98c95dc2717c0f82ac421e7fe09bf05b
SHA1 2af5915df3c540918ebce7b79cea3579ca331c65
SHA512 01050a41aa946a818f8aa179a74a5d665efba7d22cd35521f44c0a97e6bf43c5a5ada25cbab08b573b7d5913d8e9d0dad76a101d6e0c362f9698570e03565360
SSDEEP 3072:ItKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:IIJjiJcbI03GBc3ucY5DCSj
TLSH
T192545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nkicausmkf.sys

Path C:\Temp\nkicausmkf.sys
Size 293KB
SHA256 e47d166f698323428d41676d1d425101fa190f6b64d35ddf0b71d662340b4277
MD5 7b16c6e5e626a598e1b69ee4a46fb5ed
SHA1 14c42a3c983e37f38c3555cb21e03267af6416d7
SHA512 7452fb2b87d7456e006198ef602b3804415780c8d0cb4f4ca39a855b1cbf81ecf272224f344f5bf1b7d3c5fe9ad6ff4de52758acbd229937ea249ec518301bbf
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T101545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snifdxvtnl.sys

Path C:\Temp\snifdxvtnl.sys
Size 293KB
SHA256 2ed643e66cc6172fbe772808b8e438f15d507c613f1775f9e0d4e3801abf3114
MD5 18bddc22106699f9cf78dd730f721615
SHA1 9f7e1b3f8e65024c318221e3cd2ea5021c3362c0
SHA512 278697ec2e98d5d1440d05b5ec4ff09567d18e67a39f78fbab3507bc616ca1bfaca2e81f1dabad3b9878d541ad4d2cedb533d39857c5a20d3f3be99788c03df8
SSDEEP 3072:itKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:iIJjiJcbI03GBc3ucY5DCSj
TLSH
T12F545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlidbvtql.sys

Path C:\Temp\sqlidbvtql.sys
Size 293KB
SHA256 67ca402d63c1a714342766ec9248ed3e3baf3be9851ec1dcaad0e55716cc5014
MD5 b8b2e3c96cbe89c00f1051ccc4026fe5
SHA1 b906c11faf7dd67375a00ac479df5e4bfeffcd07
SHA512 8bc987c9c6045b952752c90d47b5a00c7d1079e39a263379d126691912aeba3b50b44e6e6b0b853cbde5320c59f114cdfa1f78f10fcd96d13a6cd27d3bf9103c
SSDEEP 3072:+tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:+IJjiJcbI03GBc3ucY5DCSj
TLSH
T123545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vtqligdvto.exe

Path C:\Temp\vtqligdvto.exe
Size 384KB
SHA256 5de7858aecb922b8f737782a42b798970b3c294f6ea4adb764b137288b8a39b6
MD5 06abd20f3534b58525081bf73d260e7d
SHA1 7748419bb98b72c79a3bcd01e3be45e49a2cd890
SHA512 5d02a5a85b351057727f7a9ca0c47116158fce5e46eaf391b17937a79fec113486d6c2a998b6e34bd7541f2c92708a240edd62769dbb34acc666b940cb778dc0
SSDEEP 3072:P9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:VctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BD847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztrljebwu.exe

Path C:\Temp\ywrojhbztrljebwu.exe
Size 384KB
SHA256 734d2cd716d9e868df1799e9b25a35006ba1cd7edd851cb7fc833fe28ec46df4
MD5 99b5411e96e9747437f9711b115d0246
SHA1 8df7517d521dd29801b96aa648f42874eed5bd2b
SHA512 239994c8b6776dd684395522a2936b645fde1fdb4728f1491f53c70324f43c17bda9417bf27b66149e133f5aab36924ced186cf5cc9945e499e31f537bf00439
SSDEEP 3072:89ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:GctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18A847B00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ywrojhbztrljebwu.sys

Path C:\Temp\ywrojhbztrljebwu.sys
Size 293KB
SHA256 253e0730d36d34c2fbe4cd24656cc1f657180230aabbda7a7a1b057bbf3e166d
MD5 b6c3de8bb354dfb453b15f5e3b81e675
SHA1 d33ffa9b4b6cf8354730d69f0376c86a3986401c
SHA512 7bb1f6b484ca30048ba788e99e15224429c98fbdf0e80ac5e218025d2b9f77fef0e753b48527cdc313a8249253e894e1e3289da56105559da1a5bf9505b6e7f2
SSDEEP 3072:AtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:AIJjiJcbI03GBc3ucY5DCSj
TLSH
T1FE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ztrmjecztr.exe

Path C:\Temp\ztrmjecztr.exe
Size 384KB
SHA256 d7a3c1606f999f93072a1dc27514a90f2fcd4b500ee1f0b3b6af3a2bddac5f6e
MD5 02baf281e57518f3fbafa0bce8f93b08
SHA1 6ecdefce80078d077140cc6ec777fe7c9f26bf33
SHA512 b61f3759536d3ea03b681a195df0289815d050eec933b25181653ca6f152519aab6fd22e93805bda82499bcd4bd05214e0533435c8fb6d7648c3a677a0dd5819
SSDEEP 3072:s9ctuJAaM/4yjtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pq:2ctFtIJjiJcbI03GBc3ucY5DCSjX
TLSH
T117847A00BAA4F0F6C995047800DFAF36A67EB4281726CBC3E754CE5D9A513C3A93579B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4d532e4474c0870bfe59edea645ea9ed8f72b0a360982ad8dc3d13d784bbc4bd
MD5 4a0f5d0626a118439f725b41a220b411
SHA1 f116ce489a85d5ce2e89a6a17831423e3964c997
SHA512 d09ff677285ed9390503a0e8a814dec5ef64a6a923da104640aca6e7443d2307fea70ea58f080b3012adc6c3d760398a8e5facbd9395e494e511567072f65bcf
TLSH
T16061955547A23661EBA780BC52F152C9F3B8C8C737472EAD0C8C7474E906F1860EB4D2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599040.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599040.TMP
Size 3KB
SHA256 66fec2df53c1fbfb1844f9a36e00566136128c99261d183e9f2a84fcc1291cb0
MD5 0af5d86a1fbf2e74f37ac02bf4084a01
SHA1 b654da7f5408ea4ca50fdcdf6bf1a2656dd817df
SHA512 ca910bb797827ece63b5b918ededa4aad6885b866498bac65041e7fd73f59b512fe7cb6d13334503c67ff45333801bfdc237cde9d28be4849051a8020b767f70
TLSH
T10F61941547A236A1EBA784BC52F152C9F3B8C8C737472EAD0C8C6474EA06F1864EB4D2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6aa4436d8e4e46d0dd2b9b613c3d7d998e4162dc292026a69f5f8af32f01fae1
MD5 96f0866d6041ca723be34eaab754fcd5
SHA1 f57836813fe6ea9e1c22c1eeaf8c1e2afb32fd75
SHA512 8a13987da6006158dd9f9f5543dfdb9fa81e81506128feb9e25c95989ea906e6612929ab9977a2f72a1edc13fe9eebc3a0ef2bf3832434106d25af2a93d502b2
TLSH
T128518CF7C2E8856DC91156F0BA146E2BCE1D0915832C3D5A89E4EF1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 51c66722d29273184c298857ffcf56e3e99c9747dc95a5363c9b8025da3bc273
MD5 4792af4e0d30a191f744fe24ba6576b1
SHA1 36f03a819f3ec8e2aa905c682eadb32874efa9ca
SHA512 1df02cb06b99e59da3b49189370559cb3b63b74e4b3b47aa4b5237506d69e7cb84975497fdb442c2cf25e2206bc19b0096083842074fb9e00e5463dc8e84003b
SSDEEP 192:sxRtRAyM/jK1Ml8wcI/fhsqay0ZxA3HVzoA8p9a/g6+WNCm//YZDx6GSIgVNJ:sxRtiCI/fhsHyKxv0/5v/B1
TLSH
T13662E9156A389977CCDBD209FA527F53D6F85433E2900E44AAFCDA0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b84205486f5ce4620fed3912f22f04c4cfacf8f88c3c914090376334689aacc2
MD5 aa94006bff33af5beb6f4a404f6b9149
SHA1 4518635773012c23751e55b5cce6cd8e7b146d67
SHA512 c7dfe6c275bad94b6e2bfa9db75e4fa0afd6bd4afebfa7c421430ca5231776078d34a0be000c96fb73dffae2519182b1b079bcab6c42258549af138b17ecbc9c
SSDEEP 192:sxR2RAyM/jK1Ml8wcI/fhsqay0ZxA3HVzoA8p9a/g6+WNCm//YZDx6GSIgDhNJ:sxR2iCI/fhsHyKxv0/5v/B1
TLSH
T1D762D9156A385977CCDBD209FA527F53D6F85463A2900E44AAFCDA0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6d63750ef006de12b88ef089f5f1724679b425e3f72651c1a01a21828fd6f209
MD5 754cf9a1a9a8a257aa4267f142bfc1d5
SHA1 6e1f0c504d93f54c08b95ea1d81bd2e40f4e60b0
SHA512 3f40f70ab408c528098ceb737b6f35fcb6c938e0e3aa4ce8ffd7226a579b512dfcb70247eeaa7493bb5e9c9296ff466726c321170c69ab6ae69cdb03eddf960f
SSDEEP 192:sxR2RAyM/jK1Ml8UQWcI/fhsqaN0ZxA3HVzoA8pra/g6+WNCm//YZ+x6GSIgDLHK:sxR2iqVI/fhsHNKxvu/5v/wPK
TLSH
T16462C8156A389977DCDBD209FA527F53D6F45463A2910E44AAFCCA0C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 609291f85a72c499c282552c762f3b4be22650542ffde603c054e9fca02e9e7b
MD5 b11a7178008096c854d8f59559c3460b
SHA1 675d545ba0179069bd439cb6f7aa3b7958a3f67f
SHA512 b1877f55c03537b3ec9f288f2ab54ab7d48972cb1fe29398caf780230339e75d9f8863e4880764d06f19ab061936a86b60a7dddcad6a399333130a3c84813d94
SSDEEP 768:eOEtpf7pLuL7ZIWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OVPvREkTqQ3ro7ob:eOEtpZE7ZIWgKgf16u1ja0v2/Qk884r
TLSH
T1F9E2EB3B680CCB7E4F404A9CED2A7E9E6DE801CB96D8C99447EA840C03C67EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fa4eee00ea7adfee7b04a2ae8b78ea033b279161a93d9c5955a5a74e9e6864f2
MD5 af24f61265542ffe945be7093e4c09eb
SHA1 b0d64b8a76ed8e0cf55cb7c8d5dce15ce946c58a
SHA512 9f8952c328774d7e9f2bdce000eaccf0d6b9e1f5668d606537c98540488d0eec3169f668d79f8ec62173cc2358b4bed827db6636f06365e958f793e1e710fdf8
SSDEEP 24:KciNq4wIhKGhg1SS/wdyXfIrQMiIRKYhs1CSVWg6tiQoIBKmhA16S3olyXV+JV:KAzIhKwgkbyVNIRKOscm7IBKQAkzya
TLSH
T12691424079BB22013D7D29499260A91E029170E636AAB47B3BB814E19F67E016FFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2caf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2caf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3e463911e07fd89cf8fcca4ceb01be2c365c395de64b22d753beb3783251de45
MD5 7d6c99c92c926a7f4980d896a2e628cb
SHA1 622c583f26ef6557ee626e15832e07f850e61b06
SHA512 18b79031b803d40fc184f99c11da3fa662a382a2974735b048f3f0a238e6d3854eada6861c837109c4ec75e7c3666b663f7596e220e0dd3b89cc032e7d32b8cd
SSDEEP 768:EjaeqD4MlshiLdMma3EXPfcOIfNRV5R4HTytYYqgHvPg1yjWtxjTo:EqcjhIdMh3cfMfLWTwJgyj2y
TLSH
T12B03CF7AECB85CA79CA29684770677936FB44263C3C22B64C9DC5B0D069B6DF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 7964f86b91dd2306b232ecb35531842aa9707f9a5f9130554bdaa85896d4a2e9
MD5 58d7be61c780298aa4fc08b390c81680
SHA1 74d77d7e9e648f6ad2e024b1a2afa69d0b5b0061
SHA512 8ad45d1d52366e835bea4e8da81b74c303112532cda1fd4ce46b4670e9ffc29d32ff32928169118e9c9a7a24152b8d12aebe1dd386ca81ee6426c8701e25b7c7
SSDEEP 768:4F1j+933LwgXM4KfcOIfNcfNXV5R4HTytYYqgHvPwTzn12bfZZ/:19330fMfaftWTwJCByZZ/
TLSH
T1E11318F698E78977E89E8787633D2E46AABCC163B2845990B7D44D0CCC875BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6dd141bfd196aa09e8d59e49e02f5816dc175f623d87100fbde21a6732643f78
MD5 70db041604539545f1c39d66f8f09c47
SHA1 f825c263c956db9ab9e668a8822c1b63d95439a4
SHA512 4d6eab10b661083bd521cdaa9882d78b7f05cf5a9defe3bc585836d0ab3f79335bc8928c622d9f43b80559cac2e73003342050097da37654aa6a26dfff772f99
SSDEEP 768:Ej+9m3D7MPfcOIfNcfNoV5R4HTytYYqgHvPwTzn12bfZZ/:T9m3IfMfafsWTwJCByZZ/
TLSH
T1A9F2AF71ECB98D675CD2D68872163797BFE8517792C40B64C6D88F0D0987ACE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 e2f9e58aa85437d7dd5b1e4321d0a0501ac144c46edc086ef634ddf30f077aa7
MD5 eb525a919a8de0fe89089d705521caf2
SHA1 e4b8fc725881dfb5ace47585d5cce14895e07d36
SHA512 143feaaaa86a4631db14761b0e286bb246a5d1018300482c6874bb8920c970d40cb0b3209bc8f862736436e11f764d2beed64552a8eb77b1c7cfdde8c585ecda
SSDEEP 768:CjaeqD4MlshiLdMms3Q9MPfcOIfNcfN/V5R4HTytYYqgHvPwTyjWtxUTL:CqcjhIdMv3nfMfafVWTwJCyj22
TLSH
T1AF13BEB6ECB89CA75CA2E684721677D3BEB40167C7C51F64DAD84A0D05876CF130B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 ebb046cd24bb7f7f871eaf2f8fc21c4203d8899cbf99a49b90be0339b66dbc99
MD5 a9ab31f32b21ae38cad5eea485839368
SHA1 b022e9466cbdbb4d7703fadd96f7e71369e9bc5d
SHA512 60f3d5283733e57e06dfcd1d4644bac90a4d3b15548d097ec1bd5590aa2a8ef79345b8a05d4343a3b19b3192ff6044f2ac2d93c2e927c824982413d9784556a3
SSDEEP 768:1jaeqD4MlshiLdMms3r7MPfcOIfNcfNoV5R4HTytYYqgHvPwTyjWtxUTL:1qcjhIdMv3gfMfafsWTwJCyj22
TLSH
T10A13BFB6ECB89CA75CA2E684721777D3AFB44167C3C51B64DAD84B0D05876CF130A81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46e129a4-1a98-4017-b8ed-abb5d9f9ccdd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46e129a4-1a98-4017-b8ed-abb5d9f9ccdd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5960_455887921\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 e3c12f4fd12f04376b0c2a07b48a838328e05915777ad2915255906df17db3d1
MD5 ca836420e9c1aed5e0fe83558b16a88f
SHA1 44964ebdf9db41e8eb1907717fc85a5f539b2b4c
SHA512 8126fccceee4808c98c05c03ff44a052676969f377b434885dacc0f2f7aa5eb78acfc857bbbe5277a2cf76aff8c30bc990dbb393c4a782a81cd9f133b2244053
TLSH
T1F671238357B8C6B3C1DE5FF102835608F6FB22384B2330304BA15546AB30B3A28B8F08
MD5 SHA1 SHA512 TLSH

Submit Download

memory/560-64-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1200-343-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1336-189-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1880-412-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2044-424-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2480-399-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2792-304-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2792-267-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3332-429-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3512-318-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3956-237-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4168-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5056-420-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5060-383-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5280-331-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5352-387-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5380-441-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5448-358-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5692-416-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5828-445-0x0000000000010000-0x00000000000AB000-memory.dmp

Download