systex | bacbf69b9b45b957f0324d837f0f36da400d305747c25d28de1004ce9b2e0e91

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
Size 384KB
Sample260701-db5pcsey7v
SHA256 bacbf69b9b45b957f0324d837f0f36da400d305747c25d28de1004ce9b2e0e91
MD5 c82b3d192b50c7a8b3484b8e7a9453c3
SHA1 690de38d7c479d98089d4851cb3a8f400c9c8852
SHA512 44074b13bdffc2ec86da20b6a6a0c5eea0ddf6d2428b337dcea6a540fd9a08612d56ea49d458511408fe9d7e5db17073c8547f3b123687bac9f845cf823ae2aa
SSDEEP 3072:hItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:hItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D8848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery systex spyware trojan

Malware Config

Signatures

Family: Systex
Systex is a trojan loader written in C++.
trojan systex

Executes dropped EXE 64 IoCs

pid	Process
3340	tnlgdywqoifdbytq.exe
2664	tnlgdywqoifdbytq.sys
1104	CreateProcess.exe
5004	dbvtnlfdyv.exe
588	CreateProcess.exe
4788	CreateProcess.exe
4068	i_dbvtnlfdyv.exe
2860	igaysqkida.sys
3080	CreateProcess.exe
5144	ysqkicayvq.exe
2456	CreateProcess.exe
3400	CreateProcess.exe
5764	i_ysqkicayvq.exe
2384	faxvpnlfda.sys
5556	CreateProcess.exe
984	icaxspnhfd.exe
1312	CreateProcess.exe
4728	CreateProcess.exe
5580	i_icaxspnhfd.exe
1080	smkfcxvpnh.sys
5304	CreateProcess.exe
5284	upnhfcxupn.exe
3908	CreateProcess.exe
5820	CreateProcess.exe
5232	i_upnhfcxupn.exe
2020	zxrpnhezwu.sys
684	CreateProcess.exe
3252	zxupmheczx.exe
2616	CreateProcess.exe
704	CreateProcess.exe
1404	i_zxupmheczx.exe
1140	kebzxuomke.sys
5764	CreateProcess.exe
2132	ezwurmgezw.exe
6048	CreateProcess.exe
616	CreateProcess.exe
1052	i_ezwurmgezw.exe
4424	urmjecwuom.sys
4808	CreateProcess.exe
5300	wtrmjecwuo.exe
1892	CreateProcess.exe
4900	CreateProcess.exe
5540	i_wtrmjecwuo.exe
2112	gbztrljebw.sys
3228	CreateProcess.exe
1920	ebztrojgby.exe
860	CreateProcess.exe
3680	CreateProcess.exe
1804	i_ebztrojgby.exe
5536	wqolgdbztq.sys
5596	CreateProcess.exe
3376	qoigdytqoi.exe
4264	CreateProcess.exe
920	CreateProcess.exe
5600	i_qoigdytqoi.exe
3660	yvqoigaysq.sys
780	CreateProcess.exe
3020	qnigayvtnl.exe
3420	CreateProcess.exe
4428	CreateProcess.exe
2160	i_qnigayvtnl.exe
3344	vsnlfdavsq.sys
1992	CreateProcess.exe
4272	xvpnlfdays.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1317656060\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1413126134\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1112660684\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1317656060\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1317656060\kp_pinslist.pb	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1413126134\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1112660684\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4704_1317656060\ct_config.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 43 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qnigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_yvqoigdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ezwurmgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wtrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qoigdytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxusmjhfcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxusmjhfcw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pjhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ysqkicayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yvqoigdxvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xvpnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_xvpnlfdays.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tolgeywqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icaxspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_icaxspnhfd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_smkfcxupnh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_pjhezwrpjh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebwtomgeyw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dbytqljdbv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dxvsqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CreateProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ysqkicayvq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_ebztrojgby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_qnigayvtnl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_dxvsqnifay.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upnhfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_upnhfcxupn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zxupmheczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_zxupmheczx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_wtrmjecwuo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tnlgdywqoifdbytq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbvtnlfdyv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qoigdytqoi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	i_fdxvpnhfzx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ezwurmgezw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ebztrojgby.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5448	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 20 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1440	ipconfig.exe
4956	ipconfig.exe
5116	ipconfig.exe
5032	ipconfig.exe
2520	ipconfig.exe
3412	ipconfig.exe
1228	ipconfig.exe
1660	ipconfig.exe
2980	ipconfig.exe
2532	ipconfig.exe
4396	ipconfig.exe
5116	ipconfig.exe
5964	ipconfig.exe
1448	ipconfig.exe
2852	ipconfig.exe
1768	ipconfig.exe
4080	ipconfig.exe
2964	ipconfig.exe
1308	ipconfig.exe
2604	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2900715619-172032027-1873877232-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273478721875841"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{77104F16-6D86-4058-BD04-0270D4514F2E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe
3340	tnlgdywqoifdbytq.exe

Suspicious behavior: LoadsDriver 21 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeDebugPrivilege	4068	i_dbvtnlfdyv.exe
Token: SeDebugPrivilege	5764	i_ysqkicayvq.exe
Token: SeDebugPrivilege	5580	i_icaxspnhfd.exe
Token: SeDebugPrivilege	5232	i_upnhfcxupn.exe
Token: SeDebugPrivilege	1404	i_zxupmheczx.exe
Token: SeDebugPrivilege	1052	i_ezwurmgezw.exe
Token: SeDebugPrivilege	5540	i_wtrmjecwuo.exe
Token: SeDebugPrivilege	1804	i_ebztrojgby.exe
Token: SeDebugPrivilege	5600	i_qoigdytqoi.exe
Token: SeDebugPrivilege	2160	i_qnigayvtnl.exe
Token: SeDebugPrivilege	5704	i_xvpnlfdays.exe
Token: SeDebugPrivilege	2372	i_fdxvpnhfzx.exe
Token: SeDebugPrivilege	5204	i_smkfcxupnh.exe
Token: SeDebugPrivilege	2116	i_zxusmjhfcw.exe
Token: SeDebugPrivilege	4696	i_pjhezwrpjh.exe
Token: SeDebugPrivilege	4620	i_ebwtomgeyw.exe
Token: SeDebugPrivilege	796	i_tolgeywqoi.exe
Token: SeDebugPrivilege	5984	i_dbytqljdbv.exe
Token: SeDebugPrivilege	5372	i_yvqoigdxvq.exe
Token: SeDebugPrivilege	2372	i_dxvsqnifay.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 3340	2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe	89
PID 2088 wrote to memory of 2164	2088	2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe	90
PID 2164 wrote to memory of 4704	2164	iexplore.exe	91
PID 4704 wrote to memory of 2620	4704	msedge.exe	92
PID 4704 wrote to memory of 5448	4704	msedge.exe	93
PID 4704 wrote to memory of 2564	4704	msedge.exe	94
PID 4704 wrote to memory of 2564	4704	msedge.exe	94
PID 4704 wrote to memory of 4104	4704	msedge.exe	95
PID 4704 wrote to memory of 4104	4704	msedge.exe	95
PID 4704 wrote to memory of 4104	4704	msedge.exe	95
PID 4704 wrote to memory of 1192	4704	msedge.exe	97
PID 4704 wrote to memory of 1192	4704	msedge.exe	97
PID 4704 wrote to memory of 1192	4704	msedge.exe	97
PID 4704 wrote to memory of 1908	4704	msedge.exe	98
PID 4704 wrote to memory of 1908	4704	msedge.exe	98
PID 4704 wrote to memory of 1908	4704	msedge.exe	98
PID 4704 wrote to memory of 2788	4704	msedge.exe	101
PID 4704 wrote to memory of 2788	4704	msedge.exe	101
PID 4704 wrote to memory of 4736	4704	msedge.exe	102
PID 4704 wrote to memory of 4736	4704	msedge.exe	102
PID 3340 wrote to memory of 1104	3340	tnlgdywqoifdbytq.exe	103
PID 4704 wrote to memory of 5600	4704	msedge.exe	106
PID 5004 wrote to memory of 588	5004	dbvtnlfdyv.exe	108
PID 3340 wrote to memory of 4788	3340	tnlgdywqoifdbytq.exe	113
PID 3340 wrote to memory of 3080	3340	tnlgdywqoifdbytq.exe	117
PID 5144 wrote to memory of 2456	5144	ysqkicayvq.exe	119
PID 3340 wrote to memory of 3400	3340	tnlgdywqoifdbytq.exe	122
PID 3340 wrote to memory of 5556	3340	tnlgdywqoifdbytq.exe	126
PID 984 wrote to memory of 1312	984	icaxspnhfd.exe	128
PID 3340 wrote to memory of 4728	3340	tnlgdywqoifdbytq.exe	131
PID 3340 wrote to memory of 5304	3340	tnlgdywqoifdbytq.exe	135
PID 5284 wrote to memory of 3908	5284	upnhfcxupn.exe	137
PID 3340 wrote to memory of 5820	3340	tnlgdywqoifdbytq.exe	141
PID 4704 wrote to memory of 1744	4704	msedge.exe	143
PID 4704 wrote to memory of 1412	4704	msedge.exe	144
PID 4704 wrote to memory of 1560	4704	msedge.exe	145
PID 3340 wrote to memory of 684	3340	tnlgdywqoifdbytq.exe	148
PID 3252 wrote to memory of 2616	3252	zxupmheczx.exe	150
PID 3340 wrote to memory of 704	3340	tnlgdywqoifdbytq.exe	153
PID 3340 wrote to memory of 5764	3340	tnlgdywqoifdbytq.exe	157
PID 2132 wrote to memory of 6048	2132	ezwurmgezw.exe	159
PID 3340 wrote to memory of 616	3340	tnlgdywqoifdbytq.exe	162
PID 3340 wrote to memory of 4808	3340	tnlgdywqoifdbytq.exe	166
PID 5300 wrote to memory of 1892	5300	wtrmjecwuo.exe	168
PID 3340 wrote to memory of 4900	3340	tnlgdywqoifdbytq.exe	171
PID 3340 wrote to memory of 3228	3340	tnlgdywqoifdbytq.exe	175
PID 1920 wrote to memory of 860	1920	ebztrojgby.exe	177
PID 3340 wrote to memory of 3680	3340	tnlgdywqoifdbytq.exe	180
PID 4704 wrote to memory of 1164	4704	msedge.exe	184
PID 4704 wrote to memory of 1164	4704	msedge.exe	184
PID 3340 wrote to memory of 5596	3340	tnlgdywqoifdbytq.exe	187
PID 3376 wrote to memory of 4264	3376	qoigdytqoi.exe	189
PID 3340 wrote to memory of 920	3340	tnlgdywqoifdbytq.exe	192
PID 3340 wrote to memory of 780	3340	tnlgdywqoifdbytq.exe	196
PID 3020 wrote to memory of 3420	3020	qnigayvtnl.exe	198
PID 3340 wrote to memory of 4428	3340	tnlgdywqoifdbytq.exe	201
PID 3340 wrote to memory of 1992	3340	tnlgdywqoifdbytq.exe	205
PID 4272 wrote to memory of 5576	4272	xvpnlfdays.exe	207
PID 3340 wrote to memory of 3920	3340	tnlgdywqoifdbytq.exe	210
PID 4704 wrote to memory of 5664	4704	msedge.exe	214
PID 4704 wrote to memory of 5664	4704	msedge.exe	214
PID 3340 wrote to memory of 956	3340	tnlgdywqoifdbytq.exe	215
PID 5248 wrote to memory of 4140	5248	fdxvpnhfzx.exe	217
PID 3340 wrote to memory of 4396	3340	tnlgdywqoifdbytq.exe	220

C:\Users\Admin\AppData\Local\Temp\2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_c82b3d192b50c7a8b3484b8e7a9453c3_amadey_darkgate_elex_smoke-loader_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Temp\tnlgdywqoifdbytq.exe
  C:\Temp\tnlgdywqoifdbytq.exe run
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3340
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbvtnlfdyv.exe ups_run
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1104
  - - C:\Temp\dbvtnlfdyv.exe
      C:\Temp\dbvtnlfdyv.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4080
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbvtnlfdyv.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4788
  - - C:\Temp\i_dbvtnlfdyv.exe
      C:\Temp\i_dbvtnlfdyv.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4068
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ysqkicayvq.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3080
  - - C:\Temp\ysqkicayvq.exe
      C:\Temp\ysqkicayvq.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5144
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2456
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ysqkicayvq.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3400
  - - C:\Temp\i_ysqkicayvq.exe
      C:\Temp\i_ysqkicayvq.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5764
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\icaxspnhfd.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5556
  - - C:\Temp\icaxspnhfd.exe
      C:\Temp\icaxspnhfd.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1312
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1660
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_icaxspnhfd.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4728
  - - C:\Temp\i_icaxspnhfd.exe
      C:\Temp\i_icaxspnhfd.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5580
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\upnhfcxupn.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5304
  - - C:\Temp\upnhfcxupn.exe
      C:\Temp\upnhfcxupn.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5284
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3908
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1308
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_upnhfcxupn.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:5820
  - - C:\Temp\i_upnhfcxupn.exe
      C:\Temp\i_upnhfcxupn.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5232
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxupmheczx.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:684
  - - C:\Temp\zxupmheczx.exe
      C:\Temp\zxupmheczx.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3252
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:2616
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5032
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxupmheczx.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:704
  - - C:\Temp\i_zxupmheczx.exe
      C:\Temp\i_zxupmheczx.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1404
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ezwurmgezw.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5764
  - - C:\Temp\ezwurmgezw.exe
      C:\Temp\ezwurmgezw.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2132
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:6048
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4396
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ezwurmgezw.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:616
  - - C:\Temp\i_ezwurmgezw.exe
      C:\Temp\i_ezwurmgezw.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1052
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\wtrmjecwuo.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:4808
  - - C:\Temp\wtrmjecwuo.exe
      C:\Temp\wtrmjecwuo.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5300
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:1892
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2980
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_wtrmjecwuo.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4900
  - - C:\Temp\i_wtrmjecwuo.exe
      C:\Temp\i_wtrmjecwuo.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5540
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebztrojgby.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:3228
  - - C:\Temp\ebztrojgby.exe
      C:\Temp\ebztrojgby.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1920
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:860
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2604
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebztrojgby.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:3680
  - - C:\Temp\i_ebztrojgby.exe
      C:\Temp\i_ebztrojgby.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1804
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qoigdytqoi.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:5596
  - - C:\Temp\qoigdytqoi.exe
      C:\Temp\qoigdytqoi.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3376
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:4264
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qoigdytqoi.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:920
  - - C:\Temp\i_qoigdytqoi.exe
      C:\Temp\i_qoigdytqoi.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5600
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\qnigayvtnl.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:780
  - - C:\Temp\qnigayvtnl.exe
      C:\Temp\qnigayvtnl.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        Executes dropped EXE
        
        PID:3420
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1440
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_qnigayvtnl.exe ups_ins
    3⤵
    - Executes dropped EXE
    PID:4428
  - - C:\Temp\i_qnigayvtnl.exe
      C:\Temp\i_qnigayvtnl.exe ups_ins
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2160
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\xvpnlfdays.exe ups_run
    3⤵
    - Executes dropped EXE
    PID:1992
  - - C:\Temp\xvpnlfdays.exe
      C:\Temp\xvpnlfdays.exe ups_run
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:5576
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5964
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_xvpnlfdays.exe ups_ins
    3⤵
    PID:3920
  - - C:\Temp\i_xvpnlfdays.exe
      C:\Temp\i_xvpnlfdays.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5704
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\fdxvpnhfzx.exe ups_run
    3⤵
    PID:956
  - - C:\Temp\fdxvpnhfzx.exe
      C:\Temp\fdxvpnhfzx.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5248
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4140
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2520
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_fdxvpnhfzx.exe ups_ins
    3⤵
    PID:4396
  - - C:\Temp\i_fdxvpnhfzx.exe
      C:\Temp\i_fdxvpnhfzx.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\smkfcxupnh.exe ups_run
    3⤵
    PID:424
  - - C:\Temp\smkfcxupnh.exe
      C:\Temp\smkfcxupnh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5208
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:1440
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1448
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_smkfcxupnh.exe ups_ins
    3⤵
    PID:1256
  - - C:\Temp\i_smkfcxupnh.exe
      C:\Temp\i_smkfcxupnh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5204
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\zxusmjhfcw.exe ups_run
    3⤵
    PID:1848
  - - C:\Temp\zxusmjhfcw.exe
      C:\Temp\zxusmjhfcw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3240
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:200
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2852
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_zxusmjhfcw.exe ups_ins
    3⤵
    PID:2860
  - - C:\Temp\i_zxusmjhfcw.exe
      C:\Temp\i_zxusmjhfcw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\pjhezwrpjh.exe ups_run
    3⤵
    PID:2084
  - - C:\Temp\pjhezwrpjh.exe
      C:\Temp\pjhezwrpjh.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:4824
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:4500
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:3412
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_pjhezwrpjh.exe ups_ins
    3⤵
    PID:3028
  - - C:\Temp\i_pjhezwrpjh.exe
      C:\Temp\i_pjhezwrpjh.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4696
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\ebwtomgeyw.exe ups_run
    3⤵
    PID:1180
  - - C:\Temp\ebwtomgeyw.exe
      C:\Temp\ebwtomgeyw.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:1496
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3588
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:2532
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_ebwtomgeyw.exe ups_ins
    3⤵
    PID:4768
  - - C:\Temp\i_ebwtomgeyw.exe
      C:\Temp\i_ebwtomgeyw.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4620
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\tolgeywqoi.exe ups_run
    3⤵
    PID:5532
  - - C:\Temp\tolgeywqoi.exe
      C:\Temp\tolgeywqoi.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3236
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1228
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_tolgeywqoi.exe ups_ins
    3⤵
    PID:2224
  - - C:\Temp\i_tolgeywqoi.exe
      C:\Temp\i_tolgeywqoi.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:796
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dbytqljdbv.exe ups_run
    3⤵
    PID:928
  - - C:\Temp\dbytqljdbv.exe
      C:\Temp\dbytqljdbv.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:3844
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2320
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:4956
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dbytqljdbv.exe ups_ins
    3⤵
    PID:3424
  - - C:\Temp\i_dbytqljdbv.exe
      C:\Temp\i_dbytqljdbv.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5984
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\yvqoigdxvq.exe ups_run
    3⤵
    PID:2712
  - - C:\Temp\yvqoigdxvq.exe
      C:\Temp\yvqoigdxvq.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2604
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:3064
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:1768
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_yvqoigdxvq.exe ups_ins
    3⤵
    PID:2800
  - - C:\Temp\i_yvqoigdxvq.exe
      C:\Temp\i_yvqoigdxvq.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5372
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\dxvsqnifay.exe ups_run
    3⤵
    PID:5812
  - - C:\Temp\dxvsqnifay.exe
      C:\Temp\dxvsqnifay.exe ups_run
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
    - - C:\temp\CreateProcess.exe
        
        C:\temp\CreateProcess.exe C:\windows\system32\ipconfig.exe /release
        5⤵
        
        PID:2828
      - C:\windows\system32\ipconfig.exe
        
        C:\windows\system32\ipconfig.exe /release
        6⤵
        Gathers network information
        
        PID:5116
- - C:\temp\CreateProcess.exe
    C:\temp\CreateProcess.exe C:\Temp\i_dxvsqnifay.exe ups_ins
    3⤵
    PID:5756
  - - C:\Temp\i_dxvsqnifay.exe
      C:\Temp\i_dxvsqnifay.exe ups_ins
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2372
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://xytets.com:2345/t.asp?os=home
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" -- "http://xytets.com:2345/t.asp?os=home"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ff885e5c188,0x7ff885e5c194,0x7ff885e5c1a0
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,3864504592357191240,12045717817182061775,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:11
      4⤵
      System Time Discovery
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,13745550964130311161,5894566566397097821,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:13
      4⤵
      PID:2564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13869303068802478958,10677512195812512023,262144 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
      4⤵
      PID:4104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,1676919803036550867,6098952863613152582,2097152 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
      4⤵
      PID:1192
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,4574183407127785384,16413436053902791104,2097152 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:1908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,13742134768266913618,15103255046597197051,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,12649972793461945328,11440754458584368549,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:4736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,13128338392964001211,9934973013011386513,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:1440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,13128338392964001211,9934973013011386513,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:14
      4⤵
      PID:5600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,8813303986004321023,4381327787745963190,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:14
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,15055743490637160713,8990623992515281228,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:14
      4⤵
      PID:1412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,18102105703184608600,8550646113154705701,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1156,i,9592459008082889176,17379902026789477686,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
      4⤵
      PID:1164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,6357759402308867976,6376377755003760992,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:14
      4⤵
      PID:5664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=912,i,6184523375564649283,9088098069648475057,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:14
      4⤵
      PID:2668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,4198813268943484449,18272362772463374838,262144 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:10
      4⤵
      PID:4068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,7762636675477748179,6408347415932255340,524288 --field-trial-handle=2616,i,9264557057808373870,4406633301603259848,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:14
      4⤵
      PID:1072

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:920

C:\Temp\tnlgdywqoifdbytq.sys
C:\Temp\tnlgdywqoifdbytq.sys
1⤵
- Executes dropped EXE
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:988

C:\Temp\igaysqkida.sys
C:\Temp\igaysqkida.sys
1⤵
- Executes dropped EXE
PID:2860

C:\Temp\faxvpnlfda.sys
C:\Temp\faxvpnlfda.sys
1⤵
- Executes dropped EXE
PID:2384

C:\Temp\smkfcxvpnh.sys
C:\Temp\smkfcxvpnh.sys
1⤵
- Executes dropped EXE
PID:1080

C:\Temp\zxrpnhezwu.sys
C:\Temp\zxrpnhezwu.sys
1⤵
- Executes dropped EXE
PID:2020

C:\Temp\kebzxuomke.sys
C:\Temp\kebzxuomke.sys
1⤵
- Executes dropped EXE
PID:1140

C:\Temp\urmjecwuom.sys
C:\Temp\urmjecwuom.sys
1⤵
- Executes dropped EXE
PID:4424

C:\Temp\gbztrljebw.sys
C:\Temp\gbztrljebw.sys
1⤵
- Executes dropped EXE
PID:2112

C:\Temp\wqolgdbztq.sys
C:\Temp\wqolgdbztq.sys
1⤵
- Executes dropped EXE
PID:5536

C:\Temp\yvqoigaysq.sys
C:\Temp\yvqoigaysq.sys
1⤵
- Executes dropped EXE
PID:3660

C:\Temp\vsnlfdavsq.sys
C:\Temp\vsnlfdavsq.sys
1⤵
- Executes dropped EXE
PID:3344

C:\Temp\fcausnkifz.sys
C:\Temp\fcausnkifz.sys
1⤵
PID:4068

C:\Temp\usmkfcxupn.sys
C:\Temp\usmkfcxupn.sys
1⤵
PID:2880

C:\Temp\cxupmkecwu.sys
C:\Temp\cxupmkecwu.sys
1⤵
PID:3176

C:\Temp\mkhbzwuomj.sys
C:\Temp\mkhbzwuomj.sys
1⤵
PID:4568

C:\Temp\mhezwjhbzt.sys
C:\Temp\mhezwjhbzt.sys
1⤵
PID:4944

C:\Temp\uolgebwtrl.sys
C:\Temp\uolgebwtrl.sys
1⤵
PID:5536

C:\Temp\lgeywqnlgd.sys
C:\Temp\lgeywqnlgd.sys
1⤵
PID:4128

C:\Temp\fdyvqoigay.sys
C:\Temp\fdyvqoigay.sys
1⤵
PID:5016

C:\Temp\lfdaysqnif.sys
C:\Temp\lfdaysqnif.sys
1⤵
PID:4248

C:\Temp\usqkicausn.sys
C:\Temp\usqkicausn.sys
1⤵
PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

dbvtnlfdyv.exe

Path C:\Temp\dbvtnlfdyv.exe
Size 384KB
SHA256 6df3d0df780196433cff45af81f1f1690a07739f7d5ad72b0a03118e8d165648
MD5 ac6b350800ee2ff8d5da93f600cbe56b
SHA1 4f1117d0d54a2f47624dcbecb3dd8bba29a14547
SHA512 fa6b5242029cd6bba45342921678198c66365ea95d2fdb99ccf31d692ac2e6d85588af4f285ccd6cc0303b3f7e0191a94387c617c40f2d932fbf1e451854ddc7
SSDEEP 3072:W1ItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9p9:+ItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T168848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ezwurmgezw.exe

Path C:\Temp\ezwurmgezw.exe
Size 384KB
SHA256 c2875b5a3253476d13e0aa485acc818b618847f882de81fde1b379a5ca0a84f4
MD5 615a4b158951cb1e9a408c6b7eccf5f9
SHA1 540f7d1abea3c1ee42a2208a81beb74b075a0c66
SHA512 ce11892df853f983d5fef386db935b1b3eb437ea74c1c40c8d98caada2ffbd42baa3b051b125478a79d03769039b1e516da3ca754d00419134a039898b91d20d
SSDEEP 3072:nItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:nItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1DE847B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

faxvpnlfda.sys

Path C:\Temp\faxvpnlfda.sys
Size 293KB
SHA256 5576a43b7c9326ba674ed05853ae30c2028870ced0fc18ecdd1786897b5e6bd8
MD5 b5b95089bbaf8b4feb8ca76609396b61
SHA1 63de20683ffa1eb79efac82c6dc7cba2e6905404
SHA512 07a2cbe1ed2bb3c2b1e4d781dcd90f8cf182a9dcc7ed7cb903f0d0cf84261602c37df4916a2bdd498b7760aab023a4260dee48875f1d2090cf33136f51ed03d9
SSDEEP 3072:EtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:EIJjiJcbI03GBc3ucY5DCSj
TLSH
T10A545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_dbvtnlfdyv.exe

Path C:\Temp\i_dbvtnlfdyv.exe
Size 384KB
SHA256 5c37c25b5ce76170c250e4b46e1b57498ff98019700d2ab6f1c7d15fa92fd619
MD5 ef14766dc833af69140a461f0e2eeeaf
SHA1 b50258aa9e0ffe5d56d39eb6562bbe37bf2cac2b
SHA512 995dccc89586d0c3b09aa1f318859f5a792db443db98ea1df044c7a5f4e865acb9130c237745e8cde12dad01ea3320872f3c904dee9e36dd9fd99af1aa624193
SSDEEP 3072:uItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:uItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T143848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ezwurmgezw.exe

Path C:\Temp\i_ezwurmgezw.exe
Size 384KB
SHA256 4c9a7fa4c0e0d5b9ef996faf2083506098b125453797d89b38953455832de653
MD5 5520f395ba8ddcb56f1ea1b535d2378d
SHA1 41cb05aeda9e75c64154d5f97fde70c09818fe48
SHA512 2d638ede65281d70d6861a99835e3ceaa0de84cb9f0e6de5cf90c711639608d699ab40aa2f297ed66c75c0a475143771f88f039d452ab5a26eae280ebf379227
SSDEEP 3072:yItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:yItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1CD848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_icaxspnhfd.exe

Path C:\Temp\i_icaxspnhfd.exe
Size 384KB
SHA256 c879a3726ef0bea1432189f376f77128291aa2953a02bac6e71ebb9aa34a353a
MD5 607ee75198a66840648ebde4e3660cab
SHA1 7937b45ea5246da4cdc36af23485de6b893fcc37
SHA512 7ef51b98b898ad6cc4e67fafd89b43a3379a16d1f167efc9a3694268ed4773bd2c6bb6a28a0b6d8afcd83229a6dafafbdbcccbb9ab138b91c20f45ab713260ce
SSDEEP 3072:aItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:aItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1BC848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_upnhfcxupn.exe

Path C:\Temp\i_upnhfcxupn.exe
Size 384KB
SHA256 f1d4e4ef77e221ff4111845d4a1e86707a4bc42314627ba232e520431bc4d216
MD5 fa8994d2734a36935f9b5f26b41629a4
SHA1 9ddf921ab6f0c081380017404e0b821830d9f622
SHA512 e71fd2d427334d78d4c2b3c2a8ab795785a1f0de4fc84a61364264523e377354ad3e9636e87979c92b250c0aa36edf8cdaca093e992ef86c4d95a1e0b6cdf858
SSDEEP 3072:oItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:oItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T199847B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_ysqkicayvq.exe

Path C:\Temp\i_ysqkicayvq.exe
Size 384KB
SHA256 c314e3476539c60ba2e9e283ba5b9d9a35f8e29ecdc7734a9cfd121d4ccbfb3d
MD5 be25b69a64a75617319c11a54ba2bcb4
SHA1 a179a028dfa3cc3d43e884bb246a6fa24d8eec50
SHA512 a05f1cbccf47d19ff51a6d96ba034e080d5254b1ad66de5df773e6fd6d985e9af9d1f6a5a8b15f702e1bcced0e4e89135dc37b1c3a4c11dcb4d085455a8e9230
SSDEEP 3072:TItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:TItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T189848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

i_zxupmheczx.exe

Path C:\Temp\i_zxupmheczx.exe
Size 384KB
SHA256 bc375e3dd751ba38a6e62b5dcd101436c0da7254db4183c18c85246dc02a6a84
MD5 d87e2b1d1b5181c8d8b8ae67665583c8
SHA1 312109346882a642b96b4a6d1d1a12607e1d7600
SHA512 a3e9fab27caa8b4d2fb74aaf8ded13a01a72b7c684398347f043b2c27a2e58e663ea556f50abc5c18014d86103f657fdaf775e67278ca0bce4a53004761aa3c3
SSDEEP 3072:QItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:QItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1A2847B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icaxspnhfd.exe

Path C:\Temp\icaxspnhfd.exe
Size 384KB
SHA256 32f3384f8b8b4a87e7de87511dbe136354f18d7fab648840b92b49911161d9de
MD5 103e137a581ad3606903d8bf6c44afa8
SHA1 2c6c26e0c39a5d5be444cc9d51fedf516ce95248
SHA512 fe902b34748e8f95de96cf3072cd313d10d59fc5e31f3525e6760ffdaa04c2c517a637e318532675f1ab3241eff81322b2fa0e6ec7d6b2d9e47f3dc5420aa6e2
SSDEEP 3072:zItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:zItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T18F848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

igaysqkida.sys

Path C:\Temp\igaysqkida.sys
Size 293KB
SHA256 4afae6085f2044cdf72a8291974319c7603a67695bb0dfafc94cbf865ef7d226
MD5 041683cfa94cb5dd8f2b1030255e054c
SHA1 2c69eb2adb27471ea5bd86c20980a763652bb7a0
SHA512 d01b27597dd735868429136c0ed5c0aaeebdaf6a23110aa3376f3d486f56c10ea5f2cfb74e7dfdaa547f844ed4a71943c46477f4d576db67840426668c22d984
SSDEEP 3072:VtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:VIJjiJcbI03GBc3ucY5DCSj
TLSH
T1F4545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kebzxuomke.sys

Path C:\Temp\kebzxuomke.sys
Size 293KB
SHA256 13562527a4cd234c65ed5431df791f909d5deea26814524c92048cb59df37d94
MD5 93a6805ede1e5bbcf7d6a0d3f8876283
SHA1 85446b9f21339b2798ed2ce272daf88e15326862
SHA512 a4336ca2eaf803fb687130a31363db2307d1040195f5985394e570b38bd89c1cd72dff14fde04f3d05ec033f4447fb75cbf5b3313cbaa8d2ea501af3c7edecf1
SSDEEP 3072:ptKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:pIJjiJcbI03GBc3ucY5DCSj
TLSH
T150545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

smkfcxvpnh.sys

Path C:\Temp\smkfcxvpnh.sys
Size 293KB
SHA256 ac5fdee3fb8dfceecb2d0ec196440a831315b2a8a840be81f889abf51a0c37ed
MD5 b8041fb8491bd235330d799e64a717d8
SHA1 7b61d15318299add0e19a6ecb167838ae1a552b8
SHA512 ccee4fa1c5fd3f59f726a65cda13bcfb4455c704dc236f5fa28eab339b42a96b28d3c6d4abef24780eee2f0fe2b880062880fb00fbc134975dac724ec3cf5897
SSDEEP 3072:mtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:mIJjiJcbI03GBc3ucY5DCSj
TLSH
T1A2545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoifdbytq.exe

Path C:\Temp\tnlgdywqoifdbytq.exe
Size 384KB
SHA256 430fe340e600c2ac1dc764ec0f93af3dc34d9055370cf92d0128593eab5d4f13
MD5 3000a7cb2ef54fdf44beaf40c51b7d98
SHA1 15f8927958587c27b1d525743185121f47a8864e
SHA512 bd67128f2b596ba3dd4a3c932967937d555c469d5dcf8a0ebfb6912ebd1fb8bc22ea09c0c5da8c7156bf6ec563b17cff3d84c25dca6f033fe36dddc6c1a1148d
SSDEEP 3072:qItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:qItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1D1848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tnlgdywqoifdbytq.sys

Path C:\Temp\tnlgdywqoifdbytq.sys
Size 293KB
SHA256 2342d1a7af50761345f5a1550f8a6b0e54c520191c8d4914cce1ab2dc8693b63
MD5 b3ad17d363ca7096fe6826cb4c92542c
SHA1 b8c36adee45a17827a31ece4a02d452b72db7c78
SHA512 55336c5963599f85bc3a2a68f28cd5705a4ecb9aba25d95998965f10388ec06eb8d8a8432aa03358412e7a91f04e18106dd5d3b0701e50800347ae041faff256
SSDEEP 3072:YtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:YIJjiJcbI03GBc3ucY5DCSj
TLSH
T1DE545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upnhfcxupn.exe

Path C:\Temp\upnhfcxupn.exe
Size 384KB
SHA256 a91257db9b85dea2277cd01d117d5040ae36ca65507d83438451f624430e6b29
MD5 2f303fba77c95d7423cc4795cc61e19a
SHA1 c752a8dba61431c86af2d80dfc8b77d93c0e429f
SHA512 a9d6edef85e4f404d44bf1db27651c04d6415e7d7d6b72ee4b2799301a028164c3adfb88a6c6708a99a4d1823492278cee4d35e107f96640f55f33e1af5649e8
SSDEEP 3072:fItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:fItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T14F847B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urmjecwuom.sys

Path C:\Temp\urmjecwuom.sys
Size 293KB
SHA256 d1c05680036d23b5da8a536830592e221fcf62a6ca311bb7cf0552cbe2d22aac
MD5 40b0dc45a3f9e6422bc54bfcad1b5c1c
SHA1 9376cc96d941b4abb5cc83c56d36bb8d87e097f8
SHA512 8eadad007503f19ed14700b827e9b5fb849300ca448c60a13d33de0e160030dbd781ed8641cec6f54037d17e3ee30d793580fe296476ec66445397e0839fff06
SSDEEP 3072:wtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:wIJjiJcbI03GBc3ucY5DCSj
TLSH
T1C8545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ysqkicayvq.exe

Path C:\Temp\ysqkicayvq.exe
Size 384KB
SHA256 05c414341e05c2bcc151d654ba8c9058010c76c2565c0e669769d4ce54c34878
MD5 b60e5b5d0b665d1e99fe04ef50e4a07c
SHA1 084b1526ddfc0a0852bfcb415837ddb29a1c1369
SHA512 588d6ede4762dc79fcbd1f294d2b393b2372e0c8f6fae68ee49de27a6db1623721c6a7c46ee7c1f9c22b6ec45d2992e24da7ac11179df5cf74d31d7b9c00ddbc
SSDEEP 3072:gItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:gItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T181848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxrpnhezwu.sys

Path C:\Temp\zxrpnhezwu.sys
Size 293KB
SHA256 8d0ce273265cbd6f04e4ad1a29c4b5863177931565a28ae1d418015c903a98ff
MD5 298d2f63152f0c64ff66ae21cd544705
SHA1 d2bba4c0c390421e595319298303a78ae7ff3000
SHA512 810b0c4a0b2943574e70ba2ca381af8238aa6128b8d140d266ba8117b0225849d09124d4e0088a73405aed8a991883181b4ac18a8a114372014be636039fc8f3
SSDEEP 3072:qtKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pypSwbYtlZ9EdV:qIJjiJcbI03GBc3ucY5DCSj
TLSH
T107545B44AAA4B0F6D9D5043C01EFAF3A967EB4281726CBC3E354CE5D99017C7A93069F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxupmheczx.exe

Path C:\Temp\zxupmheczx.exe
Size 384KB
SHA256 439078b146bd4ce03497150287a469fbc3698ac5236f1e55e12de1217719410f
MD5 589f8b4d2302b1d64567d7000094581a
SHA1 1520b77acf08084bfb8cee7c456706c47f8ae960
SHA512 d4017f109e3cb65bf847ca8dd26772d66d8af23fc4ba2c92c8e66daa86ac333621e2902a2f0441c716de31bf57f1e66edd091158b8ea81bac88a01ec92f8f56f
SSDEEP 3072:9ItJPraMD4y5tKOsNi6cWgOEkbaFKnjiqQnjwbufspN3GGomU3/03ucYfBLx9pyj:9ItZHIJjiJcbI03GBc3ucY5DCSjX
TLSH
T1E9848B01BAA4F0B6D894043800EFAF36A67EB4281726CBC7F754CE5D99513C3A93569F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 15887081dfc378ed34379747a8ee71c0f5a038a70062960bc63c6a1991b3c379
MD5 fec035551feb32c06daa0fe83886c7a4
SHA1 78378b25f72bd82f6c1f237591e6c98f13cf478f
SHA512 fbdc77e5e370f59e23b9f4184a17b9bb85b8f037a25a9b5fa91fbb46c7d7d9262e6a1d5b18a50c752dc63fdcf4b22b05e4bf12b56bcdcb1d01050565e8711a36
TLSH
T19141BDF783F4856E8A1195F0AA18BE2BCE1C0515832C7D9AC9E0AE5793E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6ba5bc46cd4f1bd5abd1049fe362aa6e5cc8d916eae62a5d948da6dd6542f227
MD5 e9448197d9cefa61b39b707cf2306478
SHA1 02029045269c697e39cdf600d31178d78db69e73
SHA512 029e16b7bd2ace5b7d0d1fa114693021e89b08f74739258d51a495ab17f458c4556b12683385f1c83346da53e021a99e51474ae3e1072afcb68c06281de10ba9
TLSH
T18F41CDF383E4856E8A1195F0AA18AE2BCE1C0915832C3D5AC9E4AF5B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6a126ff8239a0ccda45d38a3e448d595ec6d22dd12fc34e1a5a655ad3539779d
MD5 720045133160b93f600c7f5389ed1dbe
SHA1 4359f21b6a57909c77c368948b77b4fafc0f7b42
SHA512 2d9311ef8be928d3ad6a027b2e2290c958e59942a650bc8678f7ecf6d9914ba9707e3c7806f74176ae5f2c4a6108d98cbf5fdbdaefe13c56bedc42f1767039e0
SSDEEP 384:sxRF7bqnAv/f1VsihtnsGr4td9/5+/aEw:sR7WnAv/f15tsGrAz/5Ec
TLSH
T15072D81A69245D3B8CDBD219FA56BF63D7F81173A2904E44AAFC8A0C01E76DD211783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f1848744b6bee051246c25c3e210cd8f4994c8a9cc0dd20df101a13e64e7ee2c
MD5 b0330f141c376264f7f6451988f2cc35
SHA1 80b95251bd05578789c9333351d53e213325d0f9
SHA512 75b3bbe9c0def19c5fc8d93483110d5fab2b901a5e656a8cad618a11584f0a3235e789730297a4f5c3275366b09be80b7053cfa16b36543ac8f3b4d1c3c7fde4
SSDEEP 192:sxRVlh7RIzyMqZjK1Ml8wcYhI6/fzhVsnih3zpZsGJlsJwshszoA8prVT/g6+WN9:sxRF7bCAv/f1VsihjnsGr4td9/5+/qj1
TLSH
T1CE72D81A6A245D3B8CDBD219FA55BF63D6F81173A2904E44AAFC8A0C05E76DC211783F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ba23ef767a85427697afea64ea4d671762eb29c5928b63ee440ac0f0d9d0e43a
MD5 57f61c1363e91ebe7e812eeee0f072fe
SHA1 4f93dfa8df0de491ec0bc8ba183f5d4a1b1eecff
SHA512 7f506dcb6598e8a2d84b784a99be8d8e06a14543fdfea3fe5950bde235d4c18ab53f2813f99fd08368465fc826b75113cdfd7e422351c72871613cad093b89b3
SSDEEP 768:RGqO3j7pLuL7yrWgzvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlu7z9wQroPwbr:RGqO3VE7yrWgzvfiXu1jaSu7pw7Pwbr
TLSH
T158E2FC3B680CC77E4F804A9CEC29BE9B6DA802CF56D8895447EE844C03C7AFB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e126a9b0395fdbfa8007bf03f2e6b63ee950f453142cdac20e09c0ba3767de84
MD5 e145a79ea1b0abd199193f46b7758372
SHA1 b178a809f6730efb73fed35fc6a797493fab0c2b
SHA512 9d2f7ffc6221190e3a7dc3e4072dfc331fbbd12ceff9022b19f4cdb6fac94fb821ec2d6c4f9729fb7b0ac69bc6c5e3e45bd33a8c919465e6835845e9ccce6562
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83Mtr:aR55IlHnOLRXxxinhfB
TLSH
T144B2C05171BA2700387E290D9379D42F194630A270DEA87B3BA835D26F67E005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 105ea411e449a029c44121e2e4b0a93d66d5a3429c95d2c6fc74e2c261e02e6b
MD5 94847f8fea5bfbd3495a23cfb66d8ee6
SHA1 558f01d98d66a3621daefa5abe20caa696e8c7fd
SHA512 5f7ae6d3817d4c511552c582ee3e592a05341874b8369c6b2a7d2842d16d525227d09b30f91003b9e939bd2b0ee2ea04c42e0bc46e7db2277c29c625268f2c6f
SSDEEP 384:nGiF1tNn/s3n9SsD8NS8TUNTUlIRYYznNV9HXYfo1GqXdfl071FYc0mn15wbAjE+:tF1j+9R3wgPXGqXdy7oc0mn12bfJ9q
TLSH
T1A3C24A36D8A4CABBECE78FC9B70A7646EEE40263859C19D4DAD85D4D01C32DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5d50212c0629c84ff2101d7511ce693b0dbd5413fc0cf8620545f023784cd25c
MD5 48ef2683b78c5534a39ce83229ee01cc
SHA1 b8068eb3a3c90cbc72162b87f9d1d95a7c0732f2
SHA512 e72ef6069522b8829d2f6bf661a859290fd812fc0245150e6ddc537e1f65e241c022ebf50a466d6861e22d31c4ddb56e1fc0ec106ea2a0a3ebb5c8d6cce8eaa6
SSDEEP 384:nTiF1tNn/s3n9SQ8N+8TUNTUlIR3znNdHlfXYfo1GqXdfl071FY3E+mX0IidKzv1:+F1j+9FvwgRFvGqXdy7ozm78Kz1
TLSH
T1EAD24A36DCA1CEBBDCE68BC8B70A7A46EEE012A385885DD4E6D85D4C01C72DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 030da05a3f96129acbe550aae2e585e3a414304a8a47d18b9dfccc0e71bb4cca
MD5 77bbe47c6ad15cf460c89725a3359e0d
SHA1 235ea079d66982eab3264d0febfb250774e26dbc
SHA512 3bc7596e9c01ed1b4f9028af5b9d8cf4a5f30cecb656ebcddf7c21a6684a07835a1b9e2434ae9b74fded45cd52b43b02c030611501be92375ff8e944db1659aa
SSDEEP 384:nDiF1tNn/s3n9SG8N+8TUNTUlIRnznNd5ufXYfo1GqXdfl071FY3E0mX0IidKzvQ:uF1j+9Hvwg9IvGqXdy7oLm78KzQ
TLSH
T132E2C3F198D38A76D89E4B87633E6E469EFCC263B5885984F7C81D0CCC861BFD206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 5c88dd8b14477f60f519ba54b054c2dc9780f4a34ed5ec191686498e38f8c9a5
MD5 e9208816c1af42ea71bc876f59eb7328
SHA1 217516d809d7b14a9ff338eb109207e5b7e0d36b
SHA512 6ad10af028d0d4559c89c41256a02da97c83f82cd4c912b7527f8e8e4d502133974e8dbce081a8b0e82df8ea29ff71f0087ae04a70ecf360a201e2abf39d4ef2
TLSH
T17B3120E098392DD2D0BE0DAF649728FC94D8C726F49834796854ED98563D15E268087F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 67dc20a8dca6a78c0bb6d2fe871ba2425500bf0ab41e69d4f6e25096b823c979
MD5 25499f8cf2aded11b02d0ccb8fb39856
SHA1 4c108669b22502ccfd4503c29048a4e034293f62
SHA512 2c7355ec30e6bee7ab905af3cba817c206a78d1e5bde7c4b60ac9ed035539eb3825448671d3c71a6997f3cdc229b9d553a24193ce99b6072d5726d0ea45837e6
TLSH
T1D93140E088392DD1D0BD0CAF748B24FC94D8C722F494347D6868E998867D55D268083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 60dfefc08fd06b961472bdaa4555e96ba9fc056b83160e98337cd1bdbed34eee
MD5 73c9b2609547962d2bad4f0371116ec9
SHA1 35024f3b15fce589dd9a3a7e4e9957d4c11dd6cd
SHA512 d387db0caed0c72fa8d292d215e1d7eba4b3ef9e11be0468fc9c4af2f4d0020ad1ae3a633588e4fa9bac781b3a06d677ad6f731a36093ebee397e4aed43f92a7
TLSH
T1013141F18C392DD2D47E0CAFA04B29FC94E8D326F4A474386858ED98563D55E264087F
MD5 SHA1 SHA512 TLSH

Submit Download

CreateProcess.exe

Path C:\temp\CreateProcess.exe
Size 3KB
SHA256 496a5d432443b4af03729cb823fd4b987bc556d24aa19222cc3ae2455b3a52f4
MD5 52e616d387b66c67749ed1a210227f8c
SHA1 82c3783b275a60edf9302a5ed92b1bb3125ecf83
SHA512 cade136700fc0743a587300afcba18f0cc43eeccb8fb9d80de53699232e17e6f5d66eef7eaab55e51a61c0e713ee57635e46ccdc70b5b4413d33baeb5199cf7c
TLSH
T14571C08356A9D5B3C59A9FF102835644F6FB22380B6370240B95559AAB70A7A68B8F04
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1080-217-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/1140-246-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2020-230-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2112-287-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2384-197-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-182-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2664-59-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2860-156-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/2880-338-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3176-356-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3344-315-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/3660-295-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4068-327-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4128-396-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4248-425-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4424-282-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4568-360-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/4944-371-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5016-408-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5536-391-0x0000000000010000-0x00000000000AB000-memory.dmp

Download

memory/5536-291-0x0000000000010000-0x00000000000AB000-memory.dmp

Download